GitLab Security Releases

<br />
<b>Deprecated</b>:  Function get_magic_quotes_gpc() is deprecated in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>99</b><br />
<br />
<b>Deprecated</b>:  The each() function is deprecated. This message will be suppressed on further calls in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>619</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>832</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in <b>/hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php</b> on line <b>839</b><br />
<?xml version='1.0' encoding='utf-8' ?>
<feed xmlns='http://www.w3.org/2005/Atom'>
<title>GitLab Security Releases</title>
<id>https://about.gitlab.com/releases</id>
<link href='https://about.gitlab.com/releases/categories/releases/' />
<updated>2025-10-16T00:00:00+00:00</updated>
<author>
<name>The GitLab Team</name>
</author>
<entry>
<title>GitLab Patch Release: 18.4.2, 18.3.4, 18.2.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/</id>
<published>2025-10-08T00:00:00+00:00</published>
<updated>2025-10-08T00:00:00+00:00</updated>
<author>
<name>Kat Wu</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today, we are releasing versions 18.4.2, 18.3.4, 18.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, please visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. To maintain good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-11340---incorrect-authorization-issue-in-graphql-mutations-impacts-gitlab-ee&quot;&gt;Incorrect authorization issue in GraphQL mutations impacts GitLab EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-10004---denial-of-service-issue-in-graphql-blob-type-impacts-gitlab-ceee&quot;&gt;Denial of Service issue in GraphQL blob type impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-9825---missing-authorization-issue-in-manual-jobs-impacts-gitlab-ceee&quot;&gt;Missing authorization issue in manual jobs impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-2934---denial-of-service-issue-in-webhook-endpoints-impacts-gitlab-ceee&quot;&gt;Denial of Service issue in webhook endpoints impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cve-2025-11340---incorrect-authorization-issue-in-graphql-mutations-impacts-gitlab-ee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-11340&quot;&gt;CVE-2025-11340&lt;&#x2F;a&gt; - Incorrect authorization issue in GraphQL mutations impacts GitLab EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scoped GraphQL mutations.&lt;br &#x2F;&gt;
&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab EE: all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 7.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;bwill&quot;&gt;Brian Williams&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-10004---denial-of-service-issue-in-graphql-blob-type-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-10004&quot;&gt;CVE-2025-10004&lt;&#x2F;a&gt; - Denial of Service issue in GraphQL blob type impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could make the GitLab instance unresponsive or degraded by sending crafted GraphQL queries requesting large repository blobs.&lt;br &#x2F;&gt;
&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 7.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-9825---missing-authorization-issue-in-manual-jobs-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-9825&quot;&gt;CVE-2025-9825&lt;&#x2F;a&gt; - Missing authorization issue in manual jobs impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users without project membership to view sensitive manual CI&#x2F;CD variables by querying the GraphQL API.&lt;br &#x2F;&gt;
&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 5.0 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-2934---denial-of-service-issue-in-webhook-endpoints-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-2934&quot;&gt;CVE-2025-2934&lt;&#x2F;a&gt; - Denial of Service issue in webhook endpoints impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue impacting an upstream Ruby Core library that could have allowed an authenticated user to create a denial of service condition by configuring malicious webhook endpoints that send crafted HTTP responses. This issue was reported to Ruby Core maintainers on July 17, 2025.&lt;br &#x2F;&gt;
&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 4.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ppee&quot;&gt;ppee&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1842&quot;&gt;18.4.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206259&quot;&gt;Backport of &#x27;Added safety chaining to pipeline helper&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206057&quot;&gt;Workhorse: Improve large HTTP handling for DWS proxy&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206161&quot;&gt;Backport of &#x27;Fix: no implicit conversion of String into Array&#x27; in Geo::Event workers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206330&quot;&gt;Backport: Fix agentic chat&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206833&quot;&gt;[18.4] Clear detached partitions before tests run&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206915&quot;&gt;Backport &#x27;Fixes target projects endpoint 404 on compare revisions view&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206962&quot;&gt;Transfer start and due dates data upon work item move or clone&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207052&quot;&gt;Backport of &#x27;Fix reassignment dropdown in CE&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206778&quot;&gt;Transfer health status data upon work item move or clone&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206999&quot;&gt;Backport of Revert &quot;Merge branch &#x27;ai-catalog-item-consumers-graphql&#x27; into &#x27;master&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206860&quot;&gt;Backport of CI_MERGE_REQUEST_DIFF_BASE_SHA not updating on branch change&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206979&quot;&gt;Backport of &quot;Use key-value structure in Release Environment MR label script&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206163&quot;&gt;Backport of &#x27;Fix Start free trial link for self-managed instances&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207013&quot;&gt;Update dependency gitlab-fog-azure-rm to &#x27;~&amp;gt; 2.4.0&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207283&quot;&gt;Backport of &#x27;Remove non Saas instances from calling CDOT for trial duration&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206520&quot;&gt;Backport of &#x27;Remove check_f02a3f53bf not null constraint&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207685&quot;&gt;18.4 backport of &#x27;Remove unknown licenses from sbom dependency list export&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207445&quot;&gt;[18.4] Fix json validation for elasticsearch_aws_role_arn&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207245&quot;&gt;Backport: Change the model selection FF used for self managed&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207794&quot;&gt;[18.4] Prevent session creation for sessionless users&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8741&quot;&gt;Add a gitlab::config alias for package::config recipe&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1834&quot;&gt;18.3.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206060&quot;&gt;Workhorse: Improve large HTTP handling for DWS proxy&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206834&quot;&gt;[18.3] Clear detached partitions before tests run&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206918&quot;&gt;Backport &#x27;Fixes target projects endpoint 404 on compare revisions view&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206961&quot;&gt;Transfer start and due dates data upon work item move or clone&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207053&quot;&gt;Backport of &#x27;Fix reassignment dropdown in CE&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206776&quot;&gt;Transfer health status data upon work item move or clone&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206980&quot;&gt;Backport of &quot;Use key-value structure in Release Environment MR label script&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207014&quot;&gt;Update dependency gitlab-fog-azure-rm to &#x27;~&amp;gt; 2.4.0&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207288&quot;&gt;Backport of &#x27;Remove non Saas instances from calling CDOT for trial duration&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207687&quot;&gt;18.3 backport of &#x27;Remove unknown licenses from sbom dependency list export&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8755&quot;&gt;Update docs hugo jobs&#x27; image to use latest image&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1828&quot;&gt;18.2.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205903&quot;&gt;[18.2] Allow elastic client adapter to be set&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206835&quot;&gt;[18.2] Clear detached partitions before tests run&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206958&quot;&gt;Transfer start and due dates data upon work item move or clone&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207054&quot;&gt;Backport of &#x27;Fix reassignment dropdown in CE&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206775&quot;&gt;Transfer health status data upon work item move or clone&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206981&quot;&gt;Backport of &quot;Use key-value structure in Release Environment MR label script&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207015&quot;&gt;Update dependency gitlab-fog-azure-rm to &#x27;~&amp;gt; 2.4.0&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207448&quot;&gt;[18.2] Fix json validation for elasticsearch_aws_role_arn&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;207688&quot;&gt;18.2 backport of &#x27;Remove unknown licenses from sbom dependency list export&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206928&quot;&gt;Backport of &#x27;Fix Start free trial link for self-managed instances&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8754&quot;&gt;Update docs hugo jobs&#x27; image to use latest image&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;important-notes-on-upgrading&quot;&gt;Important notes on upgrading&lt;&#x2F;h2&gt;

&lt;p&gt;This patch includes database migrations that may impact your upgrade process.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;impact-on-your-installation&quot;&gt;Impact on your installation:&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;strong&gt;Single-node instances&lt;&#x2F;strong&gt;: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;strong&gt;Multi-node instances&lt;&#x2F;strong&gt;: With proper &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;zero_downtime.html&quot;&gt;zero-downtime upgrade procedures&lt;&#x2F;a&gt;, this patch can be applied without downtime.&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;post-deploy-migrations&quot;&gt;Post-deploy migrations&lt;&#x2F;h3&gt;

&lt;p&gt;The following versions include post-deploy migrations that can run after the upgrade:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;18.4.2&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;To learn more about the impact of upgrades on your installation, see:&lt;&#x2F;p&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;zero_downtime.html&quot;&gt;Zero-downtime upgrades&lt;&#x2F;a&gt; for multi-node deployments&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;update&#x2F;package&#x2F;#downtime&quot;&gt;Standard upgrades&lt;&#x2F;a&gt; for single-node installations&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 18.4.1, 18.3.3, 18.2.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/09/25/patch-release-gitlab-18-4-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/09/25/patch-release-gitlab-18-4-1-released/</id>
<published>2025-09-25T00:00:00+00:00</published>
<updated>2025-09-25T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today, we are releasing versions 18.4.1, 18.3.3, 18.2.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, please visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. To maintain good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-9642---cross-site-scripting-issue-impacts-gitlab-ceee&quot;&gt;Cross-site scripting issue impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-10858---denial-of-service-issue-when-uploading-specifically-crafted-json-files-impacts-gitlab-ceee&quot;&gt;Denial of Service issue when uploading specifically crafted JSON files impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-8014---denial-of-service-issue-bypassing-query-complexity-limits-impacts-gitlab-ceee&quot;&gt;Denial of Service issue bypassing query complexity limits impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-9958---information-disclosure-issue-in-virtual-registry-configuration-for-low-privileged-users-impacts-gitlab-ceee&quot;&gt;Information disclosure issue in virtual registery configuration for low privileged users impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-7691---privilege-escalation-issue-from-within-the-developer-role-impacts-gitlab-ee&quot;&gt;Privilege Escalation issue from within the Developer role impacts GitLab EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-11042---denial-of-service-issue-in-graphql-api-via-unbounded-array-parameters-impacts-gitlab-ceee&quot;&gt;Denial of Service issue in GraphQL API via Unbounded Array Parameters impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-10871---improper-authorization-issue-for-project-maintainers-when-assigning-roles-impacts-gitlab-ee&quot;&gt;Improper Authorization issue for Project Maintainers when assigning roles impacts GitLab EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-10867---denial-of-service-issue-in-graphql-api-blobsearch-impacts-gitlab-ceee&quot;&gt;Denial of Service issue in GraphQL API blobSearch impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-5069---incorrect-ownership-assignment-via-move-issue-drop-down-impacts-gitlab-ceee&quot;&gt;Incorrect ownership assignment via Move Issue drop-down impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-10868---denial-of-service-issue-via-string-conversion-methods-impacts-gitlab-ceee&quot;&gt;Denial of Service issue via string conversion methods impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cve-2025-9642---cross-site-scripting-issue-in-script-gadgets-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-9642&quot;&gt;CVE-2025-9642&lt;&#x2F;a&gt; - Cross-site scripting issue in Script Gadgets impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute actions on behalf of other users by injecting malicious content.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1.&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 8.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-10858---denial-of-service-issue-when-uploading-specifically-crafted-json-files-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-10858&quot;&gt;CVE-2025-10858&lt;&#x2F;a&gt; - Denial of Service issue when uploading specifically crafted JSON files impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an unauthenticated user to render a GitLab instance unresponsive to legitimate users by sending specifically crafted JSON files.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 7.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-8014---denial-of-service-issue-bypassing-query-complexity-limits-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-8014&quot;&gt;CVE-2025-8014&lt;&#x2F;a&gt; - Denial of Service issue bypassing query complexity limits impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an unauthenticated user to bypass query complexity limits leading to a Denial of Service condition.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted versions:&lt;&#x2F;strong&gt; Gitlab EE&#x2F;CE all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 7.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;foxribeye&quot;&gt;foxribeye&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-9958---information-disclosure-issue-in-virtual-registry-configuration-for-low-privileged-users-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-9958&quot;&gt;CVE-2025-9958&lt;&#x2F;a&gt; - Information disclosure issue in virtual registry configuration for low privileged users impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed low privileged users access to sensitive information stored in virtual registry configurations.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-7691---privilege-escalation-issue-from-within-the-developer-role-impacts-gitlab-ee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-7691&quot;&gt;CVE-2025-7691&lt;&#x2F;a&gt; - Privilege Escalation issue from within the Developer role impacts GitLab EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed a developer with specific group management permissions to escalate their privileges and obtain unauthorized access to additional system capabilities.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted versions:&lt;&#x2F;strong&gt; GitLab EE all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 6.5 &lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rogerace&quot;&gt;rogerace&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-11042---denial-of-service-issue-in-graphql-api-via-unbounded-array-parameters-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-11042&quot;&gt;CVE-2025-11042&lt;&#x2F;a&gt; - Denial of Service issue in GraphQL API via Unbounded Array Parameters impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an authenticated user to cause uncontrolled CPU consumption, potentially leading to a Denial of Service condition while using specific GraphQL queries.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 4.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;afrnz&quot;&gt;Alisa Frunza&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-10871---improper-authorization-issue-for-project-maintainers-when-assigning-roles-impacts-gitlab-ee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-10871&quot;&gt;CVE-2025-10871&lt;&#x2F;a&gt; - Improper Authorization issue for Project Maintainers when assigning roles impacts GitLab EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could allow Project Maintainers improper authorization to assign custom roles to users exceeding the Project Maintainer&#x27;s security boundary and achieving elevated privileges.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted versions:&lt;&#x2F;strong&gt; GitLab EE all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 3.8 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by a GitLab team member, &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;dlrussel&quot;&gt;Diane Russel&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-10867---denial-of-service-issue-in-graphql-api-blobsearch-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-10867&quot;&gt;CVE-2025-10867&lt;&#x2F;a&gt; - Denial of Service issue in GraphQL API blobSearch impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an authenticated user to create a Denial of Service condition by exploiting an unprotected GraphQL API through repeated requests.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 3.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;terrichu&quot;&gt;Terri Chu&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-5069---incorrect-ownership-assignment-via-move-issue-drop-down-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-5069&quot;&gt;CVE-2025-5069&lt;&#x2F;a&gt; - Incorrect ownership assignment via Move Issue drop-down impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name, potentially having users transfer sensitive information to the incorrect project.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 3.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;foxribeye&quot;&gt;foxribeye&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-10868---denial-of-service-issue-via-string-conversion-methods-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-10868&quot;&gt;CVE-2025-10868&lt;&#x2F;a&gt; - Denial of Service issue via string conversion methods impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an authenticated user to cause performance degradation, potentially leading to a Denial of Service condition with certain string conversion methods.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 3.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;h3 id=&quot;postgresql-security-updates&quot;&gt;postgreSQL security updates&lt;&#x2F;h3&gt;

&lt;p&gt;&lt;code&gt;postgreSQL&lt;&#x2F;code&gt; has been updated to version 16.10 which contains fixes for security vulnerabilities including CVE-2025-8713, CVE-2025-8714 and CVE-2025-8715&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1841&quot;&gt;18.4.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205266&quot;&gt;Backport of Update the admin user for GET Release Environment QA tests&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205496&quot;&gt;[18.4] Backport: Resolve &quot;Unable to fork project or create project if application wide lock_duo_features_enabled is true&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205374&quot;&gt;Backport of Add Danger message to guide backport MR authors to reviewers and mergers (18.4)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205365&quot;&gt;Backport of &#x27;Prevent deleting group&#x2F;project when ancestor is marked for deletion at the service level&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205608&quot;&gt;18.4: Backport of &#x27;Fix error when applying scanner suggestion&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205622&quot;&gt;Backport of Ensure proper MCP URL OAuth Discovery for API&#x2F;V4&#x2F;MCP&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205735&quot;&gt;Fix database state leak across specs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205663&quot;&gt;Optimize HandleMalformedStrings middleware for CPU and memory&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205750&quot;&gt;Backport protected branches dropdown copy fix to 18.4&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205876&quot;&gt;[18.4] Fix flaky parallel design management uploads spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205807&quot;&gt;Backport of (Fix FetchModelDefinitionsService) !205687&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206018&quot;&gt;Backport: Add documentation on how to add DUO_WORKFLOW_SELF_SIGNED_JWT__SIGNING_KEY for DAP installations&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206004&quot;&gt;Backport of &#x27;Geo: fix &lt;code&gt;ActiveRecord::StatementInvalid: PG::UndefinedColumn&lt;&#x2F;code&gt; when querying reverification count&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205854&quot;&gt;Backport of Return success when status update target already matches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205899&quot;&gt;[18.4] Allow elastic client adapter to be set&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206199&quot;&gt;Backport of Use isUnsafeLink for xcode protocol&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206229&quot;&gt;Ensure assets get recompiled if cached-assets-hash.txt is empty&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206147&quot;&gt;18.4 Backport of &#x27;Resolve &quot;Dependency list export with API silently fails license validation&quot;&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8733&quot;&gt;CI: Make Ubuntu 22.04 FIPS check EE-only (Backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1833&quot;&gt;18.3.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203969&quot;&gt;Backport &#x27;Bump default ruby version to 3.2.9&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204752&quot;&gt;Backport of &quot;Use release-environment project id instead of canonical&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204767&quot;&gt;Backport of &#x27;Danger to not warn in maintained stable branches&#x27; to 18.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204681&quot;&gt;Backport of &quot;Upgrade duo workflow client protocol version&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204568&quot;&gt;Backport of &quot;Filter out duplicate values from the variable options dropdown&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204897&quot;&gt;18.3: Backport of &#x27;Fix security widget polling indefinitely when there are sboms&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204902&quot;&gt;[18.3 backport] Remove CVE-2025-8714 commands from structure.sql&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204635&quot;&gt;Backport 18.3: Do not trim deployment filename in geo secondary&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204370&quot;&gt;[Backport-18.3]Wiki search throws 500 error for some wiki content&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204361&quot;&gt;[18.3] Fix search admin page error when ES server returns forbidden&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205149&quot;&gt;Backport of &quot;Hide secrets manager settings behind feature flag instead of just the license&quot; to 18.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205265&quot;&gt;Backport of Update the admin user for GET Release Environment QA tests&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205498&quot;&gt;[18.3] Backport: Resolve &quot;Unable to fork project or create project if application wide lock_duo_features_enabled is true&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205372&quot;&gt;Backport of Add Danger message to guide backport MR authors to reviewers and mergers (18.3)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205541&quot;&gt;[Backport 18-3] Skip secret push protection for as-if-foss pipeline&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205610&quot;&gt;18.3: Backport of &#x27;Fix error when applying scanner suggestion&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205625&quot;&gt;Backport of Ensure proper MCP URL OAuth Discovery for API&#x2F;V4&#x2F;MCP&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205731&quot;&gt;Optimize HandleMalformedStrings middleware for CPU and memory&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205700&quot;&gt;Backport to 18.3 of Add job project claims to CI ID Tokens&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205849&quot;&gt;Backport of Return success when status update target already matches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205877&quot;&gt;[18.3] Fix flaky parallel design management uploads spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206171&quot;&gt;Backport &#x27;Fix branches autocomplete paths in the merge request list app&#x27; to 18-3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206173&quot;&gt;Backport &#x27;Fix Linked file not being on top of the list&#x27; to 18-3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205902&quot;&gt;[18.3] Allow elastic client adapter to be set&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206204&quot;&gt;Backport of Use isUnsafeLink for xcode protocol&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;206144&quot;&gt;18.3 Backport of &#x27;Resolve &quot;Dependency list export with API silently fails license validation&quot;&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8699&quot;&gt;Backport: Fix registry matadata database password creation&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8720&quot;&gt;Fall back to c_rehash if there are multiple TLS certificates&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1827&quot;&gt;18.2.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204431&quot;&gt;Backport of diff comment suggestions line range fix&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204362&quot;&gt;[18.2] Fix search admin page error when ES server returns forbidden&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204372&quot;&gt;[Backport 18.2] Wiki search throws 500 error for some wiki content&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204768&quot;&gt;Backport of &#x27;Danger to not warn in maintained stable branches&#x27; to 18.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204636&quot;&gt;Backport 18.2: Do not trim deployment filename in geo secondary&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204785&quot;&gt;Backport of &quot;Use release-environment project id instead of canonical&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204900&quot;&gt;18.2: Backport of &#x27;Fix security widget polling indefinitely when there are sboms&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205264&quot;&gt;Backport of Update the admin user for GET Release Environment QA tests&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205542&quot;&gt;[Backport 18-2] Skip secret push protection for as-if-foss pipeline&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205370&quot;&gt;Backport of Add Danger message to guide backport MR authors to reviewers and mergers (18.2)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205612&quot;&gt;18.2: Backport of &#x27;Fix error when applying scanner suggestion&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205733&quot;&gt;Optimize HandleMalformedStrings middleware for CPU and memory&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205705&quot;&gt;Backport to 18.2 of Add job project claims to CI ID Tokens&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205500&quot;&gt;[18.2] Backport: Resolve &quot;Unable to fork project or create project if application wide lock_duo_features_enabled is true&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;205879&quot;&gt;[18.2] Fix flaky parallel design management uploads spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8721&quot;&gt;Fall back to c_rehash if there are multiple TLS certificates&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;important-notes-on-upgrading&quot;&gt;Important notes on upgrading&lt;&#x2F;h2&gt;

&lt;p&gt;These versions do not include any new migrations, and for multi-node deployments, &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;#upgrading-without-downtime&quot;&gt;should not require any downtime&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Please be aware that by default the Omnibus packages will stop, run migrations,
and start again, no matter how “big” or “small” the upgrade is. This behavior
can be changed by adding a &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;zero_downtime.html&quot;&gt;&lt;code&gt;&#x2F;etc&#x2F;gitlab&#x2F;skip-auto-reconfigure&lt;&#x2F;code&gt;&lt;&#x2F;a&gt; file,
which is only used for &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;updates&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 18.3.2, 18.2.6, 18.1.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/</id>
<published>2025-09-10T00:00:00+00:00</published>
<updated>2025-09-10T00:00:00+00:00</updated>
<author>
<name>Kat Wu</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today, we are releasing versions 18.3.2, 18.2.6, 18.1.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, please visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. To maintain good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-2256---denial-of-service-issue-in-saml-responses-impacts-gitlab-ceee&quot;&gt;Denial of Service issue in SAML Responses impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-6454---server-side-request-forgery-issue-in-webhook-custom-header-impacts-gitlab-ceee&quot;&gt;Server-Side Request Forgery issue in Webhook custom header impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-1250---denial-of-service-issue-in-user-controllable-fields-impacts-gitlab-ceee&quot;&gt;Denial of Service issue in User-Controllable Fields impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-7337---denial-of-service-issue-in-endpoint-file-upload-impacts-gitlab-ceee&quot;&gt;Denial of Service issue in endpoint file upload impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-10094---denial-of-service-issue-in-token-listing-operations-impacts-gitlab-ceee&quot;&gt;Denial of Service issue in token listing operations impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-6769---information-disclosure-issue-in-runner-endpoints-impacts-gitlab-ceee&quot;&gt;Information disclosure issue in runner endpoints impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cve-2025-2256---denial-of-service-issue-in-saml-responses-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-2256&quot;&gt;CVE-2025-2256&lt;&#x2F;a&gt; - Denial of Service issue in SAML Responses impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt; 7.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yuki_osaki&quot;&gt;yuki_osaki&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-6454---server-side-request-forgery-issue-in-webhook-custom-header-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-6454&quot;&gt;CVE-2025-6454&lt;&#x2F;a&gt; - Server-Side Request Forgery issue in Webhook custom header impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt; 8.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ppee&quot;&gt;ppee&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-1250---denial-of-service-issue-in-user-controllable-fields-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-1250&quot;&gt;CVE-2025-1250&lt;&#x2F;a&gt; - Denial of Service issue in User-Controllable Fields impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an authenticated user to stall background job processing by sending specially crafted commit messages, merge request descriptions, or notes.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-7337---denial-of-service-issue-in-endpoint-file-upload-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-7337&quot;&gt;CVE-2025-7337&lt;&#x2F;a&gt; - Denial of Service issue in endpoint file upload impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an authenticated user with Developer-level access to cause a persistent denial of service affecting all users on a GitLab instance by uploading large files.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-10094---denial-of-service-issue-in-token-listing-operations-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-10094&quot;&gt;CVE-2025-10094&lt;&#x2F;a&gt; - Denial of Service issue in token listing operations impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users to disrupt access to token listings and related administrative operations by creating tokens with excessively large names.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions from 10.7 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-6769---information-disclosure-issue-in-runner-endpoints-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-6769&quot;&gt;CVE-2025-6769&lt;&#x2F;a&gt; - Information disclosure issue in runner endpoints impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users to view administrator-only maintenance notes by accessing runner details through specific interfaces.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions:&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 4.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;iamgk808&quot;&gt;iamgk808&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1832&quot;&gt;18.3.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202271&quot;&gt;Backport of &#x27;Ignore silent_mode in clickhouse http calls&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202828&quot;&gt;Backport of &#x27;Update gitlab-shell to v14.45.0&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201943&quot;&gt;Revert &quot;Merge branch &#x27;marina.mosti-543725-reviewer-dropdown-ce&#x27; into &#x27;master&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203071&quot;&gt;Backport of &quot;Only create ToC for headings with links&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202992&quot;&gt;Backport of fix webauthn authentication in Firefox - 18.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202953&quot;&gt;Backport of move delayed deletion cronjob settings to CE&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203308&quot;&gt;Backport &#x27;Disable gdk-update job in stable branch pipelines&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203290&quot;&gt;Backport update to gitlab-sshd to relax allowed algorithms for FIPS&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202829&quot;&gt;Backport of &#x27;Display MCP settings for root groups only&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202994&quot;&gt;Backport of &#x27;Fix shared group access for advanced code search&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203413&quot;&gt;Backport: Fix nil error in Gitlab:Auth:IpRateLimiter&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203676&quot;&gt;Backport &#x27;Add Compare link to submodule diffs&#x27; to 18.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203422&quot;&gt;Backport of &quot;Revert &#x27;New projects don&#x27;t automatically inherit from group-level&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203718&quot;&gt;Backport of &quot;Fix syncing remote stored Blobs with filenames with plus sign&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203722&quot;&gt;Backport of &#x27;Make FileLocationType.endLine nullable&#x27; for 18.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203538&quot;&gt;Backport of Update csp_enabled? to always return a boolean value&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203686&quot;&gt;Backport of Fix LdapAllAddOnSeatSyncWorker removing seats when no groups configured&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203966&quot;&gt;Backport &#x27;Revert gem caching only in specific pipelines&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203933&quot;&gt;Update gitlab-shell to v14.45.2 to allow ED25519 for FIPS&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204239&quot;&gt;[18.3] Remove flaky spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203954&quot;&gt;Backport of diff comment suggestions line range fix&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8714&quot;&gt;Adds checksum for ruby 3.2.9&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1826&quot;&gt;18.2.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202827&quot;&gt;Update gitlab-shell to v14.45.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203072&quot;&gt;Backport of &quot;Only create ToC for headings with links&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203288&quot;&gt;Backport update to gitlab-sshd to relax allowed algorithms for FIPS&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203309&quot;&gt;Backport &#x27;Disable gdk-update job in stable branch pipelines&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202995&quot;&gt;Backport of &#x27;Fix shared group access for advanced code search&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203525&quot;&gt;Backport of &#x27;Fix Bitbucket Server Importer enqueued job count&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203587&quot;&gt;Backport of &#x27;Fix: Geo::ModelMapper flakiness&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203675&quot;&gt;Backport &#x27;Add Compare link to submodule diffs&#x27; to 18.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203724&quot;&gt;Backport of &#x27;Make FileLocationType.endLine nullable&#x27; for 18.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203539&quot;&gt;Backport of Update csp_enabled? to always return a boolean value&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203720&quot;&gt;Backport of &quot;Fix syncing remote stored Blobs with filenames with plus sign&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203932&quot;&gt;Update gitlab-shell to v14.45.2 to allow ED25519 for FIPS&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;204241&quot;&gt;[18.2] Remove flaky spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8664&quot;&gt;Backport 18-2: Fix spec tag name source&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1816&quot;&gt;18.1.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202675&quot;&gt;Backport of &#x27;Fix cannot load such file – gitlab&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203530&quot;&gt;Backport of Fix &#x27;Bitbucket Server Importer enqueued job count&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;203726&quot;&gt;Backport of &#x27;Make FileLocationType.endLine nullable&#x27; for 18.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;important-notes-on-upgrading&quot;&gt;Important notes on upgrading&lt;&#x2F;h2&gt;

&lt;p&gt;These versions do not include any new migrations, and for multi-node deployments, &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;#upgrading-without-downtime&quot;&gt;should not require any downtime&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Please be aware that by default the Omnibus packages will stop, run migrations,
and start again, no matter how “big” or “small” the upgrade is. This behavior
can be changed by adding a &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;zero_downtime.html&quot;&gt;&lt;code&gt;&#x2F;etc&#x2F;gitlab&#x2F;skip-auto-reconfigure&lt;&#x2F;code&gt;&lt;&#x2F;a&gt; file,
which is only used for &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;updates&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 18.3.1, 18.2.5, 18.1.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/08/27/patch-release-gitlab-18-3-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/08/27/patch-release-gitlab-18-3-1-released/</id>
<published>2025-08-27T00:00:00+00:00</published>
<updated>2025-08-27T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today, we are releasing versions 18.3.1, 18.2.5, 18.1.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, please visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. To maintain good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-3601---allocation-of-resources-without-limits-issue-in-import-function-impacts-gitlab-ceee&quot;&gt;Allocation of Resources Without Limits issue in import function impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-2246---missing-authentication-issue-in-graphql-endpoint-impacts-gitlab-ceee&quot;&gt;Missing authentication issue in GraphQL endpoint impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-4225---allocation-of-resources-without-limits-issue-in-graphql-impacts-gitlab-ceee&quot;&gt;Allocation of Resources Without Limits issue in GraphQL impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-5101---code-injection-issue-in-gitlab-repositories-impacts-gitlab-ceee&quot;&gt;Code injection issue in GitLab repositories impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cve-2025-3601---allocation-of-resources-without-limits-issue-in-import-function-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-3601&quot;&gt;CVE-2025-3601&lt;&#x2F;a&gt; - Allocation of Resources Without Limits issue in import function impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an authenticated user to cause a Denial of Service (DoS) condition by submitting URLs that generate excessively large responses. &lt;br &#x2F;&gt;&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 8.15 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;nermalt&quot;&gt;nermalt&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-2246---missing-authentication-issue-in-graphql-endpoint-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-2246&quot;&gt;CVE-2025-2246&lt;&#x2F;a&gt; - Missing authentication issue in GraphQL endpoint impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed unauthenticated users to access sensitive manual CI&#x2F;CD variables by querying the GraphQL API. &lt;br &#x2F;&gt;&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 5.8 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-4225---allocation-of-resources-without-limits-issue-in-graphql-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-4225&quot;&gt;CVE-2025-4225&lt;&#x2F;a&gt; - Allocation of Resources Without Limits issue in GraphQL impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated attacker to cause a denial-of-service condition affecting all users by sending specially crafted GraphQL requests. &lt;br &#x2F;&gt;&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 5.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-5101---code-injection-issue-in-gitlab-repositories-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-5101&quot;&gt;CVE-2025-5101&lt;&#x2F;a&gt; - Code injection issue in GitLab repositories impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that under certain conditions could have allowed an authenticated attacker to distribute malicious code that appears harmless in the web interface by taking advantage of ambiguity between branches and tags during repository imports. &lt;br &#x2F;&gt;&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 5.0 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:L&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:N&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:L&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;).&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1831&quot;&gt;18.3.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2626&quot;&gt;[Backport 18.3] Making changes for container scanning for SBOMs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202294&quot;&gt;Backport of &#x27;Fix cannot load such file – gitlab&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202065&quot;&gt;Backport: Fix namespace issue preventing Ci::Build filtering optimization&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202363&quot;&gt;Backport of &quot;Dependency Path creation with path caching&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202656&quot;&gt;Fix trusted proxies regression when hostname is specified&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202706&quot;&gt;Backport of E2E test: use correct checkbox method&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8677&quot;&gt;Update Mattermost to v10.10.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1825&quot;&gt;18.2.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2627&quot;&gt;[Backport 18.2] Making changes for container scanning for SBOMs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201853&quot;&gt;[18.2] Fix flaky specs due to label ordering&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201990&quot;&gt;Backport &#x27;Danger to fail backport MRs without descriptive title&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201270&quot;&gt;Backport bug - Fix mutations of frozen object in feature_setting.rb&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201937&quot;&gt;Add stage check for agentic chat&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202418&quot;&gt;Backport of &#x27;update the active_add_on_purchase check to include self-managed check&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202564&quot;&gt;Backport of &quot;Create noop pipeline template compatible with test-on-omnibus&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202673&quot;&gt;Backport of &#x27;Fix cannot load such file – gitlab&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202705&quot;&gt;Backport of E2E test: use correct checkbox method&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202570&quot;&gt;Backport of &#x27;Ignore silent_mode in clickhouse http calls&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1815&quot;&gt;18.1.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201046&quot;&gt;Backport &quot;Danger to not error when e2e:test-on-omnibus-ee job not present for only QA changes&quot; to 18.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196606&quot;&gt;Backport Set :throttled urgency for GlobalAdvisoryScanWorker&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201245&quot;&gt;Backport &#x27;Add job and script to update backport MR label after deployment&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201425&quot;&gt;Backport &#x27;Update gitlab-chart digest to 9d9e150&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201655&quot;&gt;Backport of &#x27;fix missing ref attribute&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201854&quot;&gt;[18.1] Fix flaky specs due to label ordering&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201992&quot;&gt;Backport &#x27;Danger to fail backport MRs without descriptive title&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202419&quot;&gt;Backport of &#x27;update the active_add_on_purchase check to include self-managed check&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202540&quot;&gt;Backport of E2E test: use correct checkbox method&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;202565&quot;&gt;Backport of &quot;Create noop pipeline template compatible with test-on-omnibus&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;important-notes-on-upgrading&quot;&gt;Important notes on upgrading&lt;&#x2F;h2&gt;

