It would be nice to know what versions are affected now but I can understand that they may not want to reveal that until it's patched to prevent any unauthorized access of private repositories.
The following versions are affected:
8.7.0
8.6.0 through 8.6.7
8.5.0 through 8.5.11
8.4.0 through 8.4.9
8.3.0 through 8.3.8
8.2.0 through 8.2.4