CVE-2019-10112: Weak Encryption
Published May 16, 2019
·Updated
An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The construction of the HMAC key was insecurely derived.
Affected Software
6 affected components
GitLab GitLab<11.7.8
GitLab GitLab<11.7.8
GitLab GitLab>=11.8.0<11.8.4
GitLab GitLab>=11.8.0<11.8.4
GitLab GitLab>=11.9.0<11.9.2
GitLab GitLab>=11.9.0<11.9.2
Event History
May 16, 2019
CVE Published
via MITRE·03:11 PM
Data Sourced
via MITRE·03:11 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-10112?
CVE-2019-10112 is classified as a high severity vulnerability due to its potential impact on the security of HMAC key construction.
2
How do I fix CVE-2019-10112?
To fix CVE-2019-10112, upgrade GitLab to version 11.7.8, 11.8.4, or 11.9.2 or later.
3
Which versions of GitLab are affected by CVE-2019-10112?
CVE-2019-10112 affects GitLab Community and Enterprise Editions prior to versions 11.7.8, 11.8.4, and 11.9.2.
4
What type of vulnerability is CVE-2019-10112?
CVE-2019-10112 is an information disclosure vulnerability related to insecure HMAC key construction.
5
Are both GitLab Community and Enterprise Editions affected by CVE-2019-10112?
Yes, both GitLab Community and Enterprise Editions are affected by CVE-2019-10112 in specified versions.