&lt;p&gt;These versions do not include any new migrations, and for multi-node deployments, &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;#upgrading-without-downtime&quot;&gt;should not require any downtime&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Please be aware that by default the Omnibus packages will stop, run migrations,
and start again, no matter how “big” or “small” the upgrade is. This behavior
can be changed by adding a &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;zero_downtime.html&quot;&gt;&lt;code&gt;&#x2F;etc&#x2F;gitlab&#x2F;skip-auto-reconfigure&lt;&#x2F;code&gt;&lt;&#x2F;a&gt; file,
which is only used for &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;updates&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 18.2.2, 18.1.4, 18.0.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/08/13/patch-release-gitlab-18-2-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/08/13/patch-release-gitlab-18-2-2-released/</id>
<published>2025-08-13T00:00:00+00:00</published>
<updated>2025-08-13T00:00:00+00:00</updated>
<author>
<name>Nikhil George</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today, we are releasing versions 18.2.2, 18.1.4, 18.0.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, please visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. To maintain good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-7734---cross-site-scripting-issue-in-blob-viewer-impacts-gitlab-ceee&quot;&gt;Cross-site scripting issue in blob viewer impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-7739---cross-site-scripting-issue-in-labels-impacts-gitlab-ceee&quot;&gt;Cross-site scripting issue in labels impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-6186---cross-site-scripting-issue-in-workitem-impacts-gitlab-ceee&quot;&gt;Cross-site scripting issue in Workitem impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-8094---improper-handling-of-permissions-issue-in-project-api-impacts-gitlab-ceee&quot;&gt;Improper Handling of Permissions issue in project API impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2024-12303---incorrect-privilege-assignment-issue-in-delete-issues-operation-impacts-gitlab-ceee&quot;&gt;Incorrect Privilege Assignment issue in delete issues operation impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-2614---allocation-of-resources-without-limits-issue-in-release-name-creation-impacts-gitlab-ceee&quot;&gt;Allocation of Resources Without Limits issue in release name creation impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2024-10219---incorrect-authorization-issue-in-jobs-api-impacts-gitlab-ceee&quot;&gt;Incorrect Authorization issue in jobs API impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-8770---authorization-issue-in-merge-request-approval-policy-impacts-gitlab-ee&quot;&gt;Authorization issue in Merge request approval policy impacts GitLab EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-2937---inefficient-regular-expression-complexity-issue-in-wiki-impacts-gitlab-ceee&quot;&gt;Inefficient Regular Expression Complexity issue in wiki impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-1477---allocation-of-resources-without-limits-issue-in-mattermost-integration-impacts-gitlab-ceee&quot;&gt;Allocation of Resources Without Limits issue in Mattermost integration impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-5819---incorrect-permission-assignment-issue-in-id-token-impacts-gitlab-ceee&quot;&gt;Incorrect Permission Assignment issue in ID token impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-2498---insufficient-access-control-issue-in-ip-restriction-impacts-gitlab-ee&quot;&gt;Insufficient Access Control issue in IP Restriction impacts GitLab EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cve-2025-7734---cross-site-scripting-issue-in-blob-viewer-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-7734&quot;&gt;CVE-2025-7734&lt;&#x2F;a&gt; - Cross-site scripting issue in blob viewer impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 8.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-7739---cross-site-scripting-issue-in-labels-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-7739&quot;&gt;CVE-2025-7739&lt;&#x2F;a&gt; - Cross-site scripting issue in labels impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 18.2 before 18.2.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 8.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-6186---cross-site-scripting-issue-in-workitem-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-6186&quot;&gt;CVE-2025-6186&lt;&#x2F;a&gt; - Cross-site scripting issue in Workitem impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 8.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-8094---improper-handling-of-permissions-issue-in-project-api-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-8094&quot;&gt;CVE-2025-8094&lt;&#x2F;a&gt; - Improper Handling of Permissions issue in project API impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that under certain conditions could have allowed authenticated users with maintainer privileges to cause denial of service to other users&#x27; CI&#x2F;CD pipelines by manipulating shared infrastructure resources beyond their intended access level.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions 18.0 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 7.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;abdelrahman_maged&quot;&gt;abdelrahman_maged&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2024-12303---incorrect-privilege-assignment-issue-in-delete-issues-operation-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2024-12303&quot;&gt;CVE-2024-12303&lt;&#x2F;a&gt; - Incorrect Privilege Assignment issue in delete issues operation impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that under certain conditions could have allowed authenticated users with specific roles and permissions to delete issues including confidential ones by inviting users with a specific role.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 6.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yuki_osaki&quot;&gt;yuki_osaki&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-2614---allocation-of-resources-without-limits-issue-in-release-name-creation-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-2614&quot;&gt;CVE-2025-2614&lt;&#x2F;a&gt; - Allocation of Resources Without Limits issue in release name creation impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an authenticated user to cause a denial of service condition by creating specially crafted content that consumes excessive server resources when processed.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2024-10219---incorrect-authorization-issue-in-jobs-api-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2024-10219&quot;&gt;CVE-2024-10219&lt;&#x2F;a&gt; - Incorrect Authorization issue in jobs API impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;:  6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;albatraoz&quot;&gt;albatraoz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-8770---authorization-issue-in-merge-request-approval-policy-impacts-gitlab-ee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-8770&quot;&gt;CVE-2025-8770&lt;&#x2F;a&gt; - Authorization issue in Merge request approval policy impacts GitLab EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab EE: all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;bauerdominic&quot;&gt;Dominic Bauer&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-2937---inefficient-regular-expression-complexity-issue-in-wiki-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-2937&quot;&gt;CVE-2025-2937&lt;&#x2F;a&gt; - Inefficient Regular Expression Complexity issue in wiki impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yuki_osaki&quot;&gt;yuki_osaki&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-1477---allocation-of-resources-without-limits-issue-in-mattermost-integration-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-1477&quot;&gt;CVE-2025-1477&lt;&#x2F;a&gt; - Allocation of Resources Without Limits issue in Mattermost integration impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an unauthenticated user to create a denial of service condition by sending specially crafted payloads to specific integration API endpoints.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-5819---incorrect-permission-assignment-issue-in-id-token-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-5819&quot;&gt;CVE-2025-5819&lt;&#x2F;a&gt; - Incorrect Permission Assignment issue in ID token impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 15.7 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 5.0 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;skybound&quot;&gt;skybound&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-2498---insufficient-access-control-issue-in-ip-restriction-impacts-gitlab-ee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-2498&quot;&gt;CVE-2025-2498&lt;&#x2F;a&gt; - Insufficient Access Control issue in IP Restriction impacts GitLab EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab EE: all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 4.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rogerace&quot;&gt;rogerace&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1822&quot;&gt;18.2.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198502&quot;&gt;[backport] bug: Fixed double message bug&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198679&quot;&gt;Backport of &#x27;Remove full instance test suite execution from omnibus pipeline&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198865&quot;&gt;Backport &#x27;Replace test-on-gdk with test-on-cng in backport mr pipelines&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198939&quot;&gt;[18.2] Fix hardcoded GitLab version in spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198867&quot;&gt;Backport of &#x27;Exclude release environments from QA live envs&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198440&quot;&gt;[18.2 backport] Fix flaky epic deletion specs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198970&quot;&gt;[Backport 18.2] Add pause_control to Elastic delete workers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199095&quot;&gt;Backport of Skip Geo secondary for SyncProjectPolicyWorker&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198965&quot;&gt;Backport of &quot;Add outbound allowlist to allowed endpoints for SSRF filter&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199295&quot;&gt;Backport of Revert &quot;Remove FF for SSRF protection for dependency proxy&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199514&quot;&gt;Backport of &#x27;New projects inherit parent value for duo_features_enabled&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199556&quot;&gt;Backport of &#x27;Add missing elasticsearch_indexing checks to workers&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199665&quot;&gt;[18.2] Fix flaky work item spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199462&quot;&gt;[backport] of Fix: include relative URL root in PDF worker and cMap paths&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200120&quot;&gt;Ensure &lt;code&gt;docs hugo_build&lt;&#x2F;code&gt; CI job uses docs-gitlab-com stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200005&quot;&gt;Backport of &#x27;Fix: validation errors for Duo settings when creating project&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200300&quot;&gt;Backport quarantine broken user signups cap alert test&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200160&quot;&gt;Backport ruby gem caching improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200266&quot;&gt;Fix another case where Sidekiq can take too long to shut down&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200056&quot;&gt;Backport of &#x27;Filter out NULL values&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200371&quot;&gt;Backport &#x27;Decouple node-modules caching from any specific branch&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199911&quot;&gt;Backport of &#x27;Simplify db:check-schema CI job&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200448&quot;&gt;backport fix to use right primary key for ci_job_artifact_states&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200501&quot;&gt;[Backport 18.2] Fix shared group access in advanced search code scope&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200708&quot;&gt;Backport &#x27;Danger to allow backport of maintenance type changes&#x27; to 18-2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200630&quot;&gt;backport: Fix Web IDE loading race condition&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200583&quot;&gt;Backport of Fix numpad enter not working for revision compare dropdown&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200598&quot;&gt;Backport fix case insensitivity in codeowners&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200942&quot;&gt;[18.2] Fix flaky note scope spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201018&quot;&gt;Backport 556582-link-to-project-not-working-when-gitlab-hosted-in-subpath-after-upgrade-to-18-2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200485&quot;&gt;Backport fix: Detect CORS problems in Web IDE&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;201045&quot;&gt;Backport &quot;Danger to not error when e2e:test-on-omnibus-ee job not present for only QA changes&quot; to 18.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200626&quot;&gt;Backport &quot;Use projectRootPath to compose breadcrumb links&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8597&quot;&gt;Backport of &#x27;Use CI_COMMIT_TAG to check on_tag?&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8619&quot;&gt;Fix deprecation check failing on nil values&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1814&quot;&gt;18.1.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198678&quot;&gt;Backport of &#x27;Remove full instance test suite execution from omnibus pipeline&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198869&quot;&gt;Backport &#x27;Replace test-on-gdk with test-on-cng in backport mr pipelines&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198441&quot;&gt;[18.1 backport] Fix flaky epic deletion specs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199082&quot;&gt;Backport of &#x27;Exclude release environments from QA live envs&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199094&quot;&gt;Backport of Skip Geo secondary for SyncProjectPolicyWorker&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198971&quot;&gt;[Backport 18.1] Add pause_control to Elastic delete workers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199294&quot;&gt;Backport of  Revert &quot;Remove FF for SSRF protection for dependency proxy&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199460&quot;&gt;Backport of &quot;Update VERSION file for 18.1.3-internal0&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199557&quot;&gt;Backport of &#x27;Add missing elasticsearch_indexing checks to workers&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199709&quot;&gt;[18.1] Fix flaky work item spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199465&quot;&gt;[backport] of Fix: include relative URL root in PDF worker and cMap paths&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200052&quot;&gt;Backport of &quot;Add repair index tool&quot;, Backport of &quot;Filter out NULL values&quot;, Backport of &quot;Add documentation for IndexRepair task&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200119&quot;&gt;Ensure &lt;code&gt;docs hugo_build&lt;&#x2F;code&gt; CI job uses docs-gitlab-com stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200161&quot;&gt;Backport ruby gem caching improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200267&quot;&gt;Fix another case where Sidekiq can take too long to shut down&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199912&quot;&gt;Backport of &#x27;Simplify db:check-schema CI job&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200443&quot;&gt;Backport &#x27;Decouple node-modules caching from any specific branch&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200449&quot;&gt;backport fix to use right primary key for ci_job_artifact_states&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200586&quot;&gt;Backport of Fix numpad enter not working for revision compare dropdown&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200710&quot;&gt;Backport &#x27;Danger to allow backport of maintenance type changes&#x27; to 18-1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200628&quot;&gt;Backport &quot;Use projectRootPath to compose breadcrumb links&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200613&quot;&gt;Backport fix case insensitivity in codeowners&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8598&quot;&gt;Backport of &#x27;Use CI_COMMIT_TAG to check on_tag?&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1806&quot;&gt;18.0.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198442&quot;&gt;[18.0 backport] Fix flaky epic deletion specs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199084&quot;&gt;Backport of &#x27;Exclude release environments from QA live envs&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199135&quot;&gt;Backport of &#x27;Run QA on GET release environment&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198973&quot;&gt;[Backport 18.0] Add pause_control to Elastic delete workers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199711&quot;&gt;[18.0] Fix flaky work item spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200261&quot;&gt;Ensure &lt;code&gt;docs hugo_build&lt;&#x2F;code&gt; CI job uses docs-gitlab-com stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200268&quot;&gt;Fix another case where Sidekiq can take too long to shut down&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200048&quot;&gt;Backport of &quot;Add repair index tool&quot;, Backport of &quot;Filter out NULL values&quot;, Backport of &quot;Add documentation for IndexRepair task&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;199913&quot;&gt;Backport of &#x27;Simplify db:check-schema CI job&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197809&quot;&gt;[backport] &#x27;tbulva-zoekt-url-reset&#x27; into 18.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200450&quot;&gt;backport fix to use right primary key for ci_job_artifact_states&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200298&quot;&gt;Backport ruby gem caching improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200711&quot;&gt;Backport &#x27;Danger to allow backport of maintenance type changes&#x27; to 18-0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200646&quot;&gt;Backport[18.0] Removing check for project and framework for self managed instances&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200761&quot;&gt;Backport &#x27;Decouple node-modules caching from any specific branch&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;200636&quot;&gt;Backport fix case insensitivity in codeowners&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8599&quot;&gt;Backport of &#x27;Use CI_COMMIT_TAG to check on_tag?&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;important-notes-on-upgrading&quot;&gt;Important notes on upgrading&lt;&#x2F;h2&gt;

&lt;p&gt;This patch includes database migrations that may impact your upgrade process.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;impact-on-your-installation&quot;&gt;Impact on your installation:&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;strong&gt;Single-node instances&lt;&#x2F;strong&gt;: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;strong&gt;Multi-node instances&lt;&#x2F;strong&gt;: With proper &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;zero_downtime.html&quot;&gt;zero-downtime upgrade procedures&lt;&#x2F;a&gt;, this patch can be applied without downtime.&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;regular-migrations&quot;&gt;Regular migrations&lt;&#x2F;h3&gt;

&lt;p&gt;The following versions include regular migrations that run during the upgrade process:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;18.2.2&lt;&#x2F;li&gt;
  &lt;li&gt;18.1.4&lt;&#x2F;li&gt;
  &lt;li&gt;18.0.6
    &lt;h3 id=&quot;post-deploy-migrations&quot;&gt;Post-deploy migrations&lt;&#x2F;h3&gt;
  &lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;The following versions include post-deploy migrations that can run after the upgrade:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;18.2.2&lt;&#x2F;li&gt;
  &lt;li&gt;18.1.4&lt;&#x2F;li&gt;
  &lt;li&gt;18.0.6&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;To learn more about the impact of upgrades on your installation, see:&lt;&#x2F;p&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;zero_downtime.html&quot;&gt;Zero-downtime upgrades&lt;&#x2F;a&gt; for multi-node deployments&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;update&#x2F;package&#x2F;#downtime&quot;&gt;Standard upgrades&lt;&#x2F;a&gt; for single-node installations&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 18.2.1, 18.1.3, 18.0.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/07/23/patch-release-gitlab-18-2-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/07/23/patch-release-gitlab-18-2-1-released/</id>
<published>2025-07-23T00:00:00+00:00</published>
<updated>2025-07-23T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today, we are releasing versions 18.2.1, 18.1.3, 18.0.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, please visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. To maintain good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-4700---cross-site-scripting-issue-impacts-kubernetes-proxy-in-gitlab-ceee&quot;&gt;Cross-site scripting (XSS) impacts k8s proxy in GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-4439---cross-site-scripting-issue-impacts-kubernetes-proxy-in-gitlab-ceee-using-cdns&quot;&gt;Cross-site scripting (XSS) impacts k8s proxy in GitLab CE&#x2F;EE using CDNs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-7001---exposure-of-sensitive-information-to-an-unauthorized-actor-issue-impacts-gitlab-ceee-using-cdns&quot;&gt;Exposure of Sensitive Information to an Unauthorized Actor issue impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-4976---improper-access-control-issue-impacts-gitlab-ee&quot;&gt;Improper Access Control issue impacts GitLab EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-0765---exposure-of-sensitive-information-to-an-unauthorized-actor-issue-impacts-gitlab-ceee&quot;&gt;Exposure of Sensitive Information to an Unauthorized Actor issue impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-1299---improper-access-control-issue-impacts-gitlab-ceee&quot;&gt;Improper Access Control issue impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cve-2025-4700---cross-site-scripting-issue-impacts-kubernetes-proxy-in-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-4700&quot;&gt;CVE-2025-4700&lt;&#x2F;a&gt; - Cross-site scripting issue impacts Kubernetes Proxy in GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue affecting a Kubernetes proxy feature that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 8.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-4439---cross-site-scripting-issue-impacts-kubernetes-proxy-in-gitlab-ceee-using-cdns&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-4439&quot;&gt;CVE-2025-4439&lt;&#x2F;a&gt; - Cross-site scripting issue impacts Kubernetes Proxy in GitLab CE&#x2F;EE using CDNs&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an authenticated user to perform cross-site scripting attacks when the instance is served through certain content delivery networks.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 7.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-7001---exposure-of-sensitive-information-to-an-unauthorized-actor-issue-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-7001&quot;&gt;CVE-2025-7001&lt;&#x2F;a&gt; - Exposure of Sensitive Information to an Unauthorized Actor issue impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed privileged users to access certain &lt;code&gt;resource_group&lt;&#x2F;code&gt; information through the API which should have been unavailable.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 4.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;iamgk808&quot;&gt;iamgk808&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-4976---improper-access-control-issue-impacts-gitlab-ee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-4976&quot;&gt;CVE-2025-4976&lt;&#x2F;a&gt; - Improper Access Control issue impacts GitLab EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab EE: all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 4.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rogerace&quot;&gt;rogerace&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-0765---exposure-of-sensitive-information-to-an-unauthorized-actor-issue-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-0765&quot;&gt;CVE-2025-0765&lt;&#x2F;a&gt; - Exposure of Sensitive Information to an Unauthorized Actor issue impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed an unauthorized user to access custom service desk email addresses.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 4.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;iamgk808&quot;&gt;iamgk808&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-1299---improper-access-control-issue-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-1299&quot;&gt;CVE-2025-1299&lt;&#x2F;a&gt; - Improper Access Control issue impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that, under circumstances, could have allowed an unauthorized user to read deployment job logs by sending a crafted request.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versions starting from 18.2 before 18.2.1. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 4.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1821&quot;&gt;18.2.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2530&quot;&gt;Fix double-path issue for COM_REGISTRY&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198503&quot;&gt;Update VERSION files&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198464&quot;&gt;Backport of &#x27;[Agentic Chat] Do not response to NewCheckpoint message&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198481&quot;&gt;Backport of Delete the search_refactor_membership_filter feature flag&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198465&quot;&gt;Backport of &#x27;Fix S3 compatibility in Workhorse uploads for non-AWS S3 providers&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198504&quot;&gt;[Backport] Allow users to resume&#x2F;continue previous chat sessions in Agentic Chat instead of forcing new chat creation.&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198517&quot;&gt;Send workflow metadata for Agentic Chat&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198424&quot;&gt;Backport of Fix Github Import E2E&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198595&quot;&gt;Backport fix for Workhorse race test: ignore EOF error for Duo Workflow send stream&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1813&quot;&gt;18.1.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197029&quot;&gt;Merge branch &#x27;jk&#x2F;cache-assets-security-mirror&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196999&quot;&gt;[backport] &#x27;tbulva-zoekt-url-reset&#x27; into &#x27;18.1&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197168&quot;&gt;Revert &quot;Merge branch &#x27;cherry-pick-54ec1758&#x27; into &#x27;18-1-stable-ee&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197184&quot;&gt;Merge branch &#x27;dattang&#x2F;pass-omnibus-package-to-release-environment-pipeline&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197285&quot;&gt;Merge branch &#x27;dattang&#x2F;run-qa-on-get-release-environment&#x27; into &#x27;18-1-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197027&quot;&gt;[backport] Add check for allowlist when configuring Elasticsearch URL&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197355&quot;&gt;Backport of &quot;Backport of &#x27;Disable directory_code_dropdown_updates flag&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197829&quot;&gt;Revert &quot;Enable assets caching on security stable branches&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197648&quot;&gt;Backport of &#x27;Fixed branches loading on group merge request list&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198177&quot;&gt;Backport of &lt;code&gt;Trigger webhook events on vulnerability dismissal&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8554&quot;&gt;Backport GitLab Exporter 15.6.0 to 18.1.x&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8547&quot;&gt;Update dependency container-registry to v4.23.2-gitlab&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1805&quot;&gt;18.0.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197141&quot;&gt;[Backport 18.0] Zoekt: Only enable global search when nodes are online&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197766&quot;&gt;Run GET Release Environments on 18-0-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197650&quot;&gt;Backport of &#x27;Fixed branches loading on group merge request list&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197967&quot;&gt;Backport &#x27;dattang&#x2F;fix-syntax-release-env-pipeline&#x27; into &#x27;18-0-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;197886&quot;&gt;[backport to 18.0] Add check for allowlist when configuring Elasticsearch URL&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;198180&quot;&gt;Backport of &lt;code&gt;Trigger webhook events on vulnerability dismissal&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8546&quot;&gt;Update dependency container-registry to v4.21.4-gitlab&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8574&quot;&gt;Build Omnibus package for GET Release Environments - 18.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8575&quot;&gt;Merge branch &#x27;cb-fix-prein-version-parse&#x27; into &#x27;18-0-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 18.1.2, 18.0.4, 17.11.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/07/09/patch-release-gitlab-18-1-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/07/09/patch-release-gitlab-18-1-2-released/</id>
<published>2025-07-09T00:00:00+00:00</published>
<updated>2025-07-09T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today, we are releasing versions 18.1.2, 18.0.4, 17.11.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, please visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. To maintain good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-6948---cross-site-scripting-issue-impacts-gitlab-ceee&quot;&gt;Cross-site scripting issue impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-3396---improper-authorization-issue-impacts-gitlab-ceee&quot;&gt;Incorrect authorization issue impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-4972---improper-authorization-issue-impacts-gitlab-ee&quot;&gt;Incorrect authorization issue impacts GitLab EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-6168---improper-authorization-issue-impacts-gitlab-ee&quot;&gt;Incorrect authorization issue impacts GitLab EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cve-2025-6948---cross-site-scripting-issue-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-6948&quot;&gt;CVE-2025-6948&lt;&#x2F;a&gt; - Cross-site scripting issue impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 8.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-3396---improper-authorization-issue-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-3396&quot;&gt;CVE-2025-3396&lt;&#x2F;a&gt; - Improper authorization issue impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 4.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-4972---improper-authorization-issue-impacts-gitlab-ee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-4972&quot;&gt;CVE-2025-4972&lt;&#x2F;a&gt; - Improper authorization issue impacts GitLab EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users with invitation privileges to bypass group-level user invitation restrictions by manipulating group invitation functionality.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 2.7(&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mateuszek&quot;&gt;mateuszek&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-6168---improper-authorization-issue-impacts-gitlab-ee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-6168&quot;&gt;CVE-2025-6168&lt;&#x2F;a&gt; - Improper authorization issue impacts GitLab EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 2.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;hunter0xp7&quot;&gt;hunter0xp7&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;rsync-security-updates&quot;&gt;rsync security updates&lt;&#x2F;h3&gt;

