CVE-2019-19629: High severity gitlab vulnerability
Published Jan 5, 2020
·Updated
In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by the Elasticsearch integration.
Affected Software
3 affected components
GitLab GitLab>=10.5.0<=12.3.8
GitLab GitLab>=12.4.0<=12.4.5
GitLab GitLab>=12.5.0<=12.5.3
Event History
Jan 5, 2020
CVE Published
via MITRE·09:54 PM
Data Sourced
via MITRE·09:54 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-19629?
CVE-2019-19629 is considered a medium severity vulnerability due to the potential exposure of private code.
2
How do I fix CVE-2019-19629?
To fix CVE-2019-19629, upgrade GitLab EE to version 12.5.4 or later.
3
What versions of GitLab are affected by CVE-2019-19629?
CVE-2019-19629 affects GitLab EE versions from 10.5 through 12.5.3 and certain versions of 12.4 and 12.3.
4
What type of information is exposed in CVE-2019-19629?
CVE-2019-19629 may lead to private code being disclosed when transferring a public project to a private group.
5
Is the Group Search API vulnerable due to CVE-2019-19629?
Yes, the Group Search API is accessible and may expose private code due to CVE-2019-19629.