diff options
Diffstat (limited to 'changelogs/unreleased')
4 files changed, 20 insertions, 0 deletions
diff --git a/changelogs/unreleased/security-10io-multipart-check-brackets-balance-in-param-names.yml b/changelogs/unreleased/security-10io-multipart-check-brackets-balance-in-param-names.yml new file mode 100644 index 00000000000..e0d1a4e535d --- /dev/null +++ b/changelogs/unreleased/security-10io-multipart-check-brackets-balance-in-param-names.yml @@ -0,0 +1,5 @@ +--- +title: Validate each upload param key in multipart.rb +merge_request: +author: +type: security diff --git a/changelogs/unreleased/security-255886.yml b/changelogs/unreleased/security-255886.yml new file mode 100644 index 00000000000..8fe8da59444 --- /dev/null +++ b/changelogs/unreleased/security-255886.yml @@ -0,0 +1,5 @@ +--- +title: Path traversal to RCE via LFS upload +merge_request: +author: +type: security diff --git a/changelogs/unreleased/security-container-regex-backtrack.yml b/changelogs/unreleased/security-container-regex-backtrack.yml new file mode 100644 index 00000000000..c88fd526d47 --- /dev/null +++ b/changelogs/unreleased/security-container-regex-backtrack.yml @@ -0,0 +1,5 @@ +--- +title: Update container_repository_name_regex to prevent catastrophic backtracking +merge_request: +author: +type: security diff --git a/changelogs/unreleased/security-kubernetes-agent-internal-api.yml b/changelogs/unreleased/security-kubernetes-agent-internal-api.yml new file mode 100644 index 00000000000..9ed192e90cc --- /dev/null +++ b/changelogs/unreleased/security-kubernetes-agent-internal-api.yml @@ -0,0 +1,5 @@ +--- +title: Prevent private repo from being accessed via internal Kubernetes API +merge_request: +author: +type: security |