&lt;p&gt;&lt;code&gt;rsync&lt;&#x2F;code&gt; has been updated to version 3.4.1 which contains fixes for security vulnerabilities including CVE-2024-12084 and CVE-2024-12088.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1812&quot;&gt;18.1.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2477&quot;&gt;Backport Exporter 15.5.0 to 18.1 stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2474&quot;&gt;update gitlab-org&#x2F;container-registry to v4.23.2-gitlab&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195410&quot;&gt;Merge branch &#x27;550037-set-static-glab-version-for-release-qa-tests&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195314&quot;&gt;Quarantine a flaky test&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195649&quot;&gt;Fix code owner validation for roles&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195703&quot;&gt;Enable using glab for CI release&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195818&quot;&gt;Remove Sidekiq shutdown delay in ConcurrencyLimitSampler&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196086&quot;&gt;Refactor blob commit info section (18.1 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195999&quot;&gt;Backport &#x27;Upload cached frontend stable packages&#x27; to 18-1-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196131&quot;&gt;[Backport 18.1] Reintroduce body for redirect responses&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196232&quot;&gt;Show both author and committer in last commit (18.1 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196113&quot;&gt;Fix creation of PATs using UI on relative installations&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195487&quot;&gt;[Backport] Zoekt: Only enable global search when nodes are online&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196241&quot;&gt;Fix title on empty projects (18.1 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196358&quot;&gt;Rake Doctor Secrets: Fix WebHook error&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196460&quot;&gt;Fix comment typos to trigger asset compilation&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196504&quot;&gt;Fix E2E test service_ping_default_enabled_spec.rb&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196273&quot;&gt;Fix catalog data loader memoization problem in specs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196167&quot;&gt;Backport &quot;Disable the edit button, instead of not rendering it&quot; to 18.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195871&quot;&gt;Add a redirect status as a success backport to 18.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196586&quot;&gt;Make sure to load correct loader on every request&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196472&quot;&gt;Merge branch &#x27;dattang&#x2F;build-omnibus-for-release-environment&#x27; into &#x27;18-1-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196440&quot;&gt;Backport &#x27;dattang&#x2F;export-release-environment-package-name&#x27; into &#x27;18-1-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196588&quot;&gt;Quarantine a flaky test&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196825&quot;&gt;Backport: &#x27;revert-grpc-1.72&#x27; into 18-1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196613&quot;&gt;Merge branch &#x27;jk&#x2F;cache-assets-for-stable-branch&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196503&quot;&gt;Fix the owner for sequence ci_builds_id_seq&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8519&quot;&gt;Backport GitLab Exporter 15.5.0 to 18.1 stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8522&quot;&gt;Merge branch &#x27;dattang&#x2F;upload-package-for-release-environment&#x27; into &#x27;18-1-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8527&quot;&gt;Merge branch &#x27;dattang&#x2F;build-release-environment-package&#x27; into &#x27;18-1-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8533&quot;&gt;Merge branch &#x27;dattang&#x2F;fix-release-environment-package-name&#x27; into &#x27;18-1-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8540&quot;&gt;Stable branch builds: Fix versions parsing&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1804&quot;&gt;18.0.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2473&quot;&gt;update gitlab-org&#x2F;container-registry to v4.21.4-gitlab&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195409&quot;&gt;Use 1.59.2 version of glab in release_with_glab_spec.rb&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195315&quot;&gt;Quarantine a flaky test&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195199&quot;&gt;Remove checksum length expectation from the Gitlab::Git::Repository#checksum&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195561&quot;&gt;Fix Protected Tags show page&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195650&quot;&gt;Fix code owner validation for roles&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195819&quot;&gt;Remove Sidekiq shutdown delay in ConcurrencyLimitSampler&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196089&quot;&gt;Refactor blob commit info section (18.0 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196001&quot;&gt;Backport &#x27;Upload cached frontend stable packages&#x27; to 18-0-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196132&quot;&gt;[Backport 18.0] Reintroduce body for redirect responses&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196234&quot;&gt;Show both author and committer in last commit (18.0 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196166&quot;&gt;Backport &quot;Add a spinner for a loading elipsis menu&quot; to 18.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196243&quot;&gt;Fix title on empty projects (18.0 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195727&quot;&gt;No-op ValidateCiBuildNeedsProjectIdNotNull&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196467&quot;&gt;Fix comment typos to trigger asset compilation&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196701&quot;&gt;[Backport 18.0] Fix incorrect redirect when branch doesn&#x27;t include files&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196676&quot;&gt;Fix creation of PATs using UI on relative installations&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;17116&quot;&gt;17.11.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2475&quot;&gt;update gitlab-org&#x2F;container-registry to v4.19.2-gitlab&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195408&quot;&gt;Use 1.59.2 version of glab in release_with_glab_spec.rb&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195316&quot;&gt;Quarantine a flaky test&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195200&quot;&gt;Remove checksum length expectation from the Gitlab::Git::Repository#checksum&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195652&quot;&gt;Fix code owner validation for roles&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195925&quot;&gt;Revert &quot;Merge branch &#x27;backport-fix&#x2F;547265-code-owner-roles-validation-17-11&#x27;…&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196002&quot;&gt;Backport &#x27;Upload cached frontend stable packages&#x27; to 17-11-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196468&quot;&gt;Fix comment typos to trigger asset compilation&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196238&quot;&gt;Backport 1465f38a to 17.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195445&quot;&gt;Fix incompatible Rails cache version from 7.1 to 6.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196678&quot;&gt;Fix creation of PATs using UI on relative installations&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;196702&quot;&gt;[Backport 17.11] Fix incorrect redirect when branch doesn&#x27;t include files&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 18.1.1, 18.0.3, 17.11.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/06/25/patch-release-gitlab-18-1-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/06/25/patch-release-gitlab-18-1-1-released/</id>
<published>2025-06-25T00:00:00+00:00</published>
<updated>2025-06-25T00:00:00+00:00</updated>
<author>
<name>Rohit Shambhuni</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today, we are releasing versions 18.1.1, 18.0.3, 17.11.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, please visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. To maintain good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-3279---denial-of-service-impacts-gitlab-ceee&quot;&gt;Denial of Service impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-1754---missing-authentication-issue-impacts-gitlab-ceee&quot;&gt;Missing Authentication issue impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-5315---improper-access-control-issue-impacts-gitlab-ceee&quot;&gt;Improper access control issue impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-2938---elevation-of-privilege-impacts-gitlab-ceee&quot;&gt;Elevation of Privilege impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-5846---improper-access-control-issue-impacts-gitlab-ee&quot;&gt;Improper access control issue impacts GitLab EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cve-2025-3279---denial-of-service-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-3279&quot;&gt;CVE-2025-3279&lt;&#x2F;a&gt; - Denial of Service impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that, under certain conditions, could have allowed authenticated attackers to create a DoS condition by sending crafted GraphQL requests.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-1754---missing-authentication-issue-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-1754&quot;&gt;CVE-2025-1754&lt;&#x2F;a&gt; - Missing Authentication issue impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed unauthenticated attackers to upload arbitrary files to public projects by sending crafted API requests, potentially leading to resource abuse and unauthorized content storage.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 5.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;abdelrahman_maged&quot;&gt;abdelrahman_maged&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-5315---improper-access-control-issue-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-5315&quot;&gt;CVE-2025-5315&lt;&#x2F;a&gt; - Improper access control issue impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restrictions.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1.&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 4.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rhidayahh&quot;&gt;rhidayahh&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-2938---elevation-of-privilege-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-2938&quot;&gt;CVE-2025-2938&lt;&#x2F;a&gt; - Elevation of Privilege impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab CE&#x2F;EE: all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1. &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 3.1 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mateuszek&quot;&gt;mateuszek&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-5846---improper-access-control-issue-impacts-gitlab-ee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;www.cve.org&#x2F;CVERecord?id=CVE-2025-5846&quot;&gt;CVE-2025-5846&lt;&#x2F;a&gt; - Improper access control issue impacts GitLab EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted Versions&lt;&#x2F;strong&gt;: GitLab EE: all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 &lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt;: 2.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was reported internally by a GitLab team member, &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;joernchen&quot;&gt;Joern Schneeweisz&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1811&quot;&gt;18.1.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2454&quot;&gt;(Backport to 18.1) fix: Don&#x27;t unset IMAGE_TAG_EXT passed by gitlab-org&#x2F;gitlab&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2450&quot;&gt;Backport: Drop ubi-assets-release CI job&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195172&quot;&gt;[backport] 18.1: Merge branch &#x27;dj-exclude-stable-branch-coverage&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194913&quot;&gt;fix: Backport fix on git over ssh&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194784&quot;&gt;Check if Amazon Q should be enabled at project level&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1803&quot;&gt;18.0.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194052&quot;&gt;[backport] Fix line number in zoekt response&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194127&quot;&gt;Restrict LFS file download to project-bound objects&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194237&quot;&gt;Backport &quot;E2E test: account for Duo Core behaviour in code suggestion tests&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194238&quot;&gt;Backport &quot;E2E test: disable elasticsearch omnibus jobs&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194179&quot;&gt;Backport &quot;Fix Self Hosted Duo Beta features not being available&quot; to 18.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194181&quot;&gt;Backport &#x27;Move up release-environments stage in CI&#x27; to 18-0-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194518&quot;&gt;Projects::TransferService should be more reliable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194558&quot;&gt;Merge branch &#x27;jmc-549650&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194161&quot;&gt;backport &#x27;tbulva-zoekt-flashing-no-results&#x27; into 18.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194177&quot;&gt;Merge branch &#x27;tbulva-search-page-scope-fix&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194494&quot;&gt;Backport attribute_methods.rb&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194391&quot;&gt;Backport &quot;Fix losing wiki comments on some wiki page slug changes&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195084&quot;&gt;Backport to 18.0: Set glab version for release QA tests&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194193&quot;&gt;Backport vulnerability_namespace_historical_statistic fix to 18.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195173&quot;&gt;[backport] 18.0: Merge branch &#x27;dj-exclude-stable-branch-coverage&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194866&quot;&gt;Support markdown anchors and multi-line in permalink&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194944&quot;&gt;fix: Backport fix on git over ssh&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195216&quot;&gt;Backport flaky logger test fix&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194989&quot;&gt;Revert &quot;Merge branch &#x27;backport-bugfix-restrict-LFS-download–18-0&#x27; into &#x27;18-0-stable-ee&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195322&quot;&gt;Merge branch &#x27;dattang&#x2F;build-internal-release-qa-image&#x27; into &#x27;18-0-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;17115&quot;&gt;17.11.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2460&quot;&gt;Merge branch &#x27;350883-update-to-use-live-trace-application-setting&#x27; into &#x27;17-11-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194141&quot;&gt;Restrict LFS file download to project-bound objects&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194186&quot;&gt;Backport &#x27;Move up release-environments stage in CI&#x27; to 17-11-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194568&quot;&gt;Merge branch &#x27;jmc-549650&#x27; into &#x27;17-11-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194196&quot;&gt;Backport &#x27;Update Import::ValidateRemoteGitEndpoint Service&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195085&quot;&gt;Backport to 17.11: Set glab version for release QA tests&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194189&quot;&gt;Backport vulnerability_namespace_historical_statistic fix to 17.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195174&quot;&gt;[backport] 17.11: Merge branch &#x27;dj-exclude-stable-branch-coverage&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195075&quot;&gt;fix: Backport fix on git over ssh&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;194988&quot;&gt;Revert &quot;Merge branch &#x27;backport-bugfix-restrict-LFS-download–17-11&#x27; into &#x27;17-11-stable-ee&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;195323&quot;&gt;Merge branch &#x27;dattang&#x2F;build-internal-release-qa-image&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8481&quot;&gt;[Backport - 17.11.x] Removing postponed deprecation from omnibus&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update GitLab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 18.0.2, 17.11.4, 17.10.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/</id>
<published>2025-06-11T00:00:00+00:00</published>
<updated>2025-06-11T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today, we are releasing versions 18.0.2, 17.11.4, 17.10.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; page and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of GitLab’s release blog posts &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th style=&quot;text-align: left&quot;&gt;Title&lt;&#x2F;th&gt;
      &lt;th style=&quot;text-align: left&quot;&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;&lt;a href=&quot;#cve-2025-4278---html-injection-impacts-gitlab-ceee&quot;&gt;HTML injection impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;&lt;a href=&quot;#cve-2025-2254---cross-site-scripting-issue-impacts-gitlab-ceee&quot;&gt;Cross-site scripting issue impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;&lt;a href=&quot;#cve-2025-5121---missing-authorization-issue-impacts-gitlab-ultimate-ee&quot;&gt;Missing authorization issue impacts GitLab Ultimate EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;&lt;a href=&quot;#cve-2025-0673---denial-of-service-impacts-gitlab-ceee&quot;&gt;Denial of Service impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;&lt;a href=&quot;#cve-2025-1516---denial-of-service-via-unbounded-webhook-token-names-impacts-gitlab-ceee&quot;&gt;Denial of Service via unbounded Webhook token names impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;&lt;a href=&quot;#cve-2025-1478---denial-of-service-via-unbounded-board-names-impacts-gitlab-ceee&quot;&gt;Denial of Service via unbounded Board Names impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;&lt;a href=&quot;#cve-2024-9512---information-disclosure-issue-impacts-gitlab-ceee&quot;&gt;Information disclosure issue impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;&lt;a href=&quot;#cve-2025-5996---denial-of-service-dos-via-uncontrolled-http-response-processing--impacts-gitlab-ceee&quot;&gt;Denial of Service (DoS) via uncontrolled HTTP Response Processing impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;&lt;a href=&quot;#cve-2025-5195---information-disclosure-via-authorization-bypass-impacts-gitlab-ceee&quot;&gt;Information disclosure via authorization bypass impacts GitLab CE&#x2F;EE&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;&lt;a href=&quot;#cve-2025-5982---sensitive-information-disclosure-via-group-ip-restriction-bypass&quot;&gt;Sensitive information disclosure via Group IP restriction bypass&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td style=&quot;text-align: left&quot;&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cve-2025-4278---html-injection-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-4278&quot;&gt;CVE-2025-4278&lt;&#x2F;a&gt; - HTML injection impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to achieve account takeover by injecting code into the search page.
&lt;strong&gt;Impacted versions&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE:  all versions starting with 18.0 before 18.0.2.
&lt;strong&gt;CVSS:&lt;&#x2F;strong&gt; 8.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-2254---cross-site-scripting-issue-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-2254&quot;&gt;CVE-2025-2254&lt;&#x2F;a&gt; - Cross-site scripting issue impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to act in the context of a legitimate user by injecting a malicious script into the snippet viewer.&lt;br &#x2F;&gt;
&lt;strong&gt;Impacted versions&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt; 8.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-5121---missing-authorization-issue-impacts-gitlab-ultimate-ee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-5121&quot;&gt;CVE-2025-5121&lt;&#x2F;a&gt; - Missing authorization issue impacts GitLab Ultimate EE&lt;&#x2F;h3&gt;
&lt;p&gt;GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker with authenticated access to a GitLab instance with a GitLab Ultimate license applied (paid customer or trial) to inject a malicious CI&#x2F;CD job into all future CI&#x2F;CD pipelines of any project.&lt;br &#x2F;&gt;
&lt;strong&gt;Impacted versions&lt;&#x2F;strong&gt; GitLab Ultimate EE from 17.11 before 17.11.4 and 18.0 before 18.0.2.
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt; 8.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jean_d-ou&quot;&gt;jean_d-ou&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-0673---denial-of-service-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0673&quot;&gt;CVE-2025-0673&lt;&#x2F;a&gt; - Denial of Service impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by triggering an infinite redirect loop causing memory exhaustion on the server.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted versions&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt; 7.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sim4n6&quot;&gt;sim4n6&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-1516---denial-of-service-via-unbounded-webhook-token-names-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1516&quot;&gt;CVE-2025-1516&lt;&#x2F;a&gt; - Denial of Service via unbounded Webhook token names impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by generating tokens with sufficiently large names.
&lt;strong&gt;Impacted versions&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt; 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-1478---denial-of-service-via-unbounded-board-names-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1478&quot;&gt;CVE-2025-1478&lt;&#x2F;a&gt; - Denial of Service via unbounded Board Names impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by crafting Board Names with sufficiently large sizes.&lt;br &#x2F;&gt;
&lt;strong&gt;Impacted versions&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt; 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2024-9512---information-disclosure-issue-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9512&quot;&gt;CVE-2024-9512&lt;&#x2F;a&gt; - Information disclosure issue impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to clone a legitimate user’s private repository by sending a timed clone request when a secondary node is out of sync.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Impacted versions&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE: all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt; 5.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;hdtran&quot;&gt;hdtran&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-5996---denial-of-service-dos-via-uncontrolled-http-response-processing--impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-5996&quot;&gt;CVE-2025-5996&lt;&#x2F;a&gt; - Denial of Service (DoS) via uncontrolled HTTP Response Processing  impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by integrating a malicious third-party component into a GitLab project.&lt;br &#x2F;&gt;
&lt;strong&gt;Impacted versions&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE:  versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt; 6.5 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;)&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks  &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-5195---information-disclosure-via-authorization-bypass-impacts-gitlab-ceee&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-5195&quot;&gt;CVE-2025-5195&lt;&#x2F;a&gt; - Information disclosure via authorization bypass impacts GitLab CE&#x2F;EE&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed authenticated users to gain access to data beyond their privilege boundaries by accessing arbitrary compliance frameworks.
&lt;strong&gt;Impacted versions&lt;&#x2F;strong&gt; GitLab CE&#x2F;EE:  all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt; 4.3 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by a member of the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2025-5982---sensitive-information-disclosure-via-group-ip-restriction-bypass&quot;&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-5982&quot;&gt;CVE-2025-5982&lt;&#x2F;a&gt; - Sensitive information disclosure via Group IP restriction bypass&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated an issue that could have allowed a successful attacker to bypass IP access restrictions and view sensitive group information.
&lt;strong&gt;Impacted versions&lt;&#x2F;strong&gt; GitLab EE: versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2.&lt;br &#x2F;&gt;
&lt;strong&gt;CVSS&lt;&#x2F;strong&gt; 3.7 (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;)&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;joernchen&quot;&gt;@joernchen&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1802&quot;&gt;18.0.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191955&quot;&gt;Move fork_networks organization_id NOT NULL to post-migrate&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191961&quot;&gt;[Backport] Zoekt: Only enable search when nodes are online&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192132&quot;&gt;18-0-stable-ee: Trim pages deployment file name to 60 characters&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192013&quot;&gt;Fix gitpod button is missing in the edit dropdown&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192019&quot;&gt;[Backport] Elastic::MigrationWorker should not create migrations index&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192418&quot;&gt;Backport operational data_category for duo_core_features_enabled metric on service ping&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192820&quot;&gt;[Backport] Fix IDE links returns about:blank in old code dropdow&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192406&quot;&gt;Fix the title&#x2F;body issue for todo apis when it is a duo todo&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191537&quot;&gt;Add 18.0 &quot;What&#x27;s New&quot; entries&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;193180&quot;&gt;[Backport] mark_all_as_completed! method should drop halted cache &amp;amp; save halted: false&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192175&quot;&gt;Fix &quot;No such column: geo_nodes.verification_max_capacity&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;193477&quot;&gt;[backport] 18.0: Merge branch &#x27;dj-stable-branch-dont-fail-e2e&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;193625&quot;&gt;[backport] 18.0: Merge branch &#x27;dj-refactor-semgrep-ci&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;193514&quot;&gt;[backport] 18.0: Remove e2e:test-on-omnibus-ee from tier 1 backport MRs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8440&quot;&gt;Fix libarchive checksum script (Backport 18.0)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8435&quot;&gt;Warn on changes to tag only CI job definitions&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8454&quot;&gt;Backport postponing deprecation to 19.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;17114&quot;&gt;17.11.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191558&quot;&gt;[backport] 17.11: Remove jest vue3 check quarantine jobs from backport MR pipelines&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192133&quot;&gt;17-11-stable-ee: Trim pages deployment file name to 60 characters&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;193285&quot;&gt;Fix gitpod button is missing in the edit dropdown&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;193317&quot;&gt;[backport] 17.11: Merge branch &#x27;dj-stable-branch-dont-fail-e2e&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;193232&quot;&gt;Merge &#x27;535187-fix-console-errors&#x27; into &#x27;17-11-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192963&quot;&gt;Attempt to migrate ci_runner_taggings table (try 2)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192932&quot;&gt;[backport] 17.11: Remove e2e:test-on-omnibus-ee from tier 1 backport MRs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;193626&quot;&gt;[backport] 17.11: Merge branch &#x27;dj-refactor-semgrep-ci&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8441&quot;&gt;Fix libarchive checksum script (Backport 17.11)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;17108&quot;&gt;17.10.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191560&quot;&gt;[backport] 17.10: Remove jest vue3 check quarantine jobs from backport MR pipelines&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;193304&quot;&gt;Fix gitpod button is missing in the edit dropdown&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;193318&quot;&gt;[backport] 17.10: Merge branch &#x27;dj-stable-branch-dont-fail-e2e&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192962&quot;&gt;Attempt to migrate ci_runner_taggings table (try 2)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;193627&quot;&gt;[backport] 17.10: Merge branch &#x27;dj-refactor-semgrep-ci&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;192933&quot;&gt;[backport] 17.10: Remove e2e:test-on-omnibus-ee from tier 1 backport MRs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8442&quot;&gt;Fix libarchive checksum script (Backport 17.10)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;. To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page. To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 18.0.1, 17.11.3, 17.10.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released/</id>
<published>2025-05-21T00:00:00+00:00</published>
<updated>2025-05-21T00:00:00+00:00</updated>
<author>
<name>Rohit Shambhuni</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 18.0.1, 17.11.3, 17.10.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unprotected-large-blob-endpoint-in-gitlab-allows-denial-of-service&quot;&gt;Unprotected large blob endpoint in GitLab allows Denial of Service&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-xpath-validation-allows-modified-saml-response-to-bypass-2fa-requirement&quot;&gt;Improper XPath validation allows modified SAML response to bypass 2FA requirement&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#a-discord-webhook-integration-may-cause-dos&quot;&gt;A Discord webhook integration may cause DoS&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unbounded-kubernetes-cluster-tokens-may-lead-to-dos&quot;&gt;Unbounded Kubernetes cluster tokens may lead to DoS&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unvalidated-notes-position-may-lead-to-denial-of-service&quot;&gt;Unvalidated notes position may lead to Denial of Service&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#hiddenmasked-variables-may-get-exposed-in-the-ui&quot;&gt;Hidden&#x2F;masked variables may get exposed in the UI&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#two-factor-authentication-requirement-bypass&quot;&gt;Two-factor authentication requirement bypass&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#view-full-email-addresses-that-should-be-partially-obscured&quot;&gt;View full email addresses that should be partially obscured&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#branch-name-confusion-in-confidential-mrs&quot;&gt;Branch name confusion in confidential MRs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-access-to-job-data-via-a-graphql-query&quot;&gt;Unauthorized access to job data via a GraphQL query&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;unprotected-large-blob-endpoint-in-gitlab-allows-denial-of-service&quot;&gt;Unprotected large blob endpoint in GitLab allows Denial of Service&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. This could allow an authenticated attacker to cause a denial of service condition by exhausting server resources.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 7.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0993&quot;&gt;CVE-2025-0993&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;improper-xpath-validation-allows-modified-saml-response-to-bypass-2fa-requirement&quot;&gt;Improper XPath validation allows modified SAML response to bypass 2FA requirement&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allowed modified SAML responses to bypass 2FA requirement under specialized conditions.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.8).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-12093&quot;&gt;CVE-2024-12093&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;a-discord-webhook-integration-may-cause-dos&quot;&gt;A Discord webhook integration may cause DoS&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook integration may cause DoS.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-7803&quot;&gt;CVE-2024-7803&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;a92847865&quot;&gt;a92847865&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unbounded-kubernetes-cluster-tokens-may-lead-to-dos&quot;&gt;Unbounded Kubernetes cluster tokens may lead to DoS&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in the Kubernetes integration could allow an authenticated user to cause denial of service.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-3111&quot;&gt;CVE-2025-3111&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unvalidated-notes-position-may-lead-to-denial-of-service&quot;&gt;Unvalidated notes position may lead to Denial of Service&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of proper validation in GitLab could allow an authenticated user to cause a denial of service condition.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-2853&quot;&gt;CVE-2025-2853&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;hiddenmasked-variables-may-get-exposed-in-the-ui&quot;&gt;Hidden&#x2F;masked variables may get exposed in the UI&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables (that they did not author) in the WebUI, by simply creating their own variable and observing the HTTP response.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.9).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-4979&quot;&gt;CVE-2025-4979&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mateuszek&quot;&gt;mateuszek&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;two-factor-authentication-requirement-bypass&quot;&gt;Two-factor authentication requirement bypass&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.6).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0605&quot;&gt;CVE-2025-0605&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;salh4ckr&quot;&gt;salh4ckr&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;view-full-email-addresses-that-should-be-partially-obscured&quot;&gt;View full email addresses that should be partially obscured&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Under certain conditions un-authorised users can view full email addresses that should be partially obscured.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0679&quot;&gt;CVE-2025-0679&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mateuszek&quot;&gt;mateuszek&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;branch-name-confusion-in-confidential-mrs&quot;&gt;Branch name confusion in confidential MRs&lt;&#x2F;h3&gt;

&lt;p&gt;A business logic error in GitLab CE&#x2F;EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a branch name confusion in confidential MRs.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 3.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9163&quot;&gt;CVE-2024-9163&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;foxribeye&quot;&gt;foxribeye&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unauthorized-access-to-job-data-via-a-graphql-query&quot;&gt;Unauthorized access to job data via a GraphQL query&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 2.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1110&quot;&gt;CVE-2025-1110&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;mattermost-security-updates-april-29-2025&quot;&gt;Mattermost Security Updates April 29, 2025&lt;&#x2F;h3&gt;

&lt;p&gt;Mattermost has been updated to apply the latest patches for low and medium level security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1801&quot;&gt;18.0.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2388&quot;&gt;Fix CI_COMMIT_REF tags of FIPS build images&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191256&quot;&gt;Bump gitlab-shell to v14.42.0 - 18.0 backport&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191699&quot;&gt;[Backport] Do not run index integrity worker for zoekt search&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191890&quot;&gt;Update gitlab-qa to 15.5.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191824&quot;&gt;Add outbound allowlist to allowed endpoints for SSRF filter&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191907&quot;&gt;Apply Rails 7-1-stable patches to fix type map init issues&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8423&quot;&gt;KAS: remove unsupported GitOps config (18.0 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;17113&quot;&gt;17.11.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190731&quot;&gt;Backport 17.11: Generate separate project and group work items fixtures&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190703&quot;&gt;[BACKPORT] Fix flaky specs in Import::GitHubService&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190354&quot;&gt;[backport] Fixed command palette edge case&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190802&quot;&gt;Delete BBM backfill_project_id_for_projects_with_pipeline_variables backport to 17.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190828&quot;&gt;Add backport to fix shortSHA uniqueness&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191038&quot;&gt;[backport] 17.11:  Enable FF_TIMESTAMPS for stable branch pipelines&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191191&quot;&gt;[backport] Add a ping? check before hitting Elasticsearch in admin&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191092&quot;&gt;[Backport]Autocomplete: Change user authorization to use terms query for projects&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191257&quot;&gt;Bump gitlab-shell to v14.42.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191293&quot;&gt;Respect product usage data setting from charts&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191177&quot;&gt;Merge branch &#x27;tbulva-zoekt-global-search-bug&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191334&quot;&gt;Add outbound allowlist to allowed endpoints for SSRF filter&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191711&quot;&gt;Drop ci_runner_machines_archived table&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191686&quot;&gt;17.11: Use no_longer_detected_ids when auto-resolving vulnerabilities&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-pages&#x2F;-&#x2F;merge_requests&#x2F;1156&quot;&gt;Update outdated test certificates [17.11]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8395&quot;&gt;Revert &quot;Merge branch &#x27;renovate&#x2F;pgbouncer-pgbouncer-1.x&#x27; into &#x27;master&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8400&quot;&gt;Ensure correct version of Nginx modules gets included in the package&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;17107&quot;&gt;17.10.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190733&quot;&gt;Backport 17.10: Generate separate project and group work items fixtures&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190705&quot;&gt;[BACKPORT] Fix flaky specs in Import::GitHubService&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191039&quot;&gt;[backport] 17.10: Enable FF_TIMESTAMPS for stable branch pipelines&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191258&quot;&gt;Bump gitlab-shell to v14.42.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;191843&quot;&gt;Drop ci_runner_machines_archived table&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-pages&#x2F;-&#x2F;merge_requests&#x2F;1155&quot;&gt;Update outdated test certificates [17.10]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8401&quot;&gt;Ensure correct version of Nginx modules gets included in the package&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.11.2, 17.10.6, 17.9.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/05/07/patch-release-gitlab-17-11-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/05/07/patch-release-gitlab-17-11-2-released/</id>
<published>2025-05-07T00:00:00+00:00</published>
<updated>2025-05-07T00:00:00+00:00</updated>
<author>
<name>Daniel Hauenstein</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.11.2, 17.10.6, 17.9.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#partial-bypass-for-device-oauth-flow-using-cross-window-forgery&quot;&gt;Partial Bypass for Device OAuth flow using Cross Window Forgery&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-by-abusing-github-import-api&quot;&gt;Denial of service by abusing Github import API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-ip-restriction-bypass-allows-disclosing-issue-title-of-restricted-project&quot;&gt;Group IP restriction bypass allows disclosing issue title of restricted project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;partial-bypass-for-device-oauth-flow-using-cross-window-forgery&quot;&gt;Partial Bypass for Device OAuth flow using Cross Window Forgery&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 17.3 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. Under certain conditions Device OAuth flow protections could be bypassed, enabling authorization form submission through minimal user interaction.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.8).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0549&quot;&gt;CVE-2025-0549&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sim4n6&quot;&gt;sim4n6&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-by-abusing-github-import-api&quot;&gt;Denial of service by abusing Github import API&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. It was possible to cause a DoS condition via GitHub import requests using a malicious crafted payload.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8973&quot;&gt;CVE-2024-8973&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;a92847865&quot;&gt;a92847865&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;group-ip-restriction-bypass-allows-disclosing-issue-title-of-restricted-project&quot;&gt;Group IP restriction bypass allows disclosing issue title of restricted project&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions of a group, enabling them to disclose sensitive information.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1278&quot;&gt;CVE-2025-1278&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;iamgk808&quot;&gt;iamgk808&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;17112&quot;&gt;17.11.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188874&quot;&gt;Merge branch &#x27;renovate-e2e&#x2F;gitlab-qa-15.x&#x27; into &#x27;17-11-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188885&quot;&gt;[backport] Fix subgroup search redirect if SAML auth expired&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188846&quot;&gt;Fix MR diffs endpoint to respond with pagination headers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188922&quot;&gt;Fix token prefix change when PAT prefix is nil&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188895&quot;&gt;[backport] Respect fork filter for global zoekt search&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189318&quot;&gt;[17.11] Bump graphql gem to 2.4.13&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189452&quot;&gt;[Backport] Allow SSO enforcer to skip root owner check&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189039&quot;&gt;[17.11] Only check records with encrypted data in gitlab:doctor:encryption_keys&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189624&quot;&gt;Change to async_delete for ci_running_builds.runner_id&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189806&quot;&gt;Merge branch &#x27;pb-fix-matrix-use-case&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190008&quot;&gt;Update gitlab-development-kit digest to 59037d8&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189983&quot;&gt;Backport (17.11): Bump Devfile gem to 0.4.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190095&quot;&gt;Backport (17.11): Ensure all LFK&#x27;s are processed regardless of duration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190294&quot;&gt;[17.11 Backport]  Change the travel date for analytics&#x2F;dashboards_spec.rb&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8365&quot;&gt;config&#x2F;git: Fix misdetected shell path (17.11 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;17106&quot;&gt;17.10.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189317&quot;&gt;[17.10] Bump graphql gem to 2.4.13&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189041&quot;&gt;[17.10] Only check records with encrypted data in gitlab:doctor:encryption_keys&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189622&quot;&gt;Change to async_delete for ci_running_builds.runner_id&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190009&quot;&gt;Update gitlab-development-kit digest to 59037d8&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189980&quot;&gt;Backport (17.10): Bump Devfile gem to 0.4.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8342&quot;&gt;Cherry pick &#x27;8995-json-parse-utf8&#x27; into &#x27;17-10-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1798&quot;&gt;17.9.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189313&quot;&gt;[17.9] Bump graphql gem to 2.4.13&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;189042&quot;&gt;[17.9] Only check records with encrypted data in gitlab:doctor:encryption_keys&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190010&quot;&gt;Update gitlab-development-kit digest to 59037d8&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;190116&quot;&gt;Backport (17.9): Bump devfile gem to v0.4.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.11.1, 17.10.5, 17.9.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/04/23/patch-release-gitlab-17-11-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/04/23/patch-release-gitlab-17-11-1-released/</id>
<published>2025-04-23T00:00:00+00:00</published>
<updated>2025-04-23T00:00:00+00:00</updated>
<author>
<name>Félix Veillette-Potvin</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.11.1, 17.10.5, 17.9.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cross-site-scripting-xss-in-maven-dependency-proxy-through-csp-directives&quot;&gt;Cross Site Scripting (XSS) in Maven Dependency Proxy through CSP directives&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cross-site-scripting-xss-in-maven-dependency-proxy-through-cache-headers&quot;&gt;Cross Site Scripting (XSS) in Maven dependency proxy through cache headers&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#network-error-logging-nel-header-injection-in-maven-dependency-proxy-allows-browser-activity-monitoring&quot;&gt;Network Error Logging (NEL) Header Injection in Maven Dependency Proxy Allows Browser Activity Monitoring&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-dos-via-issue-preview&quot;&gt;Denial of service (DOS) via issue preview.&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-access-to-branch-names-when-repository-assets-are-disabled-in-the-project&quot;&gt;Unauthorized access to branch names when Repository assets are disabled in the project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cross-site-scripting-xss-in-maven-dependency-proxy-through-csp-directives&quot;&gt;Cross Site Scripting (XSS) in Maven Dependency Proxy through CSP directives&lt;&#x2F;h3&gt;
&lt;p&gt;An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user&#x27;s browser under specific conditions, affecting all versions from 16.6 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1763&quot;&gt;CVE-2025-1763&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cross-site-scripting-xss-in-maven-dependency-proxy-through-cache-headers&quot;&gt;Cross Site Scripting (XSS) in Maven dependency proxy through cache headers&lt;&#x2F;h3&gt;
&lt;p&gt;An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user&#x27;s browser under specific conditions, affecting all versions from 16.6 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-2443&quot;&gt;CVE-2025-2443&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;network-error-logging-nel-header-injection-in-maven-dependency-proxy-allows-browser-activity-monitoring&quot;&gt;Network Error Logging (NEL) Header Injection in Maven Dependency Proxy Allows Browser Activity Monitoring&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE&#x2F;CE that could allow an attacker to track users&#x27; browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 7.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1908&quot;&gt;CVE-2025-1908&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-dos-via-issue-preview&quot;&gt;Denial of service (DOS) via issue preview.&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered affecting service availability via issue preview in GitLab CE&#x2F;EE affecting all versions from 16.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0639&quot;&gt;CVE-2025-0639&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sigitsetiawansss&quot;&gt;sigitsetiawansss&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unauthorized-access-to-branch-names-when-repository-assets-are-disabled-in-the-project&quot;&gt;Unauthorized access to branch names when Repository assets are disabled in the project&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-12244&quot;&gt;CVE-2024-12244&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mateuszek&quot;&gt;mateuszek&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;17111&quot;&gt;17.11.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188122&quot;&gt;Put allow_composite_identities_to_run_pipelines behind ff&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188630&quot;&gt;Backporting doc fix for Amazon Q&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188405&quot;&gt;[BP]last_rollout_failed_at should be set for failures namespaces also&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188604&quot;&gt;Fix Amazon Q disconnect for already destroyed app&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188127&quot;&gt;Fix string conversion for CI Inputs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188074&quot;&gt;Backport fix for latest DS template in combination with Static Reachability&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188721&quot;&gt;Merge branch &#x27;535633-new-look-causes-attach-file-to-ignore-external_url&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188234&quot;&gt;Patch in 17.11: Sync Cloud Connector tokens hourly&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188131&quot;&gt;Update Workhorse Gitaly client dependency&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;17105&quot;&gt;17.10.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2318&quot;&gt;Backport &#x27;fix-ubi-mailroom-location&#x27; into &#x27;17-10-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7765&quot;&gt;backport update-go-grpc-to-1.71.1 to 17-10-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187346&quot;&gt;[Backport 17.10] Bulk indexing cron workers should respect pause setting&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187347&quot;&gt;[17.10] Backport: Zoekt: Fix incorrect project filtering in Zoekt initial indexing&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187380&quot;&gt;Backport: Zoekt: Rollout is considering offline nodes as well&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187382&quot;&gt;Backport: Zoekt Newly created indices are instantly evicted&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187376&quot;&gt;Backport NoMethodError: zoekt_nodes is null in some instances&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187679&quot;&gt;Fix workspaces reconciliation to send inventory config map correctly&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187370&quot;&gt;[17.10 Backport] Clean up the FinalizeBackfillCiRunnerMachinesPartitionedTable migration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187562&quot;&gt;Introduce a new gitlab:doctor:encryption_keys task&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187902&quot;&gt;Backport &quot;Resolve &quot;&#x2F;api&#x2F;v4&#x2F;todos returns 500 when has wiki todo&quot;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187420&quot;&gt;Update workhorse gitalyclient dependency update backport to 17.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187890&quot;&gt;[17.10 Backport] Clear session cookie when browser is closed&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187865&quot;&gt;Backport AI events backfill from PG to ClickHouse&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;188236&quot;&gt;Patch in 17.10: Sync Cloud Connector tokens hourly&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1797&quot;&gt;17.9.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2322&quot;&gt;Backport setting FIPS and UBI pipeline name to 17-9-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2319&quot;&gt;Backport &#x27;fix-ubi-mailroom-location&#x27; into &#x27;17-9-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7772&quot;&gt;backport update-go-grpc-to-1.71.1 to 17-9-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187368&quot;&gt;[17.9 Backport] Clean up the FinalizeBackfillCiRunnerMachinesPartitionedTable migration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187566&quot;&gt;Introduce a new gitlab:doctor:encryption_keys task&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;187765&quot;&gt;Update workhorse gitalyclient dependency backport to 17.9&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.10.4, 17.9.6, 17.8.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/04/09/patch-release-gitlab-17-10-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/04/09/patch-release-gitlab-17-10-4-released/</id>
<published>2025-04-09T00:00:00+00:00</published>
<updated>2025-04-09T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.10.4, 17.9.6, 17.8.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-via-ci-pipelines&quot;&gt;Denial of service via CI pipelines&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unintentionally-authorizing-sensitive-actions-on-users-behalf&quot;&gt;Unintentionally authorizing sensitive actions on users behalf&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ip-restriction-bypass-through-graphql-subscription&quot;&gt;IP Restriction Bypass through GraphQL Subscription&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#Unauthorized-users-can-list-the-number-of-confidential-issues&quot;&gt;Unauthorized users can list the number of confidential issues&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#debugging-information-disclosed&quot;&gt;Debugging Information Disclosed&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;denial-of-service-via-ci-pipelines&quot;&gt;Denial of service via CI pipelines&lt;&#x2F;h3&gt;

