Skip to content
Snippets Groups Projects
.cveignore 1.22 KiB
# ncurses/5.9
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5826
CVE-2019-17594
CVE-2019-17595
CVE-2019-15547
CVE-2019-15548

# libxml2/2.9.10
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5866
CVE-2019-20388
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5867
CVE-2020-7595

# libxslt/1.1.32
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5824
CVE-2019-11068
CVE-2019-5815

# bzip2/1.0.6
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5825
CVE-2019-12900
CVE-2016-3189

# unzip/6.0
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5827
CVE-2016-9844
CVE-2018-18384
CVE-2019-13232

# gnupg/2.2.10
CVE-2019-13050
CVE-2018-1000858
## https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5211
CVE-2019-14855

# openssl/1.1.1g
# Doesn't apply to omnibus-gitlab. Requires openssl version 1.1.1 or later to be used with Apache HTTP Server version 2.4.37, and
# thus for users who bring their own Apache webserver. Even so, the fix is in
# Apache httpd 2.4.38 and not openssl. Hence, ignoring. Check details in
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5793#note_442221086
CVE-2019-0190
# False positives
CVE-2019-1543
CVE-2017-3736

# Entries from CVEIGNORE variable go below this line