&lt;p&gt;A Denial of Service (DoS) issue has been discovered in GitLab CE&#x2F;EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4. A denial of service could occur upon injecting oversized payloads into CI pipeline exports.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1677&quot;&gt;CVE-2025-1677&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unintentionally-authorizing-sensitive-actions-on-users-behalf&quot;&gt;Unintentionally authorizing sensitive actions on users behalf&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing sensitive actions on their behalf.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0362&quot;&gt;CVE-2025-0362&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;ip-restriction-bypass-through-graphql-subscription&quot;&gt;IP Restriction Bypass through GraphQL Subscription&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access restrictions and view sensitive information.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-2408&quot;&gt;CVE-2025-2408&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rogerace&quot;&gt;rogerace&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unauthorized-users-can-list-the-number-of-confidential-issues&quot;&gt;Unauthorized users can list the number of confidential issues&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before  17.9.6, and 17.10 before 17.10.4, This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-11129&quot;&gt;CVE-2024-11129&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;a92847865&quot;&gt;a92847865&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h3 id=&quot;debugging-information-disclosed&quot;&gt;Debugging Information Disclosed&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific service was accessible to unauthenticated users.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 3.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-2469&quot;&gt;CVE-2025-2469&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ap-wtioit&quot;&gt;ap-wtioit&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;17104&quot;&gt;17.10.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;186586&quot;&gt;Cherry-picks multiple fixes into 17.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;186124&quot;&gt;Fix invalid pipelines for scan execution policies&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;186658&quot;&gt;Move group.cluster_agents field to CE&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;185812&quot;&gt;Fixes merge requests updating URL with reports project&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;186987&quot;&gt;Update approval rules name validation to include approval policy&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;4912&quot;&gt;Workhorse golang-jwt&#x2F;jwt upgrade to 5.2.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;4893&quot;&gt;Golang Oauth2 upgrade to 0.27.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1796&quot;&gt;17.9.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;4913&quot;&gt;Workhorse golang-jwt&#x2F;jwt upgrade to 5.2.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1787&quot;&gt;17.8.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2305&quot;&gt;CI: Use gcr mirror in DinD (17.8 Backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;185302&quot;&gt;No-op ci_runner_machines_687967fa8a batched migrations - 17.8 backport&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;186588&quot;&gt;Cherry-picks bug fixes into 17.8&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8267&quot;&gt;Backport fix in libarchive for CI&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8263&quot;&gt;CI: Use gcr mirror for DinD (17.8 Backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8278&quot;&gt;[17.8 Backport] Check packages does not have .dind job in scope&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8283&quot;&gt;CI: Optionally enable dependency proxy (Backport 17.8)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;4914&quot;&gt;Workhorse golang-jwt&#x2F;jwt upgrade to 5.2.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.10.1, 17.9.3, 17.8.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/03/26/patch-release-gitlab-17-10-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/03/26/patch-release-gitlab-17-10-1-released/</id>
<published>2025-03-26T00:00:00+00:00</published>
<updated>2025-03-26T00:00:00+00:00</updated>
<author>
<name>Félix Veillette-Potvin</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.10.1, 17.9.3, 17.8.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cross-site-scripting-xss-through-merge-request-error-messages&quot;&gt;Cross-site Scripting (XSS) through merge-request error messages&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cross-site-scripting-xss-through-improper-rendering-of-certain-file-types&quot;&gt;Cross-site Scripting (XSS) through improper rendering of certain file types&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#admin-privileges-persists-after-role-is-revoked&quot;&gt;Admin Privileges Persists After Role is Revoked&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#external-user-can-access-internal-projects&quot;&gt;External user can access internal projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#prompt-injection-in-amazon-q-integration-may-allow-unauthorized-actions&quot;&gt;Prompt injection in Amazon Q integration may allow unauthorized actions&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#uncontrolled-resource-consumption-via-a-maliciously-crafted-terraform-file-in-merge-request&quot;&gt;Uncontrolled Resource Consumption via a maliciously crafted terraform file in merge request&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-inject-shell-code-in-harbor-project-name-configuration-when-using-helper-scripts&quot;&gt;Maintainer can inject shell code in Harbor project name configuration when using helper scripts&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cross-site-scripting-xss-through-merge-request-error-messages&quot;&gt;Cross-site Scripting (XSS) through merge-request error messages&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in Gitlab EE&#x2F;CE affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS).
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-2255&quot;&gt;CVE-2025-2255&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cross-site-scripting-xss-through-improper-rendering-of-certain-file-types&quot;&gt;Cross-site Scripting (XSS) through improper rendering of certain file types&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0811&quot;&gt;CVE-2025-0811&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;admin-privileges-persists-after-role-is-revoked&quot;&gt;Admin Privileges Persists After Role is Revoked&lt;&#x2F;h3&gt;

&lt;p&gt;An improper access control vulnerability in GitLab CE&#x2F;EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to groups and projects. 
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;#vector=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 7.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-2242&quot;&gt;CVE-2025-2242&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;external-user-can-access-internal-projects&quot;&gt;External user can access internal projects&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.2).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-12619&quot;&gt;CVE-2024-12619&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;aituglo&quot;&gt;aituglo&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;prompt-injection-in-amazon-q-integration-may-allow-unauthorized-actions&quot;&gt;Prompt injection in Amazon Q integration may allow unauthorized actions&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized users.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.4).
We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member Félix Veillette-Potvin.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;uncontrolled-resource-consumption-via-a-maliciously-crafted-terraform-file-in-merge-request&quot;&gt;Uncontrolled Resource Consumption via a maliciously crafted terraform file in merge request&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE&#x2F;CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously crafted file can cause uncontrolled CPU consumption when viewing the associated merge request.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-10307&quot;&gt;CVE-2024-10307&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;l33thaxor&quot;&gt;l33thaxor&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;maintainer-can-inject-shell-code-in-harbor-project-name-configuration-when-using-helper-scripts&quot;&gt;Maintainer can inject shell code in Harbor project name configuration when using helper scripts&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicious code to the CLI commands shown in the UI.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:L&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:L&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 3.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9773&quot;&gt;CVE-2024-9773&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;17101&quot;&gt;17.10.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2275&quot;&gt;Merge branch &#x27;fixup-non-based-ubi&#x27; into &#x27;17-10-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;185392&quot;&gt;Changes for storing value of bypass_two_factor to session&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8252&quot;&gt;Correct incorrect PG version in CHANGELOG&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1793&quot;&gt;17.9.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2264&quot;&gt;Bump go to v1.23.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2276&quot;&gt;Merge branch &#x27;fixup-non-based-ubi&#x27; into &#x27;17-9-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7692&quot;&gt;17.9 Backport: jliu&#x2F;gitaly-dns-tls&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7708&quot;&gt;17.9 backport: Update build-proto-gem&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;184083&quot;&gt;[Backport 17.9] Fix frozen array error with custom analyzers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;184190&quot;&gt;Update dependency gitlab-mail_room to v0.0.27&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;184158&quot;&gt;[backport] Fixed regex and syntax options button under some conditions&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;183491&quot;&gt;[17.9] Backport: Zoekt: Index pending delete projects&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;184162&quot;&gt;[Backport 17.9] Update truncato gem&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;184345&quot;&gt;Reorder runners backfill migrations - 17.9 backport&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;185157&quot;&gt;[Backport 17.9] Replace #test-platform in favour of #s_developer_experience&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;184639&quot;&gt;Update Gitaly client dependency to include DNS lookup change (backport to 17.9)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8232&quot;&gt;Backport &#x27;ci-internal-release-docker-branch-dev&#x27; into &#x27;17-9-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8243&quot;&gt;Backport 17.9: Update container-registry to v4.15.2-gitlab&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1786&quot;&gt;17.8.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2278&quot;&gt;UBI&#x2F;FIPS: Fixup container_version when not using gitlab-base&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7693&quot;&gt;17.8 Backport: jliu&#x2F;gitaly-dns-tls&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;184916&quot;&gt;Fix a spec typo in merge_requests_controller_spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;184643&quot;&gt;Update Gitaly client dependency to include DNS lookup change (backport 17.8)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;185156&quot;&gt;[Backport 17.8] Replace #test-platform in favour of #s_developer_experience&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;184302&quot;&gt;Fix SPP worker bug in 17.8&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;184347&quot;&gt;Reorder runners backfill migrations - 17.8 backport&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8233&quot;&gt;Backport &#x27;ci-internal-release-docker-branch-dev&#x27; into &#x27;17-8-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Patch Release: 17.9.2, 17.8.5, 17.7.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/</id>
<published>2025-03-12T00:00:00+00:00</published>
<updated>2025-03-12T00:00:00+00:00</updated>
<author>
<name>Kevin Morrison</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.9.2, 17.8.5, 17.7.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action and will be notified once their instance has been patched.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-25291-and-cve-2025-25292-third-party-gem-ruby-saml&quot;&gt;CVE-2025-25291 and CVE-2025-25292 (third party gem &lt;code&gt;ruby-saml&lt;&#x2F;code&gt;)&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cve-2025-27407-third-party-gem-graphql&quot;&gt;CVE-2025-27407 (third party gem &lt;code&gt;graphql&lt;&#x2F;code&gt;)&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-due-to-inefficient-processing-of-untrusted-input&quot;&gt;Denial of Service Due to Inefficient Processing of Untrusted Input&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#credentials-disclosed-when-repository-mirroring-fails&quot;&gt;Credentials disclosed when repository mirroring fails&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-vulnerability-in-gitlab-approval-rules-due-to-unbounded-field&quot;&gt;Denial of Service Vulnerability in GitLab Approval Rules due to Unbounded Field&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#internal-notes-in-merge-requests-are-emailed-to-non-members-upon-review-submission&quot;&gt;Internal Notes in Merge Requests Are Emailed to Non-Members Upon Review Submission&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-inject-shell-code-in-google-integrations&quot;&gt;Maintainer can inject shell code in Google integrations&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#guest-with-custom-admin-group-member-permissions-can-approve-the-users-invitation-despite-user-caps&quot;&gt;Guest with custom &lt;code&gt;Admin group member&lt;&#x2F;code&gt; permissions can approve the users invitation despite user caps&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;cve-2025-25291-and-cve-2025-25292-third-party-gem-ruby-saml&quot;&gt;CVE-2025-25291 and CVE-2025-25292 (third party gem &lt;code&gt;ruby-saml&lt;&#x2F;code&gt;)&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated two privately disclosed security issues (&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-25291&quot;&gt;CVE-2025-25291&lt;&#x2F;a&gt;, &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-25292&quot;&gt;CVE-2025-25292&lt;&#x2F;a&gt;) identified in the &lt;code&gt;ruby-saml&lt;&#x2F;code&gt; library which GitLab uses when SAML SSO authentication is enabled at the instance or group level. These issues have been remediated on GitLab.com, and in GitLab CE&#x2F;EE versions 17.7.7, 17.8.5, and 17.9.2.&lt;&#x2F;p&gt;

&lt;p&gt;On GitLab CE&#x2F;EE instances using SAML authentication, under certain circumstances, an attacker with access to a valid signed SAML document from the IdP could authenticate as another valid user within the environment&#x27;s SAML IdP.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;self-managed-gitlab-known-mitigations&quot;&gt;Self Managed GitLab: Known Mitigations&lt;&#x2F;h4&gt;

&lt;p&gt;Affected customers who cannot immediately update GitLab CE&#x2F;EE to address these issues may choose to perform the following mitigation steps:&lt;&#x2F;p&gt;

&lt;p&gt;&lt;em&gt;Note: This vulnerability requires the attacker to have compromised a valid user account to perform the authentication bypass.&lt;&#x2F;em&gt;&lt;&#x2F;p&gt;

&lt;ol&gt;
  &lt;li&gt;Enable GitLab &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;user&#x2F;profile&#x2F;account&#x2F;two_factor_authentication&#x2F;&quot;&gt;two-factor authentication&lt;&#x2F;a&gt; for &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;security&#x2F;two_factor_authentication&#x2F;#enforce-2fa-for-all-users&quot;&gt;all user accounts&lt;&#x2F;a&gt; on the GitLab self-managed instance (NOTE: Enabling identity provider multi-factor authentication does not mitigate this vulnerability) &lt;strong&gt;and&lt;&#x2F;strong&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;Do not allow the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;integration&#x2F;saml&#x2F;#bypass-two-factor-authentication&quot;&gt;SAML two-factor bypass&lt;&#x2F;a&gt; option in GitLab &lt;strong&gt;and&lt;&#x2F;strong&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;integration&#x2F;omniauth&#x2F;#configure-common-settings&quot;&gt;Require admin approval for automatically created new users&lt;&#x2F;a&gt; (&lt;code&gt;gitlab_rails[&#x27;omniauth_block_auto_created_users&#x27;] = true&lt;&#x2F;code&gt;)&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h4 id=&quot;gitlab-thanks&quot;&gt;GitLab Thanks:&lt;&#x2F;h4&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ahacker1&quot;&gt;ahacker1&lt;&#x2F;a&gt; for reporting &lt;code&gt;CVE-2025-25291&lt;&#x2F;code&gt; through our HackerOne bug bounty program&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;github.com&#x2F;p-&quot;&gt;Peter Stöckli&lt;&#x2F;a&gt; (GitHub) for identifying &lt;code&gt;CVE-2025-25292&lt;&#x2F;code&gt; and contacting GitLab to coordinate disclosure and remediation across vendors&lt;&#x2F;li&gt;
  &lt;li&gt;Sixto Martin Garcia (maintainer of the &lt;code&gt;ruby-saml&lt;&#x2F;code&gt; RubyGem) for their collaboration on remediation and coordinating disclosure&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;cve-2025-27407-third-party-gem-graphql&quot;&gt;CVE-2025-27407 (third party gem &lt;code&gt;graphql&lt;&#x2F;code&gt;)&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab has remediated a privately disclosed security issue (&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-27407&quot;&gt;CVE-2025-27407&lt;&#x2F;a&gt;) identified in the Ruby &lt;code&gt;graphql&lt;&#x2F;code&gt; library, which affects and has been remediated in GitLab.com, and in GitLab CE&#x2F;EE versions 17.7.7, 17.8.5, and 17.9.2.&lt;&#x2F;p&gt;

&lt;p&gt;Under certain circumstances, if an attacker-controlled authenticated user account attempted to transfer a maliciously-crafted project via the Direct Transfer feature (note: Direct transfer is in beta stage and is disabled by default for all self-managed Gitlab instances), remote code execution is possible. Disabling Direct Transfer removes risk of exploitation from this issue.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;self-managed-gitlab-known-mitigations-1&quot;&gt;Self-managed GitLab: Known Mitigations&lt;&#x2F;h4&gt;

&lt;p&gt;Affected customers who cannot immediately update their GitLab CE&#x2F;EE to address these issues may choose to perform the following mitigation steps:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;Disable &lt;a href=&quot;http:&#x2F;&#x2F;docs.gitlab.com&#x2F;administration&#x2F;settings&#x2F;import_and_export_settings&#x2F;#enable-migration-of-groups-and-projects-by-direct-transfer&quot;&gt;migration of groups and projects by direct transfer&lt;&#x2F;a&gt;, if enabled (disabled by default)&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h4 id=&quot;gitlab-thanks-1&quot;&gt;GitLab Thanks:&lt;&#x2F;h4&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;github.com&#x2F;rmosolgo&quot;&gt;Robert Mosolgo&lt;&#x2F;a&gt; (ruby-graphql) for their collaboration on cross-vendor disclosure and remediation&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;denial-of-service-due-to-inefficient-processing-of-untrusted-input&quot;&gt;Denial of Service Due to Inefficient Processing of Untrusted Input&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. where a denial of service vulnerability could allow an attacker to cause a system reboot under certain conditions.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:A&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:A&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-13054&quot;&gt;CVE-2024-13054&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sim4n6&quot;&gt;sim4n6&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;credentials-disclosed-when-repository-mirroring-fails&quot;&gt;Credentials disclosed when repository mirroring fails&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE&#x2F;CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-12380&quot;&gt;CVE-2024-12380&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sigitsetiawansss&quot;&gt;sigitsetiawansss&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-vulnerability-in-gitlab-approval-rules-due-to-unbounded-field&quot;&gt;Denial of Service Vulnerability in GitLab Approval Rules due to Unbounded Field&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an attacker to cause a denial of service condition by manipulating specific API inputs. This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1257&quot;&gt;CVE-2025-1257&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;internal-notes-in-merge-requests-are-emailed-to-non-members-upon-review-submission&quot;&gt;Internal Notes in Merge Requests Are Emailed to Non-Members Upon Review Submission&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE&#x2F;CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2 could allow unauthorized users to access confidential information intended for internal use only. This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0652&quot;&gt;CVE-2025-0652&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;foxribeye&quot;&gt;foxribeye&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;maintainer-can-inject-shell-code-in-google-integrations&quot;&gt;Maintainer can inject shell code in Google integrations&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. An input validation issue in the Google Cloud IAM integration feature could have enabled a Maintainer to introduce malicious code.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:L&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:L&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 3.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8402&quot;&gt;CVE-2024-8402&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;guest-with-custom-admin-group-member-permissions-can-approve-the-users-invitation-despite-user-caps&quot;&gt;Guest with custom &lt;code&gt;Admin group member&lt;&#x2F;code&gt; permissions can approve the users invitation despite user caps&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2  which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 2.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-7296&quot;&gt;CVE-2024-7296&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;bump-postgresql-versions-to-1417-and-168&quot;&gt;Bump PostgreSQL versions to 14.17 and 16.8&lt;&#x2F;h3&gt;

&lt;p&gt;The PostgreSQL project released an update so we are updating to versions 14.17 and 16.8.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1792&quot;&gt;17.9.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2239&quot;&gt;PG: Upgrade client libraries and programs to 16.8&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182632&quot;&gt;Use correct project when fetching managed resources templates&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182677&quot;&gt;E2E test fix: web ide spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182666&quot;&gt;Prevent deletion of project_bot users with non-expiring access tokens&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;183361&quot;&gt;Backport: Fix missing repo logic&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;183373&quot;&gt;Backport: Search times out with certain special characters&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182319&quot;&gt;Backport: Fix to support custom pipcompile requirement file with the new DS analyzer&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;183982&quot;&gt;Update gitlab-development-kit digest to 1305f9b&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1785&quot;&gt;17.8.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182441&quot;&gt;Fixes typo on profiles controller spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1777&quot;&gt;17.7.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182443&quot;&gt;Fixes typo on issues controller spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.9.1, 17.8.4, 17.7.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/02/26/patch-release-gitlab-17-9-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/02/26/patch-release-gitlab-17-9-1-released/</id>
<published>2025-02-26T00:00:00+00:00</published>
<updated>2025-02-26T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.9.1, 17.8.4, 17.7.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#xss-in-k8s-proxy-endpoint&quot;&gt;XSS in k8s proxy endpoint&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#xss-in-maven-dependency-proxy&quot;&gt;XSS Maven Dependency Proxy&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#html-injection-leads-to-xss-on-self-hosted-instances&quot;&gt;HTML injection leads to XSS on self hosted instances&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-authorisation-check-allows-guest-user-to-read-security-policy&quot;&gt;Improper Authorisation Check Allows Guest User to Read Security Policy&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#planner-role-can-read-code-review-analytics-in-private-projects&quot;&gt;Planner role can read code review analytics in Private Projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;xss-in-k8s-proxy-endpoint&quot;&gt;XSS in k8s proxy endpoint&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0475&quot;&gt;CVE-2025-0475&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;xss-maven-dependency-proxy&quot;&gt;XSS Maven Dependency Proxy&lt;&#x2F;h3&gt;

&lt;p&gt;A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls and execute arbitrary scripts in a user&#x27;s browser under specific conditions.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 7.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0555&quot;&gt;CVE-2025-0555&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;html-injection-leads-to-xss-on-self-hosted-instances&quot;&gt;HTML injection leads to XSS on self hosted instances&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8186&quot;&gt;CVE-2024-8186&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;improper-authorisation-check-allows-guest-user-to-read-security-policy&quot;&gt;Improper Authorisation Check Allows Guest User to Read Security Policy&lt;&#x2F;h3&gt;

&lt;p&gt;A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-10925&quot;&gt;CVE-2024-10925&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yuki_osaki&quot;&gt;yuki_osaki&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;planner-role-can-read-code-review-analytics-in-private-projects&quot;&gt;Planner role can read code review analytics in private projects&lt;&#x2F;h3&gt;

&lt;p&gt;Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited permissions to access potentially sensitive project analytics data.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0307&quot;&gt;CVE-2025-0307&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;weasterhacker&quot;&gt;weasterhacker&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1791&quot;&gt;17.9.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182032&quot;&gt;Backport - Merge branch &#x27;revert-e78b1a9f&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181864&quot;&gt;Backport&#x2F;fix ambiguous pipeline 17 9&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182126&quot;&gt;Make it possible for ignore unexpected EOFs in SSL connections&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182179&quot;&gt;Allow Duo Chat to be resizable on self-managed (backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182385&quot;&gt;Merge branch &#x27;mdc&#x2F;include-build-assets-image-job-sync-pipelines&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182121&quot;&gt;Fix instance level dashboard by default severity override&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1784&quot;&gt;17.8.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2233&quot;&gt;Bump gitlab-exporter to v15.2.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181136&quot;&gt;[Backport] Return false for pending_migrations? if indexing disabled&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181267&quot;&gt;Merge branch &#x27;10443-fix-workhorse-verify&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181358&quot;&gt;Revert stricter workhorse route regexes&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181872&quot;&gt;Use primary DB when authenticating via job token in jobs API&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181865&quot;&gt;Backport&#x2F;fix ambiguous pipeline 17 8&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182098&quot;&gt;Backport add more custom exit codes for CI&#x2F;CD failures MRs and fix assets caching in scheduled cache-assets:production job&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181534&quot;&gt;Backport fix CH version incompatibility&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182388&quot;&gt;Merge branch &#x27;mdc&#x2F;include-build-assets-image-job-sync-pipelines&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182128&quot;&gt;Make it possible for ignore unexpected EOFs in SSL connections&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8187&quot;&gt;Update dependency gitlab-exporter to v15.2.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181136&quot;&gt;[Backport] Return false for pending_migrations? if indexing disabled&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181267&quot;&gt;Merge branch &#x27;10443-fix-workhorse-verify&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181358&quot;&gt;Revert stricter workhorse route regexes&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181872&quot;&gt;Use primary DB when authenticating via job token in jobs API&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1776&quot;&gt;17.7.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181268&quot;&gt;Merge branch &#x27;10443-fix-workhorse-verify&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181359&quot;&gt;Revert stricter workhorse route regexes&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182151&quot;&gt;Fix failed jobs widget polling issue&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181863&quot;&gt;Backport fix for ambiguous created_at&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182104&quot;&gt;Backport add more custom exit codes for CI&#x2F;CD failures MRs and fix assets caching in scheduled cache-assets:production job&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182390&quot;&gt;Merge branch &#x27;mdc&#x2F;include-build-assets-image-job-sync-pipelines&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;182129&quot;&gt;Make it possible for ignore unexpected EOFs in SSL connections&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181268&quot;&gt;Merge branch &#x27;10443-fix-workhorse-verify&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;181359&quot;&gt;Revert stricter workhorse route regexes&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Note: GitLab releases have skipped 17.7.5 and 17.8.3. There are no patches with these version numbers.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.8.2, 17.7.4, 17.6.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/02/12/patch-release-gitlab-17-8-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/02/12/patch-release-gitlab-17-8-2-released/</id>
<published>2025-02-12T00:00:00+00:00</published>
<updated>2025-02-12T00:00:00+00:00</updated>
<author>
<name>Rohit Shambhuni</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.8.2, 17.7.4, 17.6.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#a-csp-bypass-xss-in-merge-request-page&quot;&gt;A CSP-bypass XSS in merge-request page&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-due-to-unbounded-symbol-creation&quot;&gt;Denial of Service due to Unbounded Symbol Creation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#exfiltrate-content-from-private-issues-using-prompt-injection&quot;&gt;Exfiltrate content from private issues using Prompt Injection&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#internal-http-header-leak-via-route-confusion-in-workhorse&quot;&gt;Internal HTTP header leak via route confusion in workhorse&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ssrf-via-workspaces&quot;&gt;SSRF via workspaces&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-incident-closure-and-deletion-by-planner-role-in-gitlab&quot;&gt;Unauthorized Incident Closure and Deletion by Planner Role in GitLab&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#actioncable-does-not-invalidate-tokens-after-revocation&quot;&gt;ActionCable does not invalidate tokens after revocation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#a-custom-permission-may-allow-overriding-repository-settings&quot;&gt;A custom permission may allow overriding Repository settings&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#saml-authentication-misconfigures-external-user-attribute&quot;&gt;SAML Authentication Misconfigures External User Attribute&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;a-csp-bypass-xss-in-merge-request-page&quot;&gt;A CSP-bypass XSS in merge-request page&lt;&#x2F;h3&gt;

&lt;p&gt;An XSS vulnerability exists in GitLab CE&#x2F;EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0376&quot;&gt;CVE-2025-0376&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-due-to-unbounded-symbol-creation&quot;&gt;Denial of Service due to Unbounded Symbol Creation&lt;&#x2F;h3&gt;

&lt;p&gt;A denial of service vulnerability in GitLab CE&#x2F;EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-12379&quot;&gt;CVE-2024-12379&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sim4n6&quot;&gt;sim4n6&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;exfiltrate-content-from-private-issues-using-prompt-injection&quot;&gt;Exfiltrate content from private issues using Prompt Injection&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-3303&quot;&gt;CVE-2024-3303&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;internal-http-header-leak-via-route-confusion-in-workhorse&quot;&gt;Internal HTTP header leak via route confusion in workhorse&lt;&#x2F;h3&gt;

&lt;p&gt;An information disclosure vulnerability in GitLab CE&#x2F;EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1212&quot;&gt;CVE-2025-1212&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;joernchen&quot;&gt;Joern Schneeweisz&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;ssrf-via-workspaces&quot;&gt;SSRF via workspaces&lt;&#x2F;h3&gt;

&lt;p&gt;An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9870&quot;&gt;CVE-2024-9870&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;retr02332&quot;&gt;retr02332&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unauthorized-incident-closure-and-deletion-by-planner-role-in-gitlab&quot;&gt;Unauthorized Incident Closure and Deletion by Planner Role in GitLab&lt;&#x2F;h3&gt;

&lt;p&gt;Improper Authorization in GitLab CE&#x2F;EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;#vector=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0516&quot;&gt;CVE-2025-0516&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sp4rrow&quot;&gt;sp4rrow&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;actioncable-does-not-invalidate-tokens-after-revocation&quot;&gt;ActionCable does not invalidate tokens after revocation&lt;&#x2F;h3&gt;

&lt;p&gt;An issue discovered in GitLab CE&#x2F;EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;#vector=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.2).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1198&quot;&gt;CVE-2025-1198&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by a GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;DylanGriffith&quot;&gt;Dylan Griffith&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;a-custom-permission-may-allow-overriding-repository-settings&quot;&gt;A custom permission may allow overriding Repository settings&lt;&#x2F;h3&gt;

&lt;p&gt;An improper access control vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows a user with a custom permission to view contents of a repository even if that access is not authorized.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 2.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1042&quot;&gt;CVE-2025-1042&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mateuszek&quot;&gt;mateuszek&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;saml-authentication-misconfigures-external-user-attribute&quot;&gt;SAML Authentication Misconfigures External User Attribute&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user manually designated as an External without configuring them as such in SAML response to lose that designation, and to read and clone internal projects under certain circumstances. After upgrading to a patched version, please review and re-designate any externals users.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 3.1).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-1540&quot;&gt;CVE-2025-1540&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;unode&quot;&gt;Renato Alves&lt;&#x2F;a&gt; for reporting this vulnerability.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;mattermost-security-updates-january-22-2025&quot;&gt;Mattermost Security Updates January 22, 2025&lt;&#x2F;h3&gt;

&lt;p&gt;Mattermost has been updated to versions 10.2.3, which contains several patches and security fixes.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1782&quot;&gt;17.8.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;178514&quot;&gt;Fix Workhorse failing on 64-bit unaligned access on Raspberry Pi 32-bit&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;178575&quot;&gt;[Backport] Fixed css bug for command palette file names too long&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;178596&quot;&gt;Merge branch &#x27;fix-environment-check-user-creation&#x27; into &#x27;17-8-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;178452&quot;&gt;17.8: Ensure user external attribute is preserved and not set to nil&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;178961&quot;&gt;Backporting the bug: Remove feature flag for multiple approvals&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;179349&quot;&gt;Merge branch &#x27;dattang&#x2F;do-not-allow-release-environment-to-fail&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;179180&quot;&gt;Fix Approval widget for project merge request settings&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;179527&quot;&gt;Enable ai tracking without move_ai_tracking_to_instrumentation_layer flag&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;179948&quot;&gt;Add import_vulnerabilities feature flag&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;180252&quot;&gt;Update build-gdk-image version&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;180216&quot;&gt;Backport: Zoekt code search always performs regex search&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;180274&quot;&gt;Fix storing incorrect policy index in scan_result_policies&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;180206&quot;&gt;[Backport] Only check pending migrations if indexing enabled&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;180306&quot;&gt;Updating Duo functionality note&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;180237&quot;&gt;[backport] Fix command palette keybindings propagation&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;180553&quot;&gt;Backport into 17.8: Decrease log level of false error&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;180783&quot;&gt;[Backport] Fix info and list_pending_migration rake tasks if search cluster unreachable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1774&quot;&gt;17.7.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;178457&quot;&gt;17.7: Ensure user external attribute is preserved and not set to nil&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;179058&quot;&gt;Merge branch &#x27;fix-environment-check-user-creation&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;179350&quot;&gt;Merge branch &#x27;dattang&#x2F;do-not-allow-release-environment-to-fail&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;179735&quot;&gt;Fixes typo on profiles_controller_spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;179933&quot;&gt;Add import_vulnerabilities feature flag&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;180305&quot;&gt;Updating Duo functionality note&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;180574&quot;&gt;Backport into 17.7: Decrease log level of false error&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1765&quot;&gt;17.6.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2199&quot;&gt;Backport internal release support to 17.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;178458&quot;&gt;17.6: Ensure user external attribute is preserved and not set to nil&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;179351&quot;&gt;Merge branch &#x27;dattang&#x2F;do-not-allow-release-environment-to-fail&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;179736&quot;&gt;Fixes typo on profiles_controller_spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;8137&quot;&gt;Backport internal release support to 17.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.8.1, 17.7.3, 17.6.4</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/</id>
<published>2025-01-22T00:00:00+00:00</published>
<updated>2025-01-22T00:00:00+00:00</updated>
<author>
<name>Ottilia Westerlund</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 17.8.1, 17.7.3, 17.6.4 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-via-asciidoctor-render&quot;&gt;Stored XSS via Asciidoctor render&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#developer-could-exfiltrate-protected-cicd-variables-via-ci-lint&quot;&gt;Developer could exfiltrate protected CI&#x2F;CD variables via CI lint&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cyclic-reference-of-epics-leads-resource-exhaustion&quot;&gt;Cyclic reference of epics leads resource exhaustion&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;stored-xss-via-asciidoctor-render&quot;&gt;Stored XSS via Asciidoctor render&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0314&quot;&gt;CVE-2025-0314&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;developer-could-exfiltrate-protected-cicd-variables-via-ci-lint&quot;&gt;Developer could exfiltrate protected CI&#x2F;CD variables via CI lint&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. Under certain conditions, it may have been possible for users with developer role to exfiltrate protected CI&#x2F;CD variables via CI lint.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-11931&quot;&gt;CVE-2024-11931&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was internally discovered and reported by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;greg&#x2F;&quot;&gt;Greg Myers&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cyclic-reference-of-epics-leads-resource-exhaustion&quot;&gt;Cyclic reference of epics leads resource exhaustion&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.7 prior to 17.6.4, starting from 17.7 prior to 17.7.3, and starting from 17.8 prior to 17.8.1. It was possible to trigger a DoS by creating cyclic references between epics.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6324&quot;&gt;CVE-2024-6324&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xorz&quot;&gt;xorz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1781&quot;&gt;17.8.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;475063&quot;&gt;Private profiles showed account creation dates although documentation stated they shouldn&#x27;t&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1773&quot;&gt;17.7.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;475063&quot;&gt;Private profiles showed account creation dates although documentation stated they shouldn&#x27;t&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1764&quot;&gt;17.6.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2160&quot;&gt;Toolbox: update URLs for AzCopy (upstream change) - 17-6-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;475063&quot;&gt;Private profiles showed account creation dates although documentation stated they shouldn&#x27;t&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-fy26.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.7.1, 17.6.3, 17.5.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/</id>
<published>2025-01-08T00:00:00+00:00</published>
<updated>2025-01-08T00:00:00+00:00</updated>
<author>
<name>Greg Alfaro</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.7.1, 17.6.3, 17.5.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;changes-to-imports&quot;&gt;Changes to Imports&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab released a new user contribution and membership mapping feature for GitLab importers, including Direct Transfer, GitHub, Bitbucket Server, and Gitea importers. This feature is available by default from GitLab 17.7.1. More information on the feature and availability can be found in a &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;streamline-migrations-with-user-contribution-and-membership-mapping&#x2F;&quot;&gt;blog post&lt;&#x2F;a&gt; and in the documentation &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;project&#x2F;import&#x2F;index.html#user-contribution-and-membership-mapping&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;why-gitlab-changed-its-importer-functionality&quot;&gt;Why GitLab changed its importer functionality&lt;&#x2F;h3&gt;

&lt;p&gt;Vulnerabilities (&lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-5655&quot;&gt;CVE-2024-5655&lt;&#x2F;a&gt;, &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-6385&quot;&gt;CVE-2024-6385&lt;&#x2F;a&gt;, &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-6678&quot;&gt;CVE-2024-6678&lt;&#x2F;a&gt;, &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-8970&quot;&gt;CVE-2024-8970&lt;&#x2F;a&gt;) affecting import functionality were discovered through our HackerOne bug bounty program. To address these vulnerabilities and further enhance security, GitLab redesigned the importers’ user contribution mapping functionality.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;whats-changing&quot;&gt;What’s changing?&lt;&#x2F;h3&gt;

&lt;ol&gt;
  &lt;li&gt;&lt;strong&gt;Post-import mapping&lt;&#x2F;strong&gt;: Previously unavailable, this feature allows you to assign imported contributions and memberships to users on the destination instance after completing the import. Imported memberships and contributions are first mapped to placeholder users. Until they are reassigned, contributions will be displayed as associated with placeholders.&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;strong&gt;Email-independent mapping&lt;&#x2F;strong&gt;: The new process doesn&#x27;t rely on email addresses, allowing you to map contributions for users with different email addresses on source and destination instances.&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;strong&gt;User control&lt;&#x2F;strong&gt;: Each user on the destination instance assigned a contribution mapping must &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;project&#x2F;import&#x2F;#accept-contribution-reassignment&quot;&gt;accept the assignment&lt;&#x2F;a&gt; before any imported contributions are attributed to them. They can also &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;project&#x2F;import&#x2F;#reject-contribution-reassignment&quot;&gt;reject the assignment&lt;&#x2F;a&gt;.&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;p&gt;Full details describing improved user contribution and membership mapping features are available in the GitLab docs &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;project&#x2F;import&#x2F;#user-contribution-and-membership-mapping&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;guidance-for-gitlab-self-managed--dedicated-customers&quot;&gt;Guidance for GitLab Self-Managed &amp;amp; Dedicated Customers&lt;&#x2F;h3&gt;

&lt;ol&gt;
  &lt;li&gt;Exploitation requires that an attacker have an authenticated user account on the target GitLab instance. Therefore, the risk is primarily limited to insider threats unless you allow open internet access &lt;strong&gt;and&lt;&#x2F;strong&gt; public registrations.&lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;GitLab strongly recommends disabling importers until your GitLab instance is upgraded to version 17.7.1 or later. You can disable import features by:&lt;&#x2F;p&gt;

    &lt;ol&gt;
      &lt;li&gt;Logging in as a GitLab instance administrator user&lt;&#x2F;li&gt;
      &lt;li&gt;Go to Admin &amp;gt; Settings &amp;gt; General &amp;gt; Import and Export settings&lt;&#x2F;li&gt;
      &lt;li&gt;Uncheck the box next to each enabled importer&lt;&#x2F;li&gt;
      &lt;li&gt;Click Save Changes&lt;&#x2F;li&gt;
    &lt;&#x2F;ol&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;If you must enable an importer, GitLab recommends temporarily enabling it during an import and disabling the feature after the import is complete.&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab Self-Managed with Direct Transfer (beta feature) or GitHub, Bitbucket Server, or Gitea importers enabled may be vulnerable and should be upgraded immediately.&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#possible-access-token-exposure-in-gitlab-logs&quot;&gt;Possible access token exposure in GitLab logs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cyclic-reference-of-epics-leads-resource-exhaustion&quot;&gt;Cyclic reference of epics leads resource exhaustion&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-user-can-manipulate-status-of-issues-in-public-projects&quot;&gt;Unauthorized user can manipulate status of issues in public projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#instance-saml-does-not-respect-external_provider-configuration&quot;&gt;Instance SAML does not respect &lt;code&gt;external_provider&lt;&#x2F;code&gt; configuration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;possible-access-token-exposure-in-gitlab-logs&quot;&gt;Possible access token exposure in GitLab logs&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2025-0194&quot;&gt;CVE-2025-0194&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;tkuah&quot;&gt;Thong Kuah&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cyclic-reference-of-epics-leads-resource-exhaustion&quot;&gt;Cyclic reference of epics leads resource exhaustion&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. It was possible to trigger a DoS by creating cyclic references between epics.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6324&quot;&gt;CVE-2024-6324&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xorz&quot;&gt;xorz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unauthorized-user-can-manipulate-status-of-issues-in-public-projects&quot;&gt;Unauthorized user can manipulate status of issues in public projects&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthorized users could manipulate the status of issues in public projects.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-12431&quot;&gt;CVE-2024-12431&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;instance-saml-does-not-respect-external_provider-configuration&quot;&gt;Instance SAML does not respect &lt;code&gt;external_provider&lt;&#x2F;code&gt; configuration&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal projects or groups.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-13041&quot;&gt;CVE-2024-13041&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;dblessing&quot;&gt;Drew Blessing&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1771&quot;&gt;17.7.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2151&quot;&gt;Cherry pick fix for gsutil into &#x27;17-7-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7533&quot;&gt;backport 17.7.x: Downgrade grpc-go to v1.66.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176091&quot;&gt;Backport  Revert &quot;Merge branch &#x27;improve_reference_rewriter_to_work_cross_groups&#x27; into &#x27;master&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176128&quot;&gt;17.7 Backport Reject system notes when indexing notes on work items&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176577&quot;&gt;Merge branch &#x27;andrey-fix-qa-spec&#x27; into 17.7&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176356&quot;&gt;Merge branch &#x27;release-unique-users&#x27; into 17.7&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176507&quot;&gt;Fix CI job token signing key not always generated&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176508&quot;&gt;Update acme-client to v2.0.19&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1763&quot;&gt;17.6.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2125&quot;&gt;Cherry pick &#x27;2125-base-force-upgrade-ubi&#x27; into &#x27;17-6-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2152&quot;&gt;Cherry pick fix for gsutil into &#x27;17-6-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7535&quot;&gt;backport 17.6.x: Downgrade grpc-go to v1.66.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175367&quot;&gt;Backport Advanced Search: Set engine for OpenSearch indices&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175272&quot;&gt;17.6: Fix ability to use password for Git when password for Web is disabled&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175307&quot;&gt;Backport running release-environments QA from the stable branch to 17.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175596&quot;&gt;Backport &#x27;fix-env-var-for-release-environments-qa&#x27; 17.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175859&quot;&gt;Backport &#x27;dattang&#x2F;fix-build-gdk-image-script&#x27; to 17.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175657&quot;&gt;Backport fix for diff_files highlights preload to 17.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176514&quot;&gt;Quarantines iteration qa spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176738&quot;&gt;Quarantine outdated user_views_iteration_spec.rb&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176754&quot;&gt;Quarantine date sensitive specs 17.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1755&quot;&gt;17.5.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2126&quot;&gt;Cherry pick &#x27;2125-base-force-upgrade-ubi&#x27; into &#x27;17-5-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2153&quot;&gt;Cherry pick fix for gsutil into &#x27;17-5-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7536&quot;&gt;backport 17.5.x: Update changelog for 17.5.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175308&quot;&gt;Backport running release-environments QA from the stable branch to 17.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175364&quot;&gt;Backport &#x27;dattang&#x2F;allow-release-environments-to-fail&#x27; to 17.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175733&quot;&gt;Backport fix for diff_files highlights preload to 17.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175858&quot;&gt;Backport &#x27;dattang&#x2F;fix-build-gdk-image-script&#x27; to 17.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176596&quot;&gt;Quarantines iteration qa spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176739&quot;&gt;Quarantine outdated user_views_iteration_spec.rb&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176753&quot;&gt;Quarantine date sensitive specs 17.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;176568&quot;&gt;bump devfile gem to 0.0.28 patch&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175274&quot;&gt;17.5: Fix ability to use password for Git when password for Web is disabled&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.6.2, 17.5.4, 17.4.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/12/11/patch-release-gitlab-17-6-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/12/11/patch-release-gitlab-17-6-2-released/</id>
<published>2024-12-11T00:00:00+00:00</published>
<updated>2024-12-11T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.6.2, 17.5.4, 17.4.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#injection-of-network-error-logging-nel-headers-in-kubernetes-proxy-response-could-lead-to-ato-abusing-oauth-flows&quot;&gt;Injection of Network Error Logging (NEL) headers in kubernetes proxy response could lead to account takeover abusing OAuth flows&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-by-repeatedly-sending-unauthenticated-requests-for-diff-files&quot;&gt;Denial of Service by repeatedly sending unauthenticated requests for diff-files&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ci_job_token-could-be-used-to-obtain-gitlab-session&quot;&gt;CI_JOB_TOKEN could be used to obtain GitLab session&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#open-redirect-in-releases-api&quot;&gt;Open redirect in releases API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#client-side-path-traversal-in-harbor-artifact-links&quot;&gt;Client-Side Path Traversal in Harbor artifact links&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#html-injection-in-vulnerability-details-could-lead-to-cross-site-scripting&quot;&gt;HTML injection in vulnerability details could lead to Cross Site Scripting&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#leak-branch-names-of-projects-with-confidential-repository&quot;&gt;Leak branch names of projects with confidential repository&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#non-member-can-view-unresolved-threads-marked-as-internal-notes&quot;&gt;Non member can view unresolved threads marked as internal notes&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#uncontrolled-resource-consumption-through-a-maliciously-crafted--file&quot;&gt;Uncontrolled Resource Consumption through a maliciously crafted  file&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#certain-sensitive-information-passed-as-literals-inside-graphql-mutations-retained-in-graphql-logs&quot;&gt;Certain sensitive information passed as literals inside GraphQL mutations retained in GraphQL logs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#information-disclosure-of-confidential-incidents-details-to-a-group-member-in-gitlab-wiki&quot;&gt;Information disclosure of confidential incidents details to a group member in Gitlab Wiki&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#domain-confusion-in-gitlab-pages-unique-domain-implementation&quot;&gt;Domain Confusion in GitLab Pages Unique Domain Implementation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;injection-of-network-error-logging-nel-headers-in-kubernetes-proxy-response-could-lead-to-ato-abusing-oauth-flows&quot;&gt;Injection of Network Error Logging (NEL) headers in kubernetes proxy response could lead to ATO abusing OAuth flows&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.1 before 17.4.6, starting from 17.5 before 17.5.4, and starting from 17.6 before 17.6.2, injection of Network Error Logging (NEL) headers in kubernetes proxy response could lead to session data exfiltration.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-11274&quot;&gt;CVE-2024-11274&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-by-repeatedly-sending-unauthenticated-requests-for-diff-files&quot;&gt;Denial of Service by repeatedly sending unauthenticated requests for diff-files&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 9.4 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could cause a denial of service with requests for diff files on a commit or merge request.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 7.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8233&quot;&gt;CVE-2024-8233&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;a92847865&quot;&gt;a92847865&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;ci_job_token-could-be-used-to-obtain-gitlab-session&quot;&gt;CI_JOB_TOKEN could be used to obtain GitLab session&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.7 before 17.4.6, from 17.5 before 17.5.4, and from 17.6 before 17.6.2. It may have been possible for an attacker with a victim&#x27;s &lt;code&gt;CI_JOB_TOKEN&lt;&#x2F;code&gt; to obtain a GitLab session token belonging to the victim.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-12570&quot;&gt;CVE-2024-12570&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;open-redirect-in-releases-api&quot;&gt;Open redirect in releases API&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potentially perform an open redirect against a given releases API endpoint.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9387&quot;&gt;CVE-2024-9387&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;swiftee&quot;&gt;swiftee&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;client-side-path-traversal-in-harbor-artifact-links&quot;&gt;Client-Side Path Traversal in Harbor artifact links&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab affecting all versions starting 15.2 before 17.4.6, 17.5 before  17.5.4, and 17.6 before 17.6.2. On self hosted installs, it was possible to leak the cross site request forgery (CSRF) token to an external site while the Harbor integration was enabled.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8647&quot;&gt;CVE-2024-8647&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;html-injection-in-vulnerability-details-could-lead-to-cross-site-scripting&quot;&gt;HTML injection in vulnerability details could lead to Cross Site Scripting&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 17.3 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. Improper output encoding could lead to Cross Site Scripting (XSS) if Content Security Policy (CSP) is not enabled.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8179&quot;&gt;CVE-2024-8179&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;leak-branch-names-of-projects-with-confidential-repository&quot;&gt;Leak branch names of projects with confidential repository&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific GraphQL query, under specific conditions an unauthorised user can retrieve branch names.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8116&quot;&gt;CVE-2024-8116&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shells3c&quot;&gt;shells3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;non-member-can-view-unresolved-threads-marked-as-internal-notes&quot;&gt;Non member can view unresolved threads marked as internal notes&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions from 15.0 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2 that allowed non-member users to view unresolved threads marked as internal notes in public projects merge requests.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8650&quot;&gt;CVE-2024-8650&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;salh4ckr&quot;&gt;salh4ckr&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;uncontrolled-resource-consumption-through-a-maliciously-crafted--file&quot;&gt;Uncontrolled Resource Consumption through a maliciously crafted  file&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled resource consumption, potentially leading to a Denial of Service (DoS) condition while parsing templates to generate changelogs.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9367&quot;&gt;CVE-2024-9367&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;l33thaxor&quot;&gt;l33thaxor&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;certain-sensitive-information-passed-as-literals-inside-graphql-mutations-retained-in-graphql-logs&quot;&gt;Certain sensitive information passed as literals inside GraphQL mutations retained in GraphQL logs&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.0 before 17.4.6, starting from 17.5 before 17.5.4, and starting from 17.6 before 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:L&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:L&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.0).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-12292&quot;&gt;CVE-2024-12292&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This issue was discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;radbatnag&quot;&gt;Radamanthus Batnag&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;information-disclosure-of-confidential-incidents-details-to-a-group-member-in-gitlab-wiki&quot;&gt;Information disclosure of confidential incidents details to a group member in Gitlab Wiki&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature, potentially leading to information disclosure.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 3.1).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-10043&quot;&gt;CVE-2024-10043&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mateuszek&quot;&gt;mateuszek&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;domain-confusion-in-gitlab-pages-unique-domain-implementation&quot;&gt;Domain Confusion in GitLab Pages Unique Domain Implementation&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 3.1).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9633&quot;&gt;CVE-2024-9633&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;psycho_012&quot;&gt;psycho_012&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1762&quot;&gt;17.6.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2120&quot;&gt;Upgrade to Postgres 16.6 for client libraries, openssl 3.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;173193&quot;&gt;Fix 401 errors when installing the GitLab for Jira app&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174008&quot;&gt;Backport &#x27;dattang&#x2F;allow-release-environments-to-fail&#x27; to 17.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174254&quot;&gt;Backport &#x27;always-build-qa-image-for-release-environments&#x27; to 17.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174291&quot;&gt;Add guard clause to Wiki#find_page when title is nil&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174583&quot;&gt;Merge branch &#x27;498768-graphql-subscriptions-ignore-unauthorized-error&#x27; into &#x27;17-6-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174512&quot;&gt;Merge branch &#x27;nd&#x2F;fix-progressbar-progress&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174700&quot;&gt;Backport 17-6 Remove unused matched_lines_count&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174701&quot;&gt;Backport Zoekt indices without zoekt_repositories stuck in initializing&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174549&quot;&gt;Backport &#x27;Zoekt: Do not process failed repos&#x27; into 17.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174214&quot;&gt;Bump devfile gem to 0.1.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1754&quot;&gt;17.5.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2121&quot;&gt;Upgrade to Postgres 16.6 for client libraries, openssl 3.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;173196&quot;&gt;Fix 401 errors when installing the GitLab for Jira app&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174255&quot;&gt;Backport &#x27;always-build-qa-image-for-release-environments&#x27; to 17.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174581&quot;&gt;Merge branch &#x27;498768-graphql-subscriptions-ignore-unauthorized-error&#x27; into &#x27;17-5-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171140&quot;&gt;Backport https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170141 into 17.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;175190&quot;&gt;Quarantine Custom model features specs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1746&quot;&gt;17.4.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2122&quot;&gt;Upgrade to Postgres 16.6 for client libraries, openssl 3.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;173428&quot;&gt;Add param filtering to avoid error while saving project settings&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;173197&quot;&gt;Fix 401 errors when installing the GitLab for Jira app&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174256&quot;&gt;Backport &#x27;always-build-qa-image-for-release-environments&#x27; to 17.4&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;174756&quot;&gt;Backport fix for flaky tests in search_results spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.6.1, 17.5.3, 17.4.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/11/26/patch-release-gitlab-17-6-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/11/26/patch-release-gitlab-17-6-1-released/</id>
<published>2024-11-26T00:00:00+00:00</published>
<updated>2024-11-26T00:00:00+00:00</updated>
<author>
<name>Ottilia Westerlund</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.6.1, 17.5.3, 17.4.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#privilege-escalation-via-lfs-tokens&quot;&gt;Privilege Escalation via LFS Tokens&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dos-through-uncontrolled-resource-consumption-when-viewing-a-maliciously-crafted-cargotoml-file&quot;&gt;DoS through uncontrolled resource consumption when viewing a maliciously crafted cargo.toml file.&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unintended-access-to-usage-data-via-scoped-tokens&quot;&gt;Unintended access to Usage Data via Scoped Tokens&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#gitlab-dos-via-harbor-registry-integration&quot;&gt;Gitlab DOS via Harbor registry integration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#resource-exhaustion-and-denial-of-service-with-test_report-api-calls&quot;&gt;Resource exhaustion and denial of service with test_report API calls&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#streaming-endpoint-did-not-invalidate-tokens-after-revocation&quot;&gt;Streaming endpoint did not invalidate tokens after revocation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;privilege-escalation-via-lfs-tokens&quot;&gt;Privilege Escalation via LFS Tokens&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim&#x27;s Personal Access Token (PAT) to escalate privileges.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N &lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.2).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8114&quot;&gt;CVE-2024-8114&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;dos-through-uncontrolled-resource-consumption-when-viewing-a-maliciously-crafted-cargotoml-file&quot;&gt;DoS through uncontrolled resource consumption when viewing a maliciously crafted cargo.toml file.&lt;&#x2F;h3&gt;

&lt;p&gt;A Denial of Service (DoS) issue has been discovered in GitLab CE&#x2F;EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1. An attacker could cause a denial of service with a crafted cargo.toml file.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8237&quot;&gt;CVE-2024-8237&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;l33thaxor&quot;&gt;l33thaxor&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unintended-access-to-usage-data-via-scoped-tokens&quot;&gt;Unintended Access to Usage Data via Scoped Tokens&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-11669&quot;&gt;CVE-2024-11669&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by a GitLab team member, &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;DylanGriffith&quot;&gt;Dylan Griffith&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;gitlab-dos-via-harbor-registry-integration&quot;&gt;Gitlab DOS via Harbor registry integration&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which could cause Denial of Service via integrating a malicious harbor registry.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8177&quot;&gt;CVE-2024-8177&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;a92847865&quot;&gt;a92847865&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;resource-exhaustion-and-denial-of-service-with-test_report-api-calls&quot;&gt;Resource exhaustion and denial of service with test_report API calls&lt;&#x2F;h3&gt;

&lt;p&gt;A denial of service (DoS) condition was discovered in GitLab CE&#x2F;EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-11828&quot;&gt;CVE-2024-11828&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;luryus&quot;&gt;luryus&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;streaming-endpoint-did-not-invalidate-tokens-after-revocation&quot;&gt;Streaming endpoint did not invalidate tokens after revocation&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.2).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-11668&quot;&gt;CVE-2024-11668&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team members, &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;DylanGriffith&quot;&gt;Dylan Griffith&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;engwan&quot;&gt;Heinrich Lee Yu&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1761&quot;&gt;17.6.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;173427&quot;&gt;Revert &quot;Merge branch &#x27;include-sec-in-sidekiq-worker-attributes-concern&#x27; into &#x27;master&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;173288&quot;&gt;Revert &quot;Merge branch &#x27;421376-part-1-move-history-button&#x27; into &#x27;master&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;173464&quot;&gt;Backport to 17.6 the fix for sbom ingestion failure when license spdx id is nil&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;173593&quot;&gt;Cherry-pick &#x27;jennli-patch-compile-prod-assets-rules&#x27; into 17-6-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1753&quot;&gt;17.5.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;172339&quot;&gt;Disable http router in tests&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171715&quot;&gt;Ensure auto_merge_enabled is set when validating merge trains&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;172391&quot;&gt;Backport Index work items when project visibility level changes&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;172767&quot;&gt;Backport fix for token revocation to 17.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;172871&quot;&gt;Backport Publish AuthorizationsAddedEvent with multiple projects&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;173185&quot;&gt;Make assertion order independent&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;173594&quot;&gt;Cherry-pick &#x27;jennli-patch-compile-prod-assets-rules&#x27; into 17-5-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.5.2, 17.4.4, 17.3.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/</id>
<published>2024-11-13T00:00:00+00:00</published>
<updated>2024-11-13T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.5.2, 17.4.4, 17.3.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-access-to-kubernetes-cluster-agent&quot;&gt;Unauthorized access to Kubernetes cluster agent&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#device-oauth-flow-allows-for-cross-window-forgery&quot;&gt;Device OAuth flow allows for cross window forgery&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-by-importing-malicious-crafted-fogbugz-import-payload&quot;&gt;Denial of Service by importing malicious crafted FogBugz import payload&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-through-javascript-url-in-analytics-dashboards&quot;&gt;Stored XSS through javascript URL in Analytics dashboards&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#html-injection-in-vulnerability-code-flow-could-lead-to-xss-on-self-hosted-instances&quot;&gt;HTML injection in vulnerability Code flow could lead to XSS on self hosted instances&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#information-disclosure-through-an-api-endpoint&quot;&gt;Information disclosure through an API endpoint&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;unauthorized-access-to-kubernetes-cluster-agent&quot;&gt;Unauthorized access to Kubernetes cluster agent&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9693&quot;&gt;CVE-2024-9693&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was found internally by a GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;tigerwnz&quot;&gt;Tiger Watson&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;device-oauth-flow-allows-for-cross-window-forgery&quot;&gt;Device OAuth flow allows for cross window forgery&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.8).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-7404&quot;&gt;CVE-2024-7404&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-by-importing-malicious-crafted-fogbugz-import-payload&quot;&gt;Denial of Service by importing malicious crafted FogBugz import payload&lt;&#x2F;h3&gt;

&lt;p&gt;A Denial of Service (DoS) issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using the Fogbugz importer.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;a92847865&quot;&gt;a92847865&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;stored-xss-through-javascript-url-in-analytics-dashboards&quot;&gt;Stored XSS through javascript URL in Analytics dashboards&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.1).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8648&quot;&gt;CVE-2024-8648&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;html-injection-in-vulnerability-code-flow-could-lead-to-xss-on-self-hosted-instances&quot;&gt;HTML injection in vulnerability Code flow could lead to XSS on self hosted instances&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8180&quot;&gt;CVE-2024-8180&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;information-disclosure-through-an-api-endpoint&quot;&gt;Information disclosure through an API endpoint&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project, under certain circumstances.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-10240&quot;&gt;CVE-2024-10240&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;patrickbajao&quot;&gt;Patrick Bajao&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;mattermost-security-updates-october-28-2024&quot;&gt;Mattermost Security Updates October 28, 2024&lt;&#x2F;h3&gt;

&lt;p&gt;Mattermost has been updated to versions 10.1.2, which contains several patches and security fixes.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1752&quot;&gt;17.5.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170051&quot;&gt;Security patch upgrade alert: Only expose to admins 17-5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170814&quot;&gt;[backport] Add epic to the scope and fix the flaky spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170641&quot;&gt;[Backport] Fix indexing subgroup associations&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170777&quot;&gt;Skip creating tables as partitions if any partition exists&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170058&quot;&gt;Add knn index setting for workitem index for opensearch clusters&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;169904&quot;&gt;[Backport]Fix new project group templates pagination&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170981&quot;&gt;Update pdf worker file path in pdf viewer&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170961&quot;&gt;[backport] Fix issue label facet can overwrite selected labels&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171634&quot;&gt;Fix workitem job in 17-5-stable-ee branch&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171703&quot;&gt;[Backport] Go-get: return 404 error code when personal token is invalid&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171554&quot;&gt;Add param filtering to avoid error while saving project settings&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171926&quot;&gt;Skip multi-version upgrade migration spec on default branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171891&quot;&gt;Fix group wiki activity events breaking the user feed&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;172133&quot;&gt;Destroy merge train car after branch deletion&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171585&quot;&gt;Backport: Remove permissions JSONB column from the condition&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1744&quot;&gt;17.4.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7400&quot;&gt;Backport fix for incorrect error classification to 17.4&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7414&quot;&gt;Backport 17-4: Update GoCloud to a version that supports s3ForcePathStyle&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170209&quot;&gt;Use dump from 17.3.5 since 17.3 is the previous required stop&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170055&quot;&gt;Security patch upgrade alert: Only expose to admins 17-4&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171630&quot;&gt;Fix workitem job in 17-4-stable-ee branch&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171784&quot;&gt;Don&#x27;t run e2e:test-product-analytics&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171736&quot;&gt;Ensure auto_merge_enabled is set when validating merge trains&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;172134&quot;&gt;Destroy merge train car after branch deletion&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;172135&quot;&gt;Fix broken merge train merge when target branch deleted&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171586&quot;&gt;Backport: Remove permissions JSONB column from the condition&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170978&quot;&gt;Update pdf worker file path in pdf viewer&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1737&quot;&gt;17.3.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7396&quot;&gt;Backport dragonboat&#x27;s file permission error to 17.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170208&quot;&gt;Use dump from 16.11.8 since 16.11 is the previous required stop&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;171632&quot;&gt;Fix workitem job in 17-3-stable-ee branch&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.5.1, 17.4.3, 17.3.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/10/23/patch-release-gitlab-17-5-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/10/23/patch-release-gitlab-17-5-1-released/</id>
<published>2024-10-23T00:00:00+00:00</published>
<updated>2024-10-23T00:00:00+00:00</updated>
<author>
<name>Kevin Morrison</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.5.1, 17.4.3, 17.3.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#html-injection-in-global-search-may-lead-to-xss&quot;&gt;HTML injection in Global Search may lead to XSS&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dos-via-xml-manifest-file-import&quot;&gt;DoS via XML manifest file import&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;html-injection-in-global-search-may-lead-to-xss&quot;&gt;HTML injection in Global Search may lead to XSS&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 15.10 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. An attacker could inject HTML into the Global Search field on a diff view leading to XSS.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8312&quot;&gt;CVE-2024-8312&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;dos-via-xml-manifest-file-import&quot;&gt;DoS via XML manifest file import&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6826&quot;&gt;CVE-2024-6826&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;a92847865&quot;&gt;a92847865&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;update-regarding-helm-charts-devkit-and-analytics-stack&quot;&gt;Update regarding helm charts, devkit and analytics stack&lt;&#x2F;h3&gt;

&lt;p&gt;&lt;code&gt;Helm charts&lt;&#x2F;code&gt;, &lt;code&gt;devkit&lt;&#x2F;code&gt; and &lt;code&gt;analytics stack&lt;&#x2F;code&gt; have been patched to no longer support dynamic funnels.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;bump-ingress-nginx-controller-image-to-1112&quot;&gt;Bump Ingress NGINX Controller image to 1.11.2&lt;&#x2F;h3&gt;

&lt;p&gt;The GitLab chart bundles a forked Ingress NGINX Controller subchart. We&#x27;ve updated its image version to 1.11.2.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1751&quot;&gt;17.5.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;170051&quot;&gt;Security patch upgrade alert: Only expose to admins&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7995&quot;&gt;Backport: Ensure postgresql_new is included in GitLab CE&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1743&quot;&gt;17.4.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2058&quot;&gt;Resolve &quot;UBI FIPS: Error in bashrc due to hardening script&quot; (17.4)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2044&quot;&gt;Backport: fix: Allow non-root user to run the bundle-certificates script 17.4&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7351&quot;&gt;Backport gocloud.dev update to 17.4&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7362&quot;&gt;Backport bundle fetch fsck fix to 17.4&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168691&quot;&gt;Backport Stable Branch Danger Checks to 17-4-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168669&quot;&gt;Add version to pdf.js file in webpack builds&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168793&quot;&gt;Backport: Skip rspec fail-fast jobs if pipeline:skip-rspec-fail-fast label is set&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168569&quot;&gt;Backport fix Zoekt global code search&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168776&quot;&gt;Set author on issuable to current user if it is not already set&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;169190&quot;&gt;Backport LabKit v1.21.2 update to fix broken dependency&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;169625&quot;&gt;Fix broken duo chat spec after free access cutoff [17.4]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7998&quot;&gt;Backport: Ensure postgresql_new is included in GitLab CE&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1736&quot;&gt;17.3.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2057&quot;&gt;Resolve &quot;UBI FIPS: Error in bashrc due to hardening script&quot; (17.3)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7339&quot;&gt;Backport CreateRepositoryFromURL error handling to 17.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168938&quot;&gt;Set author on issuable to current user if it is not already set&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;169627&quot;&gt;Fix broken duo chat spec after free access cutoff [17.3]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168818&quot;&gt;Backport Stable Branch Danger Checks to 17-3-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Patch Release: 17.4.2, 17.3.5, 17.2.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/10/09/patch-release-gitlab-17-4-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/10/09/patch-release-gitlab-17-4-2-released/</id>
<published>2024-10-09T00:00:00+00:00</published>
<updated>2024-10-09T00:00:00+00:00</updated>
<author>
<name>Nikhil George</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.4.2, 17.3.5, 17.2.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. &lt;strong&gt;GitLab Dedicated customers do not need to take action.&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#run-pipelines-on-arbitrary-branches&quot;&gt;Run pipelines on arbitrary branches&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#an-attacker-can-impersonate-arbitrary-user&quot;&gt;An attacker can impersonate arbitrary user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ssrf-in-analytics-dashboard&quot;&gt;SSRF in Analytics Dashboard&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#viewing-diffs-of-mr-with-conflicts-can-be-slow&quot;&gt;Viewing diffs of MR with conflicts can be slow&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#htmli-in--oauth-page&quot;&gt;HTMLi in  OAuth page&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#deploy-keys-can-push-changes-to-an-archived-repository&quot;&gt;Deploy Keys can push changes to an archived repository&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#guests-can-disclose-project-templates&quot;&gt;Guests can disclose project templates&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#gitlab-instance-version-disclosed-to-unauthorized-users&quot;&gt;GitLab instance version disclosed to unauthorized users&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;run-pipelines-on-arbitrary-branches&quot;&gt;Run pipelines on arbitrary branches&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.
This is a critical severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 9.6).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9164&quot;&gt;CVE-2024-9164&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;an-attacker-can-impersonate-arbitrary-user&quot;&gt;An attacker can impersonate arbitrary user&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.2).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8970&quot;&gt;CVE-2024-8970&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;ssrf-in-analytics-dashboard&quot;&gt;SSRF in Analytics Dashboard&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.2).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8977&quot;&gt;CVE-2024-8977&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;viewing-diffs-of-mr-with-conflicts-can-be-slow&quot;&gt;Viewing diffs of MR with conflicts can be slow&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, were viewing diffs of MR with conflicts can be slow. This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9631&quot;&gt;CVE-2024-9631&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;a92847865&quot;&gt;a92847865&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;htmli-in-oauth-page&quot;&gt;HTMLi in OAuth page&lt;&#x2F;h3&gt;

&lt;p&gt;A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2. When authorising a new application, it can be made to render as HTML under specific circumstances.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 7.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6530&quot;&gt;CVE-2024-6530&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;deploy-keys-can-push-changes-to-an-archived-repository&quot;&gt;Deploy Keys can push changes to an archived repository&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository. This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.9).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9623&quot;&gt;CVE-2024-9623&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;stevenorman&quot;&gt;stevenorman&lt;&#x2F;a&gt; for reporting this vulnerability.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;guests-can-disclose-project-templates&quot;&gt;Guests can disclose project templates&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered discovered in GitLab EE&#x2F;CE affecting all versions starting from 11.4 before 17.2.9, all versions starting from 17.3 before 17.3.5, all versions starting from 17.4 before 17.4.2 It was possible for guest users to disclose project templates using the API.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-5005&quot;&gt;CVE-2024-5005&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;gitlab-instance-version-disclosed-to-unauthorized-users&quot;&gt;GitLab instance version disclosed to unauthorized users&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. It was possible for an unauthenticated attacker to determine the GitLab version number for a GitLab instance.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 3.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-9596&quot;&gt;CVE-2024-9596&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This issue was discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;pgascouvaillancourt&quot;&gt;Paul Gascou-Vaillancourt&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1742&quot;&gt;17.4.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2041&quot;&gt;Backport: fix: Specify an absolute directory for SCHEMA_VERSIONS_DIR to 17-4-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7323&quot;&gt;Backport grpc-go v1.67.1 upgrade to 17.4&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;167033&quot;&gt;Update expected vulnerability in enable_advanced_sast_spec.rb&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166877&quot;&gt;Skip multi-version upgrade job for stable branch MRs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168099&quot;&gt;Backport 17.4 Fix label filter by name for search&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168238&quot;&gt;Restrict duo pro assignment email to duo pro for sm&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168156&quot;&gt;Drop project_id not null constraint ci_deleted_objects&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;167937&quot;&gt;[Backport] Go-get: fix 401 error for unauthenticated requests&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1735&quot;&gt;17.3.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2042&quot;&gt;Backport: fix: Specify an absolute directory for SCHEMA_VERSIONS_DIR to 17-3-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2045&quot;&gt;Backport: fix: Allow non-root user to run the bundle-certificates script 17.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166881&quot;&gt;Skip multi-version upgrade job for stable branch MRs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168015&quot;&gt;Ensure restricted visibility levels is an array - 17.3 backport&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1729&quot;&gt;17.2.9&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166883&quot;&gt;Skip multi-version upgrade job for stable branch MRs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;168016&quot;&gt;Ensure restricted visibility levels is an array - 17.2 backport&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.4.1, 17.3.4, 17.2.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/09/25/patch-release-gitlab-17-4-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/09/25/patch-release-gitlab-17-4-1-released/</id>
<published>2024-09-25T00:00:00+00:00</published>
<updated>2024-09-25T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.4.1, 17.3.4, 17.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below be &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-leak-dependency-proxy-password-by-changing-dependency-proxy-url-via-crafted-post-request&quot;&gt;Maintainer can leak Dependency Proxy password by changing Dependency Proxy URL via crafted POST request&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ai-feature-reads-unsanitized-content-allowing-for-attacker-to-hide-prompt-injection&quot;&gt;AI feature reads unsanitized content, allowing for attacker to hide prompt injection&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-reference-can-be-exposed-in-system-notes&quot;&gt;Project reference can be exposed in system notes&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;maintainer-can-leak-dependency-proxy-password-by-changing-dependency-proxy-url-via-crafted-post-request&quot;&gt;Maintainer can leak Dependency Proxy password by changing Dependency Proxy URL via crafted POST request&lt;&#x2F;h3&gt;

&lt;p&gt;An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting via a POST request.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4278&quot;&gt;CVE-2024-4278&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ac7n0w&quot;&gt;ac7n0w&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;ai-feature-reads-unsanitized-content-allowing-for-attacker-to-hide-prompt-injection&quot;&gt;AI feature reads unsanitized content, allowing for attacker to hide prompt injection&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. An AI feature was found to read unsanitized content in a way that could&#x27;ve allowed an attacker to hide prompt injection.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 3.1).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4099&quot;&gt;CVE-2024-4099&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;project-reference-can-be-exposed-in-system-notes&quot;&gt;Project reference can be exposed in system notes&lt;&#x2F;h3&gt;

&lt;p&gt;An information disclosure issue has been discovered in Gitlab EE&#x2F;CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1. In specific conditions it was possible to disclose the path of a private project to an unauthorized user.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 2.6).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8974&quot;&gt;CVE-2024-8974&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;leipert&quot;&gt;Lukas Eipert&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;mattermost-security-updates-august-27-2024&quot;&gt;Mattermost Security Updates August 27, 2024&lt;&#x2F;h3&gt;

&lt;p&gt;Mattermost has been updated to version 9.11.1, which contains several patches and security fixes.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1741&quot;&gt;17.4.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166427&quot;&gt;Improve OpenSSL callout message&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166564&quot;&gt;Change urgency of API project&#x2F;:id&#x2F;share to &lt;code&gt;low&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166363&quot;&gt;Check commit message for issue close pattern setting&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166540&quot;&gt;Backport: Fixes issues with incorrectly displaying VR button&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166694&quot;&gt;Backport &#x27;Fix incorrect gitlab-shell-check filename&#x27; into 17.4&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166933&quot;&gt;Update OpenSSL v3 callout to delay update to GitLab 17.7&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1734&quot;&gt;17.3.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166181&quot;&gt;Improve OpenSSL callout message&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166302&quot;&gt;Fix Code Review AI features policies to check duo features enabled toggle&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166934&quot;&gt;Update OpenSSL v3 callout to delay update to GitLab 17.7&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1728&quot;&gt;17.2.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166183&quot;&gt;Improve OpenSSL callout message&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166935&quot;&gt;Update OpenSSL v3 callout to delay update to GitLab 17.7&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Patch Release: 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, 16.0.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/09/25/patch-release-gitlab-16-10-10-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/09/25/patch-release-gitlab-16-10-10-released/</id>
<published>2024-09-25T00:00:00+00:00</published>
<updated>2024-09-25T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, and 16.0.10 for GitLab Community Edition (CE) and Enterprise Edition (EE). This extends the security fixes previously added to 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10.&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain backports of an important security fix which was previously &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;releases&#x2F;2024&#x2F;09&#x2F;17&#x2F;patch-release-gitlab-17-3-3-released&#x2F;&quot;&gt;released for GitLab versions 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10&lt;&#x2F;a&gt;.
We strongly recommend that all affected self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;p&gt;Special thanks goes to Roger Meier (@bufferoverflow) who originally created the merge request in Canonical.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issue described below be &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#saml-authentication-bypass&quot;&gt;SAML authentication bypass&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;saml-authentication-bypass&quot;&gt;SAML authentication bypass&lt;&#x2F;h3&gt;

&lt;p&gt;Updates dependencies &lt;code&gt;omniauth-saml&lt;&#x2F;code&gt; to version 2.2.1 and &lt;code&gt;ruby-saml&lt;&#x2F;code&gt; to 1.17.0 to mitigate &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-45409&quot;&gt;CVE-2024-45409&lt;&#x2F;a&gt;. This security vulnerability applies only to instances which
have configured SAML based authentication.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;self-managed-gitlab-known-mitigations&quot;&gt;Self Managed GitLab: Known Mitigations&lt;&#x2F;h4&gt;

&lt;p&gt;The following mitigation for self-managed GitLab installations prevents successful exploitation of &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-45409&quot;&gt;CVE-2024-45409&lt;&#x2F;a&gt;:&lt;&#x2F;p&gt;

&lt;ol&gt;
  &lt;li&gt;Enable GitLab &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;profile&#x2F;account&#x2F;two_factor_authentication.html&quot;&gt;two-factor authentication&lt;&#x2F;a&gt; for &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;security&#x2F;two_factor_authentication.html#enforce-2fa-for-all-users&quot;&gt;all user accounts&lt;&#x2F;a&gt; on the GitLab self-managed instance (NOTE: Enabling identity provider multi-factor authentication does not mitigate this vulnerability) &lt;strong&gt;and&lt;&#x2F;strong&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;Do not allow the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;saml.html#bypass-two-factor-authentication&quot;&gt;SAML two-factor bypass&lt;&#x2F;a&gt; option in GitLab.&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h4 id=&quot;self-managed-gitlab-identifying--detecting-exploitation-attempts&quot;&gt;Self Managed GitLab: Identifying &amp;amp; Detecting Exploitation Attempts&lt;&#x2F;h4&gt;

&lt;p&gt;Evidence of attempted or successful exploitation of Ruby-SAML (&lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-45409&quot;&gt;CVE-2024-45409&lt;&#x2F;a&gt;) will be present in the GitLab &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;logs&#x2F;#application_jsonlog&quot;&gt;application_json&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;logs&#x2F;#auth_jsonlog&quot;&gt;auth_json&lt;&#x2F;a&gt; log files.&lt;&#x2F;p&gt;

&lt;h5 id=&quot;unsuccessful-exploit-attempt---hunting&quot;&gt;Unsuccessful Exploit Attempt - Hunting&lt;&#x2F;h5&gt;

&lt;p&gt;Unsuccessful exploitation attempts may generate a &lt;code&gt;ValidationError&lt;&#x2F;code&gt; from the &lt;code&gt;RubySaml&lt;&#x2F;code&gt; library. This could be for a variety of reasons related to the complexity of crafting a working exploit.&lt;&#x2F;p&gt;

&lt;p&gt;Two examples are shown below, but the error may manifest with other descriptions. The common string to search for is &lt;code&gt;RubySaml::ValidationError&lt;&#x2F;code&gt; inside the application_json log.&lt;&#x2F;p&gt;

&lt;ol&gt;
  &lt;li&gt;Invalid ticket due to incorrect callback URL
    &lt;ol&gt;
      &lt;li&gt;Example log event:&lt;&#x2F;li&gt;
      &lt;li&gt;&lt;code&gt;{&quot;severity&quot;:&quot;ERROR&quot;,&quot;time&quot;:&quot;2024-xx-xx&quot;,&quot;correlation_id&quot;:&quot;xx&quot;,&quot;message&quot;:&quot;(saml) Authentication failure! invalid_ticket: OneLogin::RubySaml::ValidationError, The response was received at https:&#x2F;&#x2F;domain.com&#x2F;users&#x2F;auth&#x2F;saml&#x2F;incorrect_callback instead of https:&#x2F;&#x2F;domain.com&#x2F;users&#x2F;auth&#x2F;saml&#x2F;callback&quot;}&lt;&#x2F;code&gt;&lt;&#x2F;li&gt;
    &lt;&#x2F;ol&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;Invalid ticket due to a certificate signing issue
    &lt;ol&gt;
      &lt;li&gt;Example log event:&lt;&#x2F;li&gt;
      &lt;li&gt;&lt;code&gt;&quot;message&quot;:&quot;(saml) Authentication failure! invalid_ticket: OneLogin::RubySaml::ValidationError, Fingerprint mismatch&quot;&lt;&#x2F;code&gt;&lt;&#x2F;li&gt;
    &lt;&#x2F;ol&gt;
  &lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h5 id=&quot;successful-exploitation---hunting&quot;&gt;Successful Exploitation - Hunting&lt;&#x2F;h5&gt;

&lt;p&gt;Successful exploitation attempts will trigger SAML related log events. However, there may be differences that make an exploit attempt unique from legitimate SAML authentication events.&lt;&#x2F;p&gt;

&lt;p&gt;A successful exploitation attempt will log whatever extern_id value is set by the attacker attempting exploitation. Therefore, identifying a unique extern_uid that is not common in your organization could be an indicator of potential exploitation.&lt;&#x2F;p&gt;

&lt;ol&gt;
  &lt;li&gt;Example exploit authentication event in the application_json log file, with a extern_id set in exploit PoC code:
    &lt;ol&gt;
      &lt;li&gt;Log event:&lt;&#x2F;li&gt;
      &lt;li&gt;&lt;code&gt;{&quot;severity&quot;:&quot;INFO&quot;,&quot;time&quot;:&quot;2024-xx-xx&quot;,&quot;correlation_id&quot;:&quot;xx&quot;,&quot;meta.caller_id&quot;:&quot;OmniauthCallbacksController#saml&quot;,&quot;meta.remote_ip&quot;:&quot;0.0.0.0&quot;,&quot;meta.feature_category&quot;:&quot;system_access&quot;,&quot;meta.client_id&quot;:&quot;ip&#x2F;0.0.0.0&quot;,&quot;message&quot;:&quot;(SAML) saving user exploit-test-user@domain.com from login with admin =\\u003e false, extern_uid =\\u003e exploit-test-user&quot;}&lt;&#x2F;code&gt;&lt;&#x2F;li&gt;
    &lt;&#x2F;ol&gt;
  &lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;p&gt;When crafting an exploit, there are many &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;saml.html#configure-assertions&quot;&gt;SAML assertions&lt;&#x2F;a&gt; an attacker would need to craft to perfectly replicate a legitimate login. These include both the key and value fields that you specify at your IdP, and may be unknown to unauthorized individuals - especially if you have customized these attributes.&lt;&#x2F;p&gt;

&lt;p&gt;You can review your auth_json log file to look for SAML responses with incorrect or missing information in the &lt;code&gt;attributes&lt;&#x2F;code&gt; section.&lt;&#x2F;p&gt;

&lt;ol&gt;
  &lt;li&gt;Example of a SAML authentication event in the auth_json log file.
    &lt;ol&gt;
      &lt;li&gt;&lt;code&gt;&quot;severity&quot;:&quot;INFO&quot;,&quot;time&quot;:&quot;2024-xx-xx&quot;,&quot;correlation_id&quot;:&quot;xx&quot;,&quot;meta.caller_id&quot;:&quot;OmniauthCallbacksController#saml&quot;,&quot;meta.remote_ip&quot;:&quot;0.0.0.0&quot;,&quot;meta.feature_category&quot;:&quot;system_access&quot;,&quot;meta.client_id&quot;:&quot;ip&#x2F;0.0.0.0&quot;,&quot;payload_type&quot;:&quot;saml_response&quot;: {&quot;issuer&quot;: [&quot;xxx&quot;],&quot;name_id&quot;: &quot;xxx&quot;,&quot;name_id_format&quot;: &quot;xxx&quot;,&quot;name_id_spnamequalifier&quot;: null,&quot;name_id_namequalifier&quot;: null,&quot;destination&quot;: &quot;xxx&quot;,&quot;audiences&quot;: [&quot;xxx&quot;],&quot;attributes&quot;: {&quot;first_name&quot;: [&quot;xxx&quot;],&quot;last_name&quot;: [&quot;yyy&quot;], &quot;email&quot;: [&quot;zzz&quot;]}}&lt;&#x2F;code&gt;&lt;&#x2F;li&gt;
    &lt;&#x2F;ol&gt;
  &lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h5 id=&quot;detecting-exploitation-attempts&quot;&gt;Detecting Exploitation Attempts&lt;&#x2F;h5&gt;

&lt;p&gt;For self managed customers forwarding GitLab application_json logs to a SIEM, creating detections to detect Ruby-SAML (&lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-45409&quot;&gt;CVE-2024-45409&lt;&#x2F;a&gt;) exploitation attempts is possible. Our team is sharing two threat detections rules, written in Sigma format, to detect potential exploitation.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Note:&lt;&#x2F;strong&gt; These detections may need to be tuned and modified to customer environments in order to deliver effective results, and due to varying configurations of different customer environments, customers should validate the legitimacy and accuracy of any events identified by these detections.&lt;&#x2F;p&gt;

&lt;h5 id=&quot;users-with-more-than-1-unique-extern_uid-over-time&quot;&gt;Users with more than 1 unique extern_uid over time&lt;&#x2F;h5&gt;

&lt;p&gt;This detection is designed to identify an authenticated SAML user with more than one extern_uid values linked to authentication events, a potential indication of malicious authentications with an attacker set extern_uid field.&lt;&#x2F;p&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight plaintext&quot;&gt;&lt;code&gt;title: Multiple extern_ids
description: Detects when their are multiple extern_id&#x27;s associated with a user.
author: Gitlab Security Engineering
date: 09&#x2F;15&#x2F;2024
schedule: &quot;*&#x2F;10 * * * *&quot;
pseudocode: |
  select log source application.log
  where 7d &amp;lt; event_time &amp;lt; now()
  where severity=&quot;INFO&quot; and meta_caller_id=&quot;Groups::OmniauthCallbacksController#group_saml&quot;
  regex(message, &quot;saving user (?&amp;lt;user_email&amp;gt;\S+) .*extern_uid \S+ (?&amp;lt;extern_id&amp;gt;[\S]+)&quot;)
  count extern_id by user_email as total_extern_ids
  where total_extern_ids &amp;gt; 1
verify: Review Gitlab application logs for the source IP of the SAML authentications. If there is a singular IP for all extern_ids this could point to a false positive. Cross reference the SAML authentication source IP&#x2F;s with the known user&#x27;s IP from sso authentication logs.
tuning: N&#x2F;A
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;h5 id=&quot;gitlab-saml-authentication-from-a-different-ip-address-than-other-idp-events-for-the-same-user-over-time&quot;&gt;GitLab SAML authentication from a different IP address than other iDP events for the same user over time&lt;&#x2F;h5&gt;

&lt;p&gt;This detection is designed to correlate authentication events, grouped by user, against both GitLab SAML authentication events as well as other iDP authentication events in an effort to identify any change in user IP address, which could be an indication of attacker authentication sessions.&lt;&#x2F;p&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight plaintext&quot;&gt;&lt;code&gt;title: Gitlab SAML IP differs from SSO IP
description: Detects when the source IP for the SAML authentication to Gitlab from application.log differs from the users known IP from SSO MFA logs.
author: Gitlab Security Engineering
date: 09&#x2F;15&#x2F;2024
schedule: &quot;*&#x2F;10 * * * *&quot;
pseudocode: |
  select log source application.log
  where severity=&quot;INFO&quot; and meta_caller_id=&quot;Groups::OmniauthCallbacksController#group_saml&quot;
  regex(message, &quot;saving user (?&amp;lt;user_email&amp;gt;\S+) &quot;)
  #Create sub-query to bring in table from SSO authentication data
  select meta_remote_ip, user_email
  where user_email in
    (
    select log source authentication
    where 1d &amp;lt; event_time &amp;lt; now()
    where event_type=&quot;user.authentication.auth_via_mfa&quot;
    group by user_email, sso_source_ip
    )
  where sso_source_ip!=meta_remote_ip
verify: False positives can arise when the user is traveling. Review SSO authentication logs to see if the geo-location is similar to the SAML authentication to Gitlab. If any discrepancies are found, reach out to the user for verification. If the user is not traveling, temporarily lock the user&#x27;s Gitlab account and review their activity through Gitlab&#x27;s application logs.
tuning: If the query is producing high false positives, consider using geolocation functions on IPs to compare the cities and countries that are generating the authentications.
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Patch Release: 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/09/17/patch-release-gitlab-17-3-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/09/17/patch-release-gitlab-17-3-3-released/</id>
<published>2024-09-17T00:00:00+00:00</published>
<updated>2024-09-17T00:00:00+00:00</updated>
<author>
<name>Rohit Shambhuni</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;All GitLab Dedicated instances have been upgraded and customers do not need to take action.&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;p&gt;Version 17.2.6 has been used to remediate GitLab Dedicated and hasn&#x27;t been made public. Version 17.2.7 contains identical changes.&lt;&#x2F;p&gt;
&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#saml-authentication-bypass&quot;&gt;SAML authentication bypass&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;saml-authentication-bypass&quot;&gt;SAML authentication bypass&lt;&#x2F;h3&gt;

&lt;p&gt;Updates dependencies &lt;code&gt;omniauth-saml&lt;&#x2F;code&gt; to version 2.2.1 and &lt;code&gt;ruby-saml&lt;&#x2F;code&gt; to 1.17.0 to mitigate &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-45409&quot;&gt;CVE-2024-45409&lt;&#x2F;a&gt;. This security vulnerability applies only to instances which
have configured SAML based authentication.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;self-managed-gitlab-known-mitigations&quot;&gt;Self Managed GitLab: Known Mitigations&lt;&#x2F;h4&gt;

&lt;p&gt;The following mitigation for self-managed GitLab installations prevents successful exploitation of &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-45409&quot;&gt;CVE-2024-45409&lt;&#x2F;a&gt;:&lt;&#x2F;p&gt;
&lt;ol&gt;
  &lt;li&gt;Enable GitLab &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;profile&#x2F;account&#x2F;two_factor_authentication.html&quot;&gt;two-factor authentication&lt;&#x2F;a&gt; for &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;security&#x2F;two_factor_authentication.html#enforce-2fa-for-all-users&quot;&gt;all user accounts&lt;&#x2F;a&gt; on the GitLab self-managed instance (NOTE: Enabling identity provider multi-factor authentication does not mitigate this vulnerability) &lt;strong&gt;and&lt;&#x2F;strong&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;Do not allow the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;saml.html#bypass-two-factor-authentication&quot;&gt;SAML two-factor bypass&lt;&#x2F;a&gt; option in GitLab.&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h4 id=&quot;self-managed-gitlab-identifying--detecting-exploitation-attempts&quot;&gt;Self Managed GitLab: Identifying &amp;amp; Detecting Exploitation Attempts&lt;&#x2F;h4&gt;

&lt;p&gt;Evidence of attempted or successful exploitation of Ruby-SAML (&lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-45409&quot;&gt;CVE-2024-45409&lt;&#x2F;a&gt;) will be present in the GitLab &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;logs&#x2F;#application_jsonlog&quot;&gt;application_json&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;logs&#x2F;#auth_jsonlog&quot;&gt;auth_json&lt;&#x2F;a&gt; log files.&lt;&#x2F;p&gt;

&lt;h5 id=&quot;unsuccessful-exploit-attempt---hunting&quot;&gt;Unsuccessful Exploit Attempt - Hunting&lt;&#x2F;h5&gt;

&lt;p&gt;Unsuccessful exploitation attempts may generate a &lt;code&gt;ValidationError&lt;&#x2F;code&gt; from the &lt;code&gt;RubySaml&lt;&#x2F;code&gt; library. This could be for a variety of reasons related to the complexity of crafting a working exploit.&lt;&#x2F;p&gt;

&lt;p&gt;Two examples are shown below, but the error may manifest with other descriptions. The common string to search for is &lt;code&gt;RubySaml::ValidationError&lt;&#x2F;code&gt; inside the application_json log.&lt;&#x2F;p&gt;

&lt;ol&gt;
  &lt;li&gt;Invalid ticket due to incorrect callback URL
    &lt;ol&gt;
      &lt;li&gt;Example log event:&lt;&#x2F;li&gt;
      &lt;li&gt;&lt;code&gt;{&quot;severity&quot;:&quot;ERROR&quot;,&quot;time&quot;:&quot;2024-xx-xx&quot;,&quot;correlation_id&quot;:&quot;xx&quot;,&quot;message&quot;:&quot;(saml) Authentication failure! invalid_ticket: OneLogin::RubySaml::ValidationError, The response was received at https:&#x2F;&#x2F;domain.com&#x2F;users&#x2F;auth&#x2F;saml&#x2F;incorrect_callback instead of https:&#x2F;&#x2F;domain.com&#x2F;users&#x2F;auth&#x2F;saml&#x2F;callback&quot;}&lt;&#x2F;code&gt;&lt;&#x2F;li&gt;
    &lt;&#x2F;ol&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;Invalid ticket due to a certificate signing issue
    &lt;ol&gt;
      &lt;li&gt;Example log event:&lt;&#x2F;li&gt;
      &lt;li&gt;&lt;code&gt;&quot;message&quot;:&quot;(saml) Authentication failure! invalid_ticket: OneLogin::RubySaml::ValidationError, Fingerprint mismatch&quot;&lt;&#x2F;code&gt;&lt;&#x2F;li&gt;
    &lt;&#x2F;ol&gt;
  &lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h5 id=&quot;successful-exploitation---hunting&quot;&gt;Successful Exploitation - Hunting&lt;&#x2F;h5&gt;

&lt;p&gt;Successful exploitation attempts will trigger SAML related log events. However, there may be differences that make an exploit attempt unique from legitimate SAML authentication events.&lt;&#x2F;p&gt;

&lt;p&gt;A successful exploitation attempt will log whatever extern_id value is set by the attacker attempting exploitation. Therefore, identifying a unique extern_uid that is not common in your organization could be an indicator of potential exploitation.&lt;&#x2F;p&gt;

&lt;ol&gt;
  &lt;li&gt;Example exploit authentication event in the application_json log file, with a extern_id set in exploit PoC code:
    &lt;ol&gt;
      &lt;li&gt;Log event:&lt;&#x2F;li&gt;
      &lt;li&gt;&lt;code&gt;{&quot;severity&quot;:&quot;INFO&quot;,&quot;time&quot;:&quot;2024-xx-xx&quot;,&quot;correlation_id&quot;:&quot;xx&quot;,&quot;meta.caller_id&quot;:&quot;OmniauthCallbacksController#saml&quot;,&quot;meta.remote_ip&quot;:&quot;0.0.0.0&quot;,&quot;meta.feature_category&quot;:&quot;system_access&quot;,&quot;meta.client_id&quot;:&quot;ip&#x2F;0.0.0.0&quot;,&quot;message&quot;:&quot;(SAML) saving user exploit-test-user@domain.com from login with admin =\\u003e false, extern_uid =\\u003e exploit-test-user&quot;}&lt;&#x2F;code&gt;&lt;&#x2F;li&gt;
    &lt;&#x2F;ol&gt;
  &lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;p&gt;When crafting an exploit, there are many &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;saml.html#configure-assertions&quot;&gt;SAML assertions&lt;&#x2F;a&gt; an attacker would need to craft to perfectly replicate a legitimate login. These include both the key and value fields that you specify at your IdP, and may be unknown to unauthorized individuals - especially if you have customized these attributes.&lt;&#x2F;p&gt;

&lt;p&gt;You can review your auth_json log file to look for SAML responses with incorrect or missing information in the &lt;code&gt;attributes&lt;&#x2F;code&gt; section.&lt;&#x2F;p&gt;
&lt;ol&gt;
  &lt;li&gt;Example of a SAML authentication event in the auth_json log file.
    &lt;ol&gt;
      &lt;li&gt;&lt;code&gt;&quot;severity&quot;:&quot;INFO&quot;,&quot;time&quot;:&quot;2024-xx-xx&quot;,&quot;correlation_id&quot;:&quot;xx&quot;,&quot;meta.caller_id&quot;:&quot;OmniauthCallbacksController#saml&quot;,&quot;meta.remote_ip&quot;:&quot;0.0.0.0&quot;,&quot;meta.feature_category&quot;:&quot;system_access&quot;,&quot;meta.client_id&quot;:&quot;ip&#x2F;0.0.0.0&quot;,&quot;payload_type&quot;:&quot;saml_response&quot;: {&quot;issuer&quot;: [&quot;xxx&quot;],&quot;name_id&quot;: &quot;xxx&quot;,&quot;name_id_format&quot;: &quot;xxx&quot;,&quot;name_id_spnamequalifier&quot;: null,&quot;name_id_namequalifier&quot;: null,&quot;destination&quot;: &quot;xxx&quot;,&quot;audiences&quot;: [&quot;xxx&quot;],&quot;attributes&quot;: {&quot;first_name&quot;: [&quot;xxx&quot;],&quot;last_name&quot;: [&quot;yyy&quot;], &quot;email&quot;: [&quot;zzz&quot;]}}&lt;&#x2F;code&gt;&lt;&#x2F;li&gt;
    &lt;&#x2F;ol&gt;
  &lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h5 id=&quot;detecting-exploitation-attempts&quot;&gt;Detecting Exploitation Attempts&lt;&#x2F;h5&gt;

&lt;p&gt;For self managed customers forwarding GitLab application_json logs to a SIEM, creating detections to detect Ruby-SAML (&lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-45409&quot;&gt;CVE-2024-45409&lt;&#x2F;a&gt;) exploitation attempts is possible. Our team is sharing two threat detections rules, written in Sigma format, to detect potential exploitation.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Note:&lt;&#x2F;strong&gt; These detections may need to be tuned and modified to customer environments in order to deliver effective results, and due to varying configurations of different customer environments, customers should validate the legitimacy and accuracy of any events identified by these detections.&lt;&#x2F;p&gt;

&lt;h5 id=&quot;users-with-more-than-1-unique-extern_uid-over-time&quot;&gt;Users with more than 1 unique extern_uid over time&lt;&#x2F;h5&gt;

&lt;p&gt;This detection is designed to identify an authenticated SAML user with more than one extern_uid values linked to authentication events, a potential indication of malicious authentications with an attacker set extern_uid field.&lt;&#x2F;p&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight plaintext&quot;&gt;&lt;code&gt;title: Multiple extern_ids
description: Detects when their are multiple extern_id&#x27;s associated with a user. 
author: Gitlab Security Engineering
date: 09&#x2F;15&#x2F;2024
schedule: &quot;*&#x2F;10 * * * *&quot;
pseudocode: |
  select log source application.log
  where 7d &amp;lt; event_time &amp;lt; now()
  where severity=&quot;INFO&quot; and meta_caller_id=&quot;Groups::OmniauthCallbacksController#group_saml&quot;
  regex(message, &quot;saving user (?&amp;lt;user_email&amp;gt;\S+) .*extern_uid \S+ (?&amp;lt;extern_id&amp;gt;[\S]+)&quot;)
  count extern_id by user_email as total_extern_ids
  where total_extern_ids &amp;gt; 1
verify: Review Gitlab application logs for the source IP of the SAML authentications. If there is a singular IP for all extern_ids this could point to a false positive. Cross reference the SAML authentication source IP&#x2F;s with the known user&#x27;s IP from sso authentication logs. 
tuning: N&#x2F;A
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;h5 id=&quot;gitlab-saml-authentication-from-a-different-ip-address-than-other-idp-events-for-the-same-user-over-time&quot;&gt;GitLab SAML authentication from a different IP address than other iDP events for the same user over time&lt;&#x2F;h5&gt;

&lt;p&gt;This detection is designed to correlate authentication events, grouped by user, against both GitLab SAML authentication events as well as other iDP authentication events in an effort to identify any change in user IP address, which could be an indication of attacker authentication sessions.&lt;&#x2F;p&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight plaintext&quot;&gt;&lt;code&gt;title: Gitlab SAML IP differs from SSO IP
description: Detects when the source IP for the SAML authentication to Gitlab from application.log differs from the users known IP from SSO MFA logs. 
author: Gitlab Security Engineering
date: 09&#x2F;15&#x2F;2024
schedule: &quot;*&#x2F;10 * * * *&quot;
pseudocode: |
  select log source application.log 
  where severity=&quot;INFO&quot; and meta_caller_id=&quot;Groups::OmniauthCallbacksController#group_saml&quot;
  regex(message, &quot;saving user (?&amp;lt;user_email&amp;gt;\S+) &quot;)
  #Create sub-query to bring in table from SSO authentication data
  select meta_remote_ip, user_email
  where user_email in
    (
    select log source authentication
    where 1d &amp;lt; event_time &amp;lt; now()
    where event_type=&quot;user.authentication.auth_via_mfa&quot;
    group by user_email, sso_source_ip
    )
  where sso_source_ip!=meta_remote_ip
verify: False positives can arise when the user is traveling. Review SSO authentication logs to see if the geo-location is similar to the SAML authentication to Gitlab. If any discrepancies are found, reach out to the user for verification. If the user is not traveling, temporarily lock the user&#x27;s Gitlab account and review their activity through Gitlab&#x27;s application logs. 
tuning: If the query is producing high false positives, consider using geolocation functions on IPs to compare the cities and countries that are generating the authentications.
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1733&quot;&gt;17.3.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;165585&quot;&gt;Improve OpenSSL 3 upgrading warning notes&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166063&quot;&gt;Upgrade bundler for the GitLab Backup CLI gem&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166059&quot;&gt;Update ruby-saml and omniauth-saml&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1727&quot;&gt;17.2.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;165587&quot;&gt;Improve OpenSSL 3 upgrading warning notes&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166043&quot;&gt;Update ruby-saml and omniauth-saml&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1718&quot;&gt;17.1.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;165589&quot;&gt;Improve OpenSSL 3 upgrading warning notes&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166058&quot;&gt;Update ruby-saml and omniauth-saml&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1708&quot;&gt;17.0.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166058&quot;&gt;Update ruby-saml and omniauth-saml&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;161110&quot;&gt;16.11.10&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;166058&quot;&gt;Update ruby-saml and omniauth-saml&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Patch Release: 17.3.2, 17.2.5, 17.1.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/</id>
<published>2024-09-11T00:00:00+00:00</published>
<updated>2024-09-11T00:00:00+00:00</updated>
<author>
<name>Ottilia Westerlund</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.3.2, 17.2.5, 17.1.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#execute-environment-stop-actions-as-the-owner-of-the-stop-action-job&quot;&gt;Execute environment stop actions as the owner of the stop action job&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#prevent-code-injection-in-product-analytics-funnels-yaml&quot;&gt;Prevent code injection in Product Analytics funnels YAML&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ssrf-via-dependency-proxy&quot;&gt;SSRF via Dependency Proxy&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-via-sending-a-specific-post-request&quot;&gt;Denial of Service via sending a a specific POST request&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ci_job_token-can-be-used-to-obtain-gitlab-session-token&quot;&gt;CI_JOB_TOKEN can be used to obtain GitLab session token&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#variables-from-settings-are-not-overwritten-by-pep-if-a-template-is-included&quot;&gt;Variables from settings are not overwritten by PEP if a template is included&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#guests-can-disclose-the-full-source-code-of-projects-using-custom-group-level-templates&quot;&gt;Guests can disclose the full source code of projects using custom group-level templates&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#identitiescontroller-allows-linking-of-arbitrary-unclaimed-provider-identities&quot;&gt;IdentitiesController allows linking of arbitrary unclaimed provider identities&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#open-redirect-in-repotreeid-endpoint-can-lead-to-account-takeover-through-broken-oauth-flow&quot;&gt;Open redirect in repo&#x2F;tree&#x2F;:id endpoint can lead to account takeover through broken OAuth flow&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#open-redirect-in-release-permanent-links-can-lead-to-account-takeover-through-broken-oauth-flow&quot;&gt;Open redirect in release permanent links can lead to account takeover through broken OAuth flow&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#guest-user-with-admin-group-member-permission-can-edit-custom-role-to-gain-other-permissions&quot;&gt;Guest user with Admin group member permission can edit custom role to gain other permissions&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#exposure-of-protected-and-masked-cicd-variables-by-abusing-on-demand-dast&quot;&gt;Exposure of protected and masked CI&#x2F;CD variables by abusing on-demand DAST&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#credentials-disclosed-when-repository-mirroring-fails&quot;&gt;Credentials disclosed when repository mirroring fails&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#commit-information-visible-through-release-atom-endpoint-for-guest-users&quot;&gt;Commit information visible through release atom endpoint for guest users&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dependency-proxy-credentials-are-logged-in-plaintext-in-graphql-logs&quot;&gt;Dependency Proxy Credentials are Logged in Plaintext in graphql Logs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#user-application-can-spoof-the-redirect-url&quot;&gt;User Application can spoof the redirect url&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-developers-can-view-group-runners-information&quot;&gt;Group Developers can view group runners information&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;execute-environment-stop-actions-as-the-owner-of-the-stop-action-job&quot;&gt;Execute environment stop actions as the owner of the stop action job&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.
This is a critical severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 9.9).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6678&quot;&gt;CVE-2024-6678&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;prevent-code-injection-in-product-analytics-funnels-yaml&quot;&gt;Prevent code injection in Product Analytics funnels YAML&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 8.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8640&quot;&gt;CVE-2024-8640&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;ssrf-via-dependency-proxy&quot;&gt;SSRF via Dependency Proxy&lt;&#x2F;h3&gt;

&lt;p&gt;A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 7.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8635&quot;&gt;CVE-2024-8635&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;joernchen&quot;&gt;joernchen&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-via-sending-a-specific-post-request&quot;&gt;Denial of Service via sending a specific POST request&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2  which could cause Denial of Service via sending a specific POST request.
This is a high severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 7.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8124&quot;&gt;CVE-2024-8124&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sim4n6&quot;&gt;sim4n6&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;ci_job_token-can-be-used-to-obtain-gitlab-session-token&quot;&gt;CI_JOB_TOKEN can be used to obtain GitLab session token&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It may have been possible for an attacker with a victim&#x27;s CI_JOB_TOKEN to obtain a GitLab session token belonging to the victim.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8641&quot;&gt;CVE-2024-8641&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;variables-from-settings-are-not-overwritten-by-pep-if-a-template-is-included&quot;&gt;Variables from settings are not overwritten by PEP if a template is included&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI&#x2F;CD template.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8311&quot;&gt;CVE-2024-8311&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;Andyschoenen&quot;&gt;Andy Schoenen&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;guests-can-disclose-the-full-source-code-of-projects-using-custom-group-level-templates&quot;&gt;Guests can disclose the full source code of projects using custom group-level templates&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4660&quot;&gt;CVE-2024-4660&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;identitiescontroller-allows-linking-of-arbitrary-unclaimed-provider-identities&quot;&gt;IdentitiesController allows linking of arbitrary unclaimed provider identities&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE&#x2F;CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.4).
We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;joernchen&quot;&gt;Joern Schneeweisz&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;open-redirect-in-repotreeid-endpoint-can-lead-to-account-takeover-through-broken-oauth-flow&quot;&gt;Open redirect in repo&#x2F;tree&#x2F;:id endpoint can lead to account takeover through broken OAuth flow&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4283&quot;&gt;CVE-2024-4283&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;open-redirect-in-release-permanent-links-can-lead-to-account-takeover-through-broken-oauth-flow&quot;&gt;Open redirect in release permanent links can lead to account takeover through broken OAuth flow&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4612&quot;&gt;CVE-2024-4612&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;guest-user-with-admin-group-member-permission-can-edit-custom-role-to-gain-other-permissions&quot;&gt;Guest user with Admin group member permission can edit custom role to gain other permissions&lt;&#x2F;h3&gt;

&lt;p&gt;A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could have escalated their privileges to include other custom roles.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8631&quot;&gt;CVE-2024-8631&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;chotebabume&quot;&gt;chotebabume&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;exposure-of-protected-and-masked-cicd-variables-by-abusing-on-demand-dast&quot;&gt;Exposure of protected and masked CI&#x2F;CD variables by abusing on-demand DAST&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2743&quot;&gt;CVE-2024-2743&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;0xn3va&quot;&gt;0xn3va&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;credentials-disclosed-when-repository-mirroring-fails&quot;&gt;Credentials disclosed when repository mirroring fails&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from repository mirror configuration.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-5435&quot;&gt;CVE-2024-5435&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;gudanggaramfilter&quot;&gt;gudanggaramfilter&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;commit-information-visible-through-release-atom-endpoint-for-guest-users&quot;&gt;Commit information visible through release atom endpoint for guest users&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6389&quot;&gt;CVE-2024-6389&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;dependency-proxy-credentials-are-logged-in-plaintext-in-graphql-logs&quot;&gt;Dependency Proxy Credentials are Logged in Plaintext in graphql Logs&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, where dependency proxy credentials are retained in graphql Logs.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:L&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:L&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.0).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4472&quot;&gt;CVE-2024-4472&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ac7n0w&quot;&gt;ac7n0w&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;user-application-can-spoof-the-redirect-url&quot;&gt;User Application can spoof the redirect url&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 3.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6446&quot;&gt;CVE-2024-6446&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;group-developers-can-view-group-runners-information&quot;&gt;Group Developers can view group runners information&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2,  where group runners information was disclosed to unauthorised group members.
This is a low severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 3.1).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6685&quot;&gt;CVE-2024-6685&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1732&quot;&gt;17.3.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;2012&quot;&gt;UBI: Backport openssl gem pin to 17-3-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;163188&quot;&gt;Backport &quot;Disable allow_failure for release-environments pipeline&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;163437&quot;&gt;Fix issue when resizing images in RTE&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;163809&quot;&gt;Backport fix for listing projects via API&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;164228&quot;&gt;Backport lock retries timeout for sliding list strategy to &lt;code&gt;17-3&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;164748&quot;&gt;backport archived filter regression bugfix&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;164791&quot;&gt;Ensure to update updated_at when updating access data&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;164894&quot;&gt;Backport OpenSSL v3 callout to 17.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;165464&quot;&gt;Quarantine pypi package registry spec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;164830&quot;&gt;Fix Sidekiq crashing when GITLAB_LOG_LEVEL set to debug&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;165343&quot;&gt;[17.3 Backport] Bump OpenSSL to 3.2.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;165279&quot;&gt;Backport 17.3 - Remove elasticsearch call on init&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7890&quot;&gt;Downgrade OpenSSL version to 1.1.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7895&quot;&gt;[17.3 Backport] Deprecate CentOS 7&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1725&quot;&gt;17.2.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;163189&quot;&gt;Backport &quot;Disable allow_failure for release-environments pipeline&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;163421&quot;&gt;Always build assets image when tagging&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162466&quot;&gt;Update google-cloud-core and google-cloud-env gems&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162937&quot;&gt;Backport to 17.2: Fixes Geo Replication Details incorrectly empty&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;164893&quot;&gt;Backport OpenSSL v3 callout to 17.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;164561&quot;&gt;Backport to 17.2: Fix JobArtifactState query timeout&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7874&quot;&gt;CI: Add test basic package functionality before release (17.2 Backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7876&quot;&gt;Use latest builder images for check-packages pipeline (17.2 Backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7896&quot;&gt;[17.2 Backport] Deprecate CentOS 7&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1717&quot;&gt;17.1.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;163191&quot;&gt;Backport &quot;Disable allow_failure for release-environments pipeline&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162939&quot;&gt;Backport to 17.1: Fixes Geo Replication Details view&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;164892&quot;&gt;Backport OpenSSL v3 callout to 17.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;165270&quot;&gt;Backport to 17.1: Fix JobArtifactState query timeout&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7875&quot;&gt;CI: Add test basic package functionality before release (17.1 Backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7877&quot;&gt;Use latest builder images for check-packages pipeline (17.1 Backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7897&quot;&gt;[17.1 Backport] Deprecate CentOS 7&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.3.1, 17.2.4, 17.1.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/08/21/patch-release-gitlab-17-3-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/08/21/patch-release-gitlab-17-3-1-released/</id>
<published>2024-08-21T00:00:00+00:00</published>
<updated>2024-08-21T00:00:00+00:00</updated>
<author>
<name>Ameya Darshan</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.3.1, 17.2.4, 17.1.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#the-gitlab-web-interface-does-not-guarantee-information-integrity-when-downloading-source-code-from-releases&quot;&gt;The GitLab Web Interface Does Not Guarantee Information Integrity When Downloading Source Code from Releases.&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-by-importing-maliciously-crafted-github-repository&quot;&gt;Denial of Service by importing maliciously crafted GitHub repository&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#prompt-injection-in-resolve-vulnerabilty-results-in-arbitrary-command-execution-in-victims-pipeline&quot;&gt;Prompt injection in &quot;Resolve Vulnerabilty&quot; results in arbitrary command execution in victim&#x27;s pipeline&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#an-unauthorized-user-can-perform-certain-actions-through-graphql-after-a-group-owner-enables-ip-restrictions&quot;&gt;An unauthorized user can perform certain actions through GraphQL after a group owner enables IP restrictions&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;the-gitlab-web-interface-does-not-guarantee-information-integrity-when-downloading-source-code-from-releases&quot;&gt;The GitLab Web Interface Does Not Guarantee Information Integrity When Downloading Source Code from Releases.&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6502&quot;&gt;CVE-2024-6502&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-by-importing-maliciously-crafted-github-repository&quot;&gt;Denial of Service by importing maliciously crafted GitHub repository&lt;&#x2F;h3&gt;

&lt;p&gt;A Denial of Service (DoS) issue has been discovered in GitLab CE&#x2F;EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1. A denial of service could occur upon importing a maliciously crafted repository using the GitHub importer.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5). 
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-8041&quot;&gt;CVE-2024-8041&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;a92847865&quot;&gt;a92847865&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;prompt-injection-in-resolve-vulnerabilty-results-in-arbitrary-command-execution-in-victims-pipeline&quot;&gt;Prompt injection in &quot;Resolve Vulnerabilty&quot; results in arbitrary command execution in victim&#x27;s pipeline&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, allows an attacker to execute arbitrary command in a victim&#x27;s pipeline through prompt injection.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-7110&quot;&gt;CVE-2024-7110&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;hhttps:&#x2F;&#x2F;gitlab.com&#x2F;dappelt&quot;&gt;Dennis Appelt&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;an-unauthorized-user-can-perform-certain-actions-through-graphql-after-a-group-owner-enables-ip-restrictions&quot;&gt;An unauthorized user can perform certain actions through GraphQL after a group owner enables IP restrictions&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorized users to perform some actions at the group level.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-3127&quot;&gt;CVE-2024-3127&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;0x777&quot;&gt;0x777&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;mattermost-security-updates-july-2-2024&quot;&gt;Mattermost Security Updates July 2, 2024&lt;&#x2F;h3&gt;

&lt;p&gt;Mattermost has been updated to versions 9.9.0, which contains several patches and security fixes.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1731&quot;&gt;17.3.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162860&quot;&gt;Fix timeout when checking group dependencies (17.3 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162869&quot;&gt;Resolve &quot;Background migrations removed issues&quot; (backport to 17.3)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162798&quot;&gt;Backport to 17.3: Fixes Geo Replication Details incorrectly empty&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162829&quot;&gt;17.3 Backport vulnerability migration bugfix&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7852&quot;&gt;Add debian 10 (Buster) to deprecated OS list&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7868&quot;&gt;Raise default PostgreSQL shared buffers minimum to 256 MB&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162931&quot;&gt;Include language server version in code suggestions&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162968&quot;&gt;Turn NotFound from Gitaly into 404 for InfoRefs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1724&quot;&gt;17.2.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161900&quot;&gt;Backport 17.2: Build assets image when running release environments&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161129&quot;&gt;Backport DORA DF score recalculation&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162292&quot;&gt;Backport 17.2 - Do not run release-environments on tagging&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162311&quot;&gt;Remove stong_memoization for cloud connector services&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161773&quot;&gt;Check if columns exist before running credit card hashing background migration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162491&quot;&gt;Merge branch &#x27;jennykim&#x2F;remove-release-environment-canonical-pipeline&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162523&quot;&gt;Fix empty dependency list page&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162544&quot;&gt;Backport 17-2: handle empty repository.ff_merge&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162868&quot;&gt;17.2 backport for: Resolve &quot;Background migrations removed in 17.1 cause upgrade issues&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162935&quot;&gt;Include language server version in code suggestions&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162969&quot;&gt;Turn NotFound from Gitaly into 404 for InfoRefs)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1716&quot;&gt;17.1.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161489&quot;&gt;Backport 17.1: Release Environments - pipeline level resource group&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161901&quot;&gt;Backport 17.1: Build assets image when running release environments&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162293&quot;&gt;Backport 17.1 - Do not run release-environments on tagging&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162001&quot;&gt;Fix backport gitlab-qa shm fix to 17.1 stable branch version&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162492&quot;&gt;Backport canonical RE downstream pipeline removal&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162771&quot;&gt;Update minimum Go version requirement for self-compiled (17.1)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162542&quot;&gt;Backport 17-1: handle empty repository.ff_merge&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162865&quot;&gt;Resolve &quot;Background migrations removed issues&quot; (backport to 17.1)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;163169&quot;&gt;Fix: backport !157455 to 17-1-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;162936&quot;&gt;Include language server version in code suggestions&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Note: GitLab releases have skipped 17.2.3 and 17.1.5 . There are no patches with these version numbers.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.2.2, 17.1.4, 17.0.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/08/07/patch-release-gitlab-17-2-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/08/07/patch-release-gitlab-17-2-2-released/</id>
<published>2024-08-07T00:00:00+00:00</published>
<updated>2024-08-07T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.2.2, 17.1.4, 17.0.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#privilege-escalation-via-lfs-tokens-granting-unrestricted-repository-access&quot;&gt;Privilege Escalation via LFS Tokens Granting Unrestricted Repository Access&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cross-project-access-of-security-policy-bot&quot;&gt;Cross project access of Security policy bot&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#advanced-search-redos-in-highlight-for-code-results&quot;&gt;Advanced search ReDOS in highlight for code results&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-via-banzai-pipeline&quot;&gt;Denial of Service via banzai pipeline&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-using-adoc-files&quot;&gt;Denial of service using adoc files&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-in-refmatcher-when-matching-branch-names-using-wildcards&quot;&gt;ReDoS in RefMatcher when matching branch names using wildcards&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#path-encoding-can-cause-the-web-interface-to-not-render-diffs-correctly&quot;&gt;Path encoding can cause the Web interface to not render diffs correctly.&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#xss-while-viewing-raw-xhtml-files-through-api&quot;&gt;XSS while viewing raw XHTML files through API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ambiguous-tag-name-exploitation&quot;&gt;Ambiguous tag name exploitation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#logs-disclosings-potentially-sensitive-data-in-query-params&quot;&gt;Logs disclosings potentially sensitive data in query params&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#password-bypass-on-approvals-using-policy-projects&quot;&gt;Password bypass on approvals using policy projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-when-parsing-git-push&quot;&gt;ReDoS when parsing git push&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#webhook-deletion-audit-log-can-preserve-auth-credentials&quot;&gt;Webhook deletion audit log can preserve auth credentials&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;privilege-escalation-via-lfs-tokens-granting-unrestricted-repository-access&quot;&gt;Privilege Escalation via LFS Tokens Granting Unrestricted Repository Access&lt;&#x2F;h3&gt;

&lt;p&gt;A permission check vulnerability in GitLab CE&#x2F;EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2  allowed for LFS tokens to read and write to the user owned repositories.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.8).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-3035&quot;&gt;CVE-2024-3035&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cross-project-access-of-security-policy-bot&quot;&gt;Cross project access of Security policy bot&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which allowed cross project access for Security policy bot.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N &lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6356&quot;&gt;CVE-2024-6356&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;advanced-search-redos-in-highlight-for-code-results&quot;&gt;Advanced search ReDOS in highlight for code results&lt;&#x2F;h3&gt;

&lt;p&gt;A Denial of Service (DoS) condition has been discovered in GitLab CE&#x2F;EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;terrichu&quot;&gt;Terri Chu&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-via-banzai-pipeline&quot;&gt;Denial of Service via banzai pipeline&lt;&#x2F;h3&gt;

&lt;p&gt;Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which allowed an attacker to cause resource exhaustion via banzai pipeline.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-5423&quot;&gt;CVE-2024-5423&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-using-adoc-files&quot;&gt;Denial of service using adoc files&lt;&#x2F;h3&gt;

&lt;p&gt;A Denial of Service (DoS) condition has been discovered in GitLab CE&#x2F;EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause a denial of service using crafted adoc files.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4210&quot;&gt;CVE-2024-4210&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;gudanggaramfilter&quot;&gt;gudanggaramfilter&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-in-refmatcher-when-matching-branch-names-using-wildcards&quot;&gt;ReDoS in RefMatcher when matching branch names using wildcards&lt;&#x2F;h3&gt;

&lt;p&gt;ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE&#x2F;CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex backtracking.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2800&quot;&gt;CVE-2024-2800&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;path-encoding-can-cause-the-web-interface-to-not-render-diffs-correctly&quot;&gt;Path encoding can cause the Web interface to not render diffs correctly.&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which causes the web interface to fail to render the diff correctly when the path is encoded.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6329&quot;&gt;CVE-2024-6329&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;xss-while-viewing-raw-xhtml-files-through-api&quot;&gt;XSS while viewing raw XHTML files through API&lt;&#x2F;h3&gt;

&lt;p&gt;A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 prior 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N &lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4207&quot;&gt;CVE-2024-4207&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;ambiguous-tag-name-exploitation&quot;&gt;Ambiguous tag name exploitation&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone  to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-3958&quot;&gt;CVE-2024-3958&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;logs-disclosings-potentially-sensitive-data-in-query-params&quot;&gt;Logs disclosings potentially sensitive data in query params&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versions starting from 17.2 before 17.2.2. Under certain conditions, access tokens may have been logged when an API request was made in a specific manner.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.9).
We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;dcouture&quot;&gt;Dominic Couture&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;password-bypass-on-approvals-using-policy-projects&quot;&gt;Password bypass on approvals using policy projects&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the password re-entry requirement to approve a policy.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.2).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4784&quot;&gt;CVE-2024-4784&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vexin&quot;&gt;vexin&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-when-parsing-git-push&quot;&gt;ReDoS when parsing git push&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regular expression DoS attack on the server.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-3114&quot;&gt;CVE-2024-3114&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;webhook-deletion-audit-log-can-preserve-auth-credentials&quot;&gt;Webhook deletion audit log can preserve auth credentials&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.
This is a medium severity issue (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab-com.gitlab.io&#x2F;gl-security&#x2F;product-security&#x2F;appsec&#x2F;cvss-calculator&#x2F;explain#explain=CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&quot;&gt;&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;, 4.1).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-7586&quot;&gt;CVE-2024-7586&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by GitLab Team &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;anton&quot;&gt;Anton Smith&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1722&quot;&gt;17.2.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1932&quot;&gt;Backups: Fix parsing of existing backups in Azure storage (Backport 17.2)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7147&quot;&gt;Do not consider pool repos dangling on restore&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160253&quot;&gt;Never return nil when search for CC service&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160554&quot;&gt;Fix issue in RTE related to adding text before a mention&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160666&quot;&gt;Backport &#x27;Check if params data cannot be JSONified&#x27; into 17.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160434&quot;&gt;Document Rake task to show&#x2F;edit token expirations&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160678&quot;&gt;Backport 17.2 - Introduce lock-free rescheduling for duplicate job&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160767&quot;&gt;Ignore unknown sequences in sequence fix migration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160744&quot;&gt;Fix squished badges rendering in 17.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161081&quot;&gt;Optimize CustomAbility specs to reduce build times&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161200&quot;&gt;Backport Do not index associated issues that are epic work item type&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160911&quot;&gt;bug: Fix template error due to divided by zero&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161241&quot;&gt;Put groups_direct field in CI JWT tokens behind feature flag&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161430&quot;&gt;Backport &#x27;Fix cluster check metrics&#x27; into 17.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161539&quot;&gt;Backport Beyond Identity bug fixes to 17.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161543&quot;&gt;Enable &lt;code&gt;project_daily_statistic_counter_attribute_fetch&lt;&#x2F;code&gt; FF by default&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161488&quot;&gt;Backport 17.2: Release Environments - pipeline level resource group&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161386&quot;&gt;Add require_personal_access_token_expiry application setting&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-pages&#x2F;-&#x2F;merge_requests&#x2F;1030&quot;&gt;Backport 17.2: Mark Cookie SameSite as default over HTTP&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7814&quot;&gt;Pin QA CI tests to stable gitlab-org&#x2F;gitlab branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1714&quot;&gt;17.1.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1933&quot;&gt;Backups: Fix parsing of existing backups in Azure storage (Backport 17.1)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160679&quot;&gt;Backport 17.1 - Introduce lock-free rescheduling for duplicate job&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160941&quot;&gt;Table driven spec needs shorter spec titles backport&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161079&quot;&gt;Optimize CustomAbility specs to reduce build times&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161242&quot;&gt;Put groups_direct field in CI JWT tokens behind feature flag&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161408&quot;&gt;Increase SQL query threashold on work_items test&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160667&quot;&gt;Backport &#x27;Check if params data cannot be JSONified&#x27; into 17.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161541&quot;&gt;Backport Beyond Identity bug fixes to 17.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161668&quot;&gt;Backport gitlab-qa shm fix to 17.1 stable branch&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161388&quot;&gt;Add require_personal_access_token_expiry application setting&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1706&quot;&gt;17.0.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1934&quot;&gt;Backups: Fix parsing of existing backups in Azure storage (Backport 17.0)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160815&quot;&gt;Backport 17.0 - Introduce lock-free rescheduling for duplicate job&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160940&quot;&gt;Table driven spec needs shorter spec titles backport&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161240&quot;&gt;Put groups_direct field in CI JWT tokens behind feature flag&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161389&quot;&gt;Add require_personal_access_token_expiry application setting&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16118&quot;&gt;16.11.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;161391&quot;&gt;Add require_personal_access_token_expiry application setting&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;add-require_personal_access_token_expiry-application-setting&quot;&gt;Add require_personal_access_token_expiry application setting&lt;&#x2F;h3&gt;

&lt;p&gt;This default enabled, optional setting added for admins of GitLab self-managed instances on versions 16.11 and above allow them to enable mandatory expiraton on all new personal, project and group access tokens. Expirations set for existing tokens are not affected by this setting. For usage information see &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;settings&#x2F;account_and_limit_settings.html#require-expiration-dates-for-new-access-tokens&quot;&gt;Require expiration dates for new access tokens&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.2.1, 17.1.3, 17.0.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/07/24/patch-release-gitlab-17-2-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/07/24/patch-release-gitlab-17-2-1-released/</id>
<published>2024-07-24T00:00:00+00:00</published>
<updated>2024-07-24T00:00:00+00:00</updated>
<author>
<name>Greg Alfaro</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.2.1, 17.1.3, 17.0.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#xss-via-the-maven-dependency-proxy&quot;&gt;XSS via the Maven Dependency Proxy&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-level-analytics-settings-leaked-in-dom&quot;&gt;Project level analytics settings leaked in DOM&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#reports-can-access-and-download-job-artifacts-despite-use-of-settings-to-prevent-it&quot;&gt;Reports can access and download job artifacts despite use of settings to prevent it&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#direct-transfer---authorised-projectgroup-exports-are-accessible-to-other-users&quot;&gt;Direct Transfer - Authorised project&#x2F;group exports are accessible to other users&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypassing-tag-check-and-branch-check-through-imports&quot;&gt;Bypassing tag check and branch check through imports&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-importexport---make-projectgroup-export-files-hidden-to-everyone-except-user-who-initiated-it&quot;&gt;Project Import&#x2F;Export - Make project&#x2F;group export files hidden to everyone except user who initiated it&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;xss-via-the-maven-dependency-proxy&quot;&gt;XSS via the Maven Dependency Proxy&lt;&#x2F;h3&gt;

&lt;p&gt;A cross site scripting vulnerability exists in GitLab CE&#x2F;EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.7)&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;joernchen&quot;&gt;Joern Schneeweisz&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;project-level-analytics-settings-leaked-in-dom&quot;&gt;Project level analytics settings leaked in DOM&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N &lt;&#x2F;code&gt;, 4.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-5067&quot;&gt;CVE-2024-5067&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;zebraman&quot;&gt;zebraman&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;reports-can-access-and-download-job-artifacts-despite-use-of-settings-to-prevent-it&quot;&gt;Reports can access and download job artifacts despite use of settings to prevent it&lt;&#x2F;h3&gt;

&lt;p&gt;An information disclosure vulnerability in GitLab CE&#x2F;EE affecting all versions starting from 16.7 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where job artifacts can be inappropriately exposed to users lacking the proper authorization level.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-7057&quot;&gt;CVE-2024-7057&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ricardobrito&quot;&gt;ricardobrito&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;direct-transfer---authorised-projectgroup-exports-are-accessible-to-other-users&quot;&gt;Direct Transfer - Authorised project&#x2F;group exports are accessible to other users&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where it was possible to disclose limited information of an exported group or project to another user.&lt;&#x2F;p&gt;

&lt;p&gt;This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.1 ).&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was found internally by a GitLab team member &lt;a href=&quot;hhttps:&#x2F;&#x2F;gitlab.com&#x2F;jnutt&quot;&gt;James Nutt&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;bypassing-tag-check-and-branch-check-through-imports&quot;&gt;Bypassing tag check and branch check through imports&lt;&#x2F;h3&gt;

&lt;p&gt;A resource misdirection vulnerability in GitLab CE&#x2F;EE affecting all versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft a repository import in such a way as to misdirect commits.
This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-0231&quot;&gt;CVE-2024-0231&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;aaron_dewes&quot;&gt;aaron_dewes&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;project-importexport---make-projectgroup-export-files-hidden-to-everyone-except-user-who-initiated-it&quot;&gt;Project Import&#x2F;Export - Make project&#x2F;group export files hidden to everyone except user who initiated it&lt;&#x2F;h3&gt;

&lt;p&gt;An information disclosure vulnerability in GitLab CE&#x2F;EE in project&#x2F;group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export.
This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 2.6).&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;wortschi&quot;&gt;Martin Wortschack&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1721&quot;&gt;17.2.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7103&quot;&gt;Revert &quot;Ensure page token is for the same tree&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159815&quot;&gt;Fix order-dependent Elasticsearch spec failure&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159794&quot;&gt;Backport to run Release Environments on RC tag into &#x27;17-2-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159993&quot;&gt;Fix state leak in cluster_util_spec.rb&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160006&quot;&gt;Ensure rspec helpers call curl with –fail&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160047&quot;&gt;Run e2e:package-and-test-ee for MR targeting stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160129&quot;&gt;Remove build-gdk-image, e2e:test-on-gdk, and retag-gdk-image jobs (17.2)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160007&quot;&gt;17.2 backport for fix PEP when SEC is available&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160276&quot;&gt;bugfix: Only run advanced SAST job when Ultimate license present&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160377&quot;&gt;Backport pipeline fixes for 17.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;469443&quot;&gt;Private dotenv artifacts not accessible to downstream jobs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1713&quot;&gt;17.1.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1921&quot;&gt;Backport mock tag cleanup related fixes&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1904&quot;&gt;Multiarch fixes backport (17.1)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158737&quot;&gt;Backport release-environments pipeline in security repo to 17.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158841&quot;&gt;Backport [17.1] Fix empty minimum_should_match in query&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159016&quot;&gt;Fix wildcard search for package.json in npm upload&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159075&quot;&gt;NPM registry: replace the saj parser (17.1 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159701&quot;&gt;Fix Content-Disposition header for Azure in API download (17.1 Backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159817&quot;&gt;Fix order-dependent Elasticsearch spec failure&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159795&quot;&gt;Backport to run Release Environments on RC tag into &#x27;17-1-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159995&quot;&gt;Fix state leak in cluster_util_spec.rb&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160094&quot;&gt;Merge branch &#x27;sh-curl-fail-ci&#x27; into &#x27;master&#x27; - 17.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159003&quot;&gt;Ignore object pool already exists creation errors 17.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158509&quot;&gt;Backport token logging improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159049&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160128&quot;&gt;Remove build-gdk-image, e2e:test-on-gdk, and retag-gdk-image jobs (17.1)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160392&quot;&gt;Backport pipeline fixes for 17.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;469443&quot;&gt;Private dotenv artifacts not accessible to downstream jobs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1705&quot;&gt;17.0.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1920&quot;&gt;Backport mock tag cleanup related fixes&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1903&quot;&gt;Multiarch fixes backport (17.0)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159796&quot;&gt;Backport to run Release Environments on RC tag into &#x27;17-0-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159286&quot;&gt;Backport Resolve &quot;Geo: JWT token expiration too short&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159019&quot;&gt;Ignore object pool already exists creation errors 17.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158907&quot;&gt;Fix 500 error using a instance runner registration token&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158511&quot;&gt;Backport token logging improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158266&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159417&quot;&gt;Update the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159054&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160326&quot;&gt;Fix order-dependent custom role definition spec failure&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;160393&quot;&gt;Backport pipeline fixes for 17.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;469443&quot;&gt;Private dotenv artifacts not accessible to downstream jobs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16117&quot;&gt;16.11.7&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159287&quot;&gt;Backport Resolve &quot;Geo: JWT token expiration too short&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159019&quot;&gt;Ignore object pool already exists creation errors 17.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157277&quot;&gt;Backport token logging improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158416&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159418&quot;&gt;Update the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159056&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16109&quot;&gt;16.10.9&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158516&quot;&gt;Backport token logging improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158414&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159419&quot;&gt;Update the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159057&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16910&quot;&gt;16.9.10&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158517&quot;&gt;Backport token logging improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153470&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159421&quot;&gt;Update the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159058&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1689&quot;&gt;16.8.9&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158518&quot;&gt;Backport token logging improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153469&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159424&quot;&gt;Update the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159066&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1679&quot;&gt;16.7.9&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158519&quot;&gt;Backport token logging improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153468&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159426&quot;&gt;Update the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159069&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1669&quot;&gt;16.6.9&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158525&quot;&gt;Backport token logging improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153466&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159429&quot;&gt;Update the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159089&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1659&quot;&gt;16.5.9&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158526&quot;&gt;Backport token logging improvements&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153459&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158110&quot;&gt;Add the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159093&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1646&quot;&gt;16.4.6&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153458&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158474&quot;&gt;Add the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159125&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1638&quot;&gt;16.3.8&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153457&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158475&quot;&gt;Add the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159383&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16210&quot;&gt;16.2.10&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153453&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158479&quot;&gt;Add the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159401&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1617&quot;&gt;16.1.7&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153448&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158476&quot;&gt;Add the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159414&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1609&quot;&gt;16.0.9&lt;&#x2F;h3&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153435&quot;&gt;Drop migration that finalizes migration to add PAT expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158477&quot;&gt;Add the token expiration banner&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;159446&quot;&gt;Backport add Rake task to show token expiration info&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Patch Release: 17.1.2, 17.0.4, 16.11.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/07/10/patch-release-gitlab-17-1-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/07/10/patch-release-gitlab-17-1-2-released/</id>
<published>2024-07-10T00:00:00+00:00</published>
<updated>2024-07-10T00:00:00+00:00</updated>
<author>
<name>Rohit Shambhuni</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.1.2, 17.0.4, 16.11.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com and GitLab Dedicated are already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#an-attacker-can-run-pipeline-jobs-as-an-arbitrary-user&quot;&gt;An attacker can run pipeline jobs as an arbitrary user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#developer-user-with-admin_compliance_framework-permission-can-change-group-url&quot;&gt;Developer user with &lt;code&gt;admin_compliance_framework&lt;&#x2F;code&gt; permission can change group URL&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#admin-push-rules-custom-role-allows-creation-of-project-level-deploy-token&quot;&gt;Admin push rules custom role allows creation of project level deploy token&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#package-registry-vulnerable-to-manifest-confusion&quot;&gt;Package registry vulnerable to manifest confusion&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#user-with-admin_group_member-permission-can-ban-group-members&quot;&gt;User with &lt;code&gt;admin_group_member&lt;&#x2F;code&gt; permission can ban group members&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#subdomain-takeover-in-gitlab-pages&quot;&gt;Subdomain takeover in GitLab pages&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;an-attacker-can-run-pipeline-jobs-as-an-arbitrary-user&quot;&gt;An attacker can run pipeline jobs as an arbitrary user&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting versions 15.8 prior to 16.11.6, 17.0 prior to 17.0.4, and 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances.
This is a critical severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 9.6).
It is now resolved in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6385&quot;&gt;CVE-2024-6385&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;developer-user-with-admin_compliance_framework-permission-can-change-group-url&quot;&gt;Developer user with &lt;code&gt;admin_compliance_framework&lt;&#x2F;code&gt; permission can change group URL&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with &lt;code&gt;admin_compliance_framework&lt;&#x2F;code&gt; custom role may have been able to modify the URL for a group namespace.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 4.9).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-5257&quot;&gt;CVE-2024-5257&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;admin-push-rules-custom-role-allows-creation-of-project-level-deploy-token&quot;&gt;Admin push rules custom role allows creation of project level deploy token&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with &lt;code&gt;admin_push_rules&lt;&#x2F;code&gt; permission may have been able to create project-level deploy tokens.
This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.8).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-5470&quot;&gt;CVE-2024-5470&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;indoappsec&quot;&gt;indoappsec&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;package-registry-vulnerable-to-manifest-confusion&quot;&gt;Package registry vulnerable to manifest confusion&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.
This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.0).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6595&quot;&gt;CVE-2024-6595&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was found internally by a GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;ameyadarshan&quot;&gt;Ameya Darshan&lt;&#x2F;a&gt;. Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;x.com&#x2F;darcy&quot;&gt;Darcy Clarke&lt;&#x2F;a&gt; for their work on &lt;a href=&quot;https:&#x2F;&#x2F;blog.vlt.sh&#x2F;blog&#x2F;the-massive-hole-in-the-npm-ecosystem&quot;&gt;manifest confusion&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;user-with-admin_group_member-permission-can-ban-group-members&quot;&gt;User with &lt;code&gt;admin_group_member&lt;&#x2F;code&gt; permission can ban group members&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with &lt;code&gt;admin_group_member&lt;&#x2F;code&gt; custom role permission could ban group members.
This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2880&quot;&gt;CVE-2024-2880&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;subdomain-takeover-in-gitlab-pages&quot;&gt;Subdomain takeover in GitLab Pages&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows a subdomain takeover in GitLab Pages by checking if the domain is enabled every time the custom domain is resolved.
This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-5528&quot;&gt;CVE-2024-5528&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fdeleite&quot;&gt;fdeleite&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1712&quot;&gt;17.1.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;7058&quot;&gt;git: Update &lt;code&gt;symlinkPointsToGitDir&lt;&#x2F;code&gt; version check&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157347&quot;&gt;Fix MailRoom not loading in Omnibus&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157428&quot;&gt;Use static AWS credentials for elasticsearch indexer if set&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157655&quot;&gt;ci: For 17-1 Use default Ruby version for MRs targeting stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157430&quot;&gt;Remove transaction opening for non-basic search count&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157757&quot;&gt;Merge branch &#x27;echui-gitlab-master-patch-58822&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157312&quot;&gt;Update FF version info for graphql_minimal_auth_methods&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157608&quot;&gt;Merge branch &#x27;correct_finalize_epics_backfilling&#x27; into &#x27;17-1-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158201&quot;&gt;Fix merge unverified changes modal showing incorrectly&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158332&quot;&gt;Backport 17.1: Field needs to be called Url&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158452&quot;&gt;Backport Release Environments notification pipeline change to 17.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157381&quot;&gt;Update dependency slack-messenger to v2.3.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7734&quot;&gt;Force ffi gem to use Ruby platform gem&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7744&quot;&gt;Fix Redis password handling with reserved characters&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7765&quot;&gt;Pin QA CI tests to stable gitlab-org&#x2F;gitlab branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1704&quot;&gt;17.0.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158455&quot;&gt;Backport Release Environments notification pipeline change to 16.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158453&quot;&gt;Backport Release Environments notification pipeline change to 17.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157383&quot;&gt;Update dependency slack-messenger to v2.3.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7764&quot;&gt;Pin QA CI tests to stable gitlab-org&#x2F;gitlab branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7745&quot;&gt;Fix Redis password handling with reserved characters&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16116&quot;&gt;16.11.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157242&quot;&gt;Update versioning info for graphql FF&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157451&quot;&gt;Define the Ruby patch version to use in CI jobs in 16.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158326&quot;&gt;For 16.11: Explicitly set Omnibus and CNG Ruby version in CI&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;158459&quot;&gt;Backport Release Environments notification pipeline change to 16.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157385&quot;&gt;Update dependency slack-messenger to v2.3.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7763&quot;&gt;Pin QA CI tests to stable gitlab-org&#x2F;gitlab branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update GitLab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Patch Release: 17.1.1, 17.0.3, 16.11.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/06/26/patch-release-gitlab-17-1-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/06/26/patch-release-gitlab-17-1-1-released/</id>
<published>2024-06-26T00:00:00+00:00</published>
<updated>2024-06-26T00:00:00+00:00</updated>
<author>
<name>Nikhil George</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.1.1, 17.0.3, 16.11.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#run-pipelines-as-any-user&quot;&gt;Run pipelines as any user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-injected-in-imported-projects-commit-notes&quot;&gt;Stored XSS injected in imported project&#x27;s commit notes&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#csrf-on-graphql-api-introspectionquery&quot;&gt;CSRF on GraphQL API &lt;code&gt;IntrospectionQuery&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#remove-search-results-from-public-projects-with-unauthorized-repos&quot;&gt;Remove search results from public projects with unauthorized repos&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cross-window-forgery-in-user-application-oauth-flow&quot;&gt;Cross window forgery in user application OAuth flow&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-maintainers-can-bypass-groups-merge-request-approval-policy&quot;&gt;Project maintainers can bypass group&#x27;s merge request approval policy&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-via-custom-built-markdown-page&quot;&gt;ReDoS via custom built markdown page&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#private-job-artifacts-can-be-accessed-by-any-user&quot;&gt;Private job artifacts can be accessed by any user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#security-fixes-for-banzai-pipeline&quot;&gt;Security fixes for banzai pipeline&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-in-dependency-linker&quot;&gt;ReDoS in dependency linker&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-using-a-crafted-openapi-file&quot;&gt;Denial of service using a crafted OpenAPI file&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#merge-request-title-disclosure&quot;&gt;Merge request title disclosure&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#access-issues-and-epics-without-having-an-sso-session&quot;&gt;Access issues and epics without having an SSO session&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#non-project-member-can-promote-key-results-to-objectives&quot;&gt;Non project member can promote key results to objectives&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;run-pipelines-as-any-user&quot;&gt;Run pipelines as any user&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which could allow an attacker to trigger a pipeline as another user under certain circumstances. This is a critical severity issue (CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N, 9.6). It is now resolved in the latest release and is assigned CVE-2024-5655.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ahacker1&quot;&gt;ahacker1&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;p&gt;Breaking changes:&lt;&#x2F;p&gt;
&lt;ol&gt;
  &lt;li&gt;This fix changes the MR re-targeting workflow so that a pipeline will not automatically run when a merge request is automatically re-targeted due to its previous target branch being merged. Users will need  to manually start a pipeline to have CI execute for their changes.&lt;&#x2F;li&gt;
  &lt;li&gt;GraphQL authentication using CI_JOB_TOKEN is disabled by default from 17.0.0, and back ported to 17.0.3, 16.11.5 in the current patch release. If access to the GraphQL API is required, please configure one of the several supported token types for authentication.&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;p&gt;At this time, we have not found evidence of abuse of this vulnerability on the platforms managed by GitLab, including GitLab.com and GitLab Dedicated instances.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;stored-xss-injected-in-imported-projects-commit-notes&quot;&gt;Stored XSS injected in imported project&#x27;s commit notes&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4901&quot;&gt;CVE-2024-4901&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;csrf-on-graphql-api-introspectionquery&quot;&gt;CSRF on GraphQL API &lt;code&gt;IntrospectionQuery&lt;&#x2F;code&gt;&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab&#x27;s GraphQL API leading to the execution of arbitrary GraphQL mutations. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4994&quot;&gt;CVE-2024-4994&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ahacker1&quot;&gt;ahacker1&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remove-search-results-from-public-projects-with-unauthorized-repos&quot;&gt;Remove search results from public projects with unauthorized repos&lt;&#x2F;h3&gt;

&lt;p&gt;Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-6323&quot;&gt;CVE-2024-6323&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to GitLab Team Member, &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;joernchen&quot;&gt;@joernchen&lt;&#x2F;a&gt; for reporting this issue.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cross-window-forgery-in-user-application-oauth-flow&quot;&gt;Cross window forgery in user application OAuth flow&lt;&#x2F;h3&gt;

&lt;p&gt;A Cross Window Forgery vulnerability exists within GitLab CE&#x2F;EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2177&quot;&gt;CVE-2024-2177&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;project-maintainers-can-bypass-groups-merge-request-approval-policy&quot;&gt;Project maintainers can bypass group&#x27;s merge request approval policy&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via graphQL. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.8).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-5430&quot;&gt;CVE-2024-5430&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-via-custom-built-markdown-page&quot;&gt;ReDoS via custom built markdown page&lt;&#x2F;h3&gt;

&lt;p&gt;A Denial of Service (DoS) condition has been discovered in GitLab CE&#x2F;EE affecting all versions from 7.10 prior before 16.11.5, version 17.0 before 17.0.3, and 17.1 before 17.1.1. It is possible for an attacker to cause a denial of service using a crafted markdown page. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4025&quot;&gt;CVE-2024-4025&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;private-job-artifacts-can-be-accessed-by-any-user&quot;&gt;Private job artifacts can be accessed by any user&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-3959&quot;&gt;CVE-2024-3959&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;security-fixes-for-banzai-pipeline&quot;&gt;Security fixes for banzai pipeline&lt;&#x2F;h3&gt;

&lt;p&gt;Multiple Denial of Service (DoS) issues has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 1.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1 which allowed an attacker to cause resource exhaustion via banzai pipeline. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4557&quot;&gt;CVE-2024-4557&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&quot;&gt;joaxcar&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;setiawan_&quot;&gt;setiawan_&lt;&#x2F;a&gt; for reporting these vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-in-dependency-linker&quot;&gt;ReDoS in dependency linker&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular  expression DoS attack on the server. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1493&quot;&gt;CVE-2024-1493&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-using-a-crafted-openapi-file&quot;&gt;Denial of service using a crafted OpenAPI file&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows for an attacker to cause a denial of service using a crafted OpenAPI file. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1816&quot;&gt;CVE-2024-1816&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;merge-request-title-disclosure&quot;&gt;Merge request title disclosure&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2191&quot;&gt;CVE-2024-2191&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;access-issues-and-epics-without-having-an-sso-session&quot;&gt;Access issues and epics without having an SSO session&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-3115&quot;&gt;CVE-2024-3115&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;non-project-member-can-promote-key-results-to-objectives&quot;&gt;Non project member can promote key results to objectives&lt;&#x2F;h3&gt;

&lt;p&gt;An issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows non-project member to promote key results to objectives. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4011&quot;&gt;CVE-2024-4011&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1711&quot;&gt;17.1.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;156799&quot;&gt;Prevent cng e2e test from running in security fork&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157027&quot;&gt;Only enumerate commits in pre-receive check if push came from Web&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;156968&quot;&gt;Revert &quot;Allow &lt;code&gt;admin_runner&lt;&#x2F;code&gt; ability to change shared runners setting&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1703&quot;&gt;17.0.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;155704&quot;&gt;Fix missing filename when downloading generic package in release page&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;156392&quot;&gt;Update an expired test certificate&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;156424&quot;&gt;Prevent starting multiple Capybara proxy servers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;156482&quot;&gt;Backport 3 commits for Merge Train pipelines support in 17-0-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;156635&quot;&gt;Fix error when calling GQL ciConfig endpoint with include:component&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;155926&quot;&gt;Only allow documented token types for GraphQL authentication&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;155242&quot;&gt;Add a banner informing about token expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;157026&quot;&gt;Only enumerate commits in pre-receive check if push came from Web&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7705&quot;&gt;Backport QA test fixes for stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7724&quot;&gt;Merge branch &#x27;sh-patch-inspec-gem&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16115&quot;&gt;16.11.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;156425&quot;&gt;Prevent starting multiple Capybara proxy servers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;156393&quot;&gt;Update an expired test certificate&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;156746&quot;&gt;Enable invert_emails_disabled_to_emails_enabled by default&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;155925&quot;&gt;Only allow documented token types for GraphQL authentication&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;155265&quot;&gt;Add a banner informing about token expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7704&quot;&gt;Backport QA test fixes for stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16108&quot;&gt;16.10.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;155266&quot;&gt;Add a banner informing about token expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1699&quot;&gt;16.9.9&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;155267&quot;&gt;Add a banner informing about token expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1688&quot;&gt;16.8.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;155268&quot;&gt;Add a banner informing about token expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1678&quot;&gt;16.7.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;155269&quot;&gt;Add a banner informing about token expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1668&quot;&gt;16.6.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;155270&quot;&gt;Add a banner informing about token expiration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.0.2, 16.11.4, 16.10.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/</id>
<published>2024-06-12T00:00:00+00:00</published>
<updated>2024-06-12T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.0.2, 16.11.4, 16.10.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-in-gomod-dependency-linker&quot;&gt;ReDoS in gomod dependency linker&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-in-ci-interpolation-fix-bypass&quot;&gt;ReDoS in CI interpolation (fix bypass)&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-in-asana-integration-issue-mapping-when-webhook-is-called&quot;&gt;ReDoS in Asana integration issue mapping when webhook is called&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#xss-and-content-injection-when-viewing-raw-xhtml-files-on-ios-devices&quot;&gt;XSS and content injection when viewing raw XHTML files on IOS devices&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#missing-agentk-request-validation-could-cause-kas-to-panic&quot;&gt;Missing agentk request validation could cause KAS to panic&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;redos-in-gomod-dependency-linker&quot;&gt;ReDoS in gomod dependency linker&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. It was possible for an attacker to cause a denial of service using maliciously crafted file.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1495&quot;&gt;CVE-2024-1495&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-in-ci-interpolation-fix-bypass&quot;&gt;ReDoS in CI interpolation (fix bypass)&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab&#x27;s CI&#x2F;CD pipeline editor could allow for denial of service attacks through maliciously crafted configuration files.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1736&quot;&gt;CVE-2024-1736&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-in-asana-integration-issue-mapping-when-webhook-is-called&quot;&gt;ReDoS in Asana integration issue mapping when webhook is called&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab&#x27;s Asana integration allowed an attacker to potentially cause a regular expression denial of service by sending specially crafted requests.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1963&quot;&gt;CVE-2024-1963&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;xss-and-content-injection-when-viewing-raw-xhtml-files-on-ios-devices&quot;&gt;XSS and content injection when viewing raw XHTML files on iOS devices&lt;&#x2F;h3&gt;

&lt;p&gt;A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.11.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4201&quot;&gt;CVE-2024-4201&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;missing-agentk-request-validation-could-cause-kas-to-panic&quot;&gt;Missing agentk request validation could cause KAS to panic&lt;&#x2F;h3&gt;

&lt;p&gt;DoS in KAS in GitLab CE&#x2F;EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests.
This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 3.1).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-5469&quot;&gt;CVE-2024-5469&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the Environments team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1702&quot;&gt;17.0.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6996&quot;&gt;Makefile: update Git versions (v17.0 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;154018&quot;&gt;Update VERSION files&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;154019&quot;&gt;Docs: Backport Dedicated AI updates&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;154505&quot;&gt;Fix failing specs in 17-0-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;154624&quot;&gt;Include headers in LfsDownloadObject&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;155385&quot;&gt;[17.0] Deprecate support for Ubuntu 18.04&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16114&quot;&gt;16.11.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6997&quot;&gt;Makefile: update Git versions (v16.11 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153752&quot;&gt;Backport &#x27;run-release-environment-for-tag-commits&#x27; into 16.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;154041&quot;&gt;Dedicated AI updates&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153833&quot;&gt;Speed up as-if-foss Rubocop&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;154370&quot;&gt;Inclusion of headers in LfsDownloadObject for GitHub imports&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;154504&quot;&gt;Fix failing specs on 16-11-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;154838&quot;&gt;Stop orphaning pages deployments on Geo secondaries on 16.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16107&quot;&gt;16.10.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6998&quot;&gt;Makefile: update Git versions (v16.10 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153753&quot;&gt;Backport &#x27;run-release-environment-for-tag-commits&#x27; into 16.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;154503&quot;&gt;Fix failing specs on 16-10-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;154837&quot;&gt;Stop orphaning pages deployments on Geo secondaries on 16.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 17.0.1, 16.11.3, 16.10.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/05/22/patch-release-gitlab-17-0-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/05/22/patch-release-gitlab-17-0-1-released/</id>
<published>2024-05-22T00:00:00+00:00</published>
<updated>2024-05-22T00:00:00+00:00</updated>
<author>
<name>Greg Alfaro</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 17.0.1, 16.11.3, and 16.10.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#1-click-account-takeover-via-xss-leveraging-the-vs-code-editor-web-ide&quot;&gt;1-click account takeover via XSS leveraging the VS code editor (Web IDE)&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#a-dos-vulnerability-in-the-description-field-of-the-runner&quot;&gt;A DOS vulnerability in the &#x27;description&#x27; field of the runner&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#csrf-via-k8s-cluster-integration&quot;&gt;CSRF via K8s cluster-integration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#using-set-pipeline-status-of-a-commit-api-incorrectly-create-a-new-pipeline-when-sha-and-pipeline_id-did-not-match&quot;&gt;Using Set Pipeline Status of a Commit API incorrectly create a new pipeline when SHA and pipeline_id did not match&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-on-wiki-render-apipage&quot;&gt;Redos on wiki render API&#x2F;Page&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#resource-exhaustion-and-denial-of-service-with-test_report-api-calls&quot;&gt;Resource exhaustion and denial of service with test_report API calls&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#guest-user-can-view-dependency-lists-of-private-projects-through-job-artifacts&quot;&gt;Guest user can view dependency lists of private projects through job artifacts&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;1-click-account-takeover-via-xss-leveraging-the-vs-code-editor-web-ide&quot;&gt;1-click account takeover via XSS leveraging the VS code editor (Web IDE)&lt;&#x2F;h3&gt;

&lt;p&gt;A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious page to exfiltrate sensitive user information.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.0) 
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4835&quot;&gt;CVE-2024-4835&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;matanber&quot;&gt;matanber&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;a-dos-vulnerability-in-the-description-field-of-the-runner&quot;&gt;A DOS vulnerability in the &#x27;description&#x27; field of the runner&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions up to 16.10.6, versions 16.11 up to 16.11.3, and 17.0 up to 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2874&quot;&gt;CVE-2024-2874&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ac7n0w&quot;&gt;ac7n0w&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h3 id=&quot;csrf-via-k8s-cluster-integration&quot;&gt;CSRF via K8s cluster-integration&lt;&#x2F;h3&gt;

&lt;p&gt;A CSRF vulnerability exists within GitLab CE&#x2F;EE from versions 16.3 up to 16.10.6, from 16.11 up to 16.11.3, from 17.0 up to 17.0.1. By leveraging this vulnerability, an attacker could exfiltrate anti-CSRF tokens via the Kubernetes Agent Server (KAS).
This is a medium severity issue (&lt;code&gt;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-7045&quot;&gt;CVE-2023-7045&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;imrerad&quot;&gt;imrerad&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h3 id=&quot;using-set-pipeline-status-of-a-commit-api-incorrectly-create-a-new-pipeline-when-sha-and-pipeline_id-did-not-match&quot;&gt;Using Set Pipeline Status of a Commit API incorrectly create a new pipeline when SHA and pipeline_id did not match&lt;&#x2F;h3&gt;

&lt;p&gt;An authorization vulnerability exists within GitLab from versions 16.10 up to 16.10.6, 16.11 up to 16.11.3, and 17.0 up to 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-5258&quot;&gt;CVE-2024-5258&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to GitLab Team Member, Andrew Winata for reporting this issue.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-on-wiki-render-apipage&quot;&gt;Redos on wiki render API&#x2F;Page&lt;&#x2F;h3&gt;

&lt;p&gt;A Denial of Service (DoS) condition has been discovered in GitLab CE&#x2F;EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. It is possible for an attacker to cause a denial of service using a crafted wiki page.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6502&quot;&gt;CVE-2023-6502&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;code&gt;Anonymizer&lt;&#x2F;code&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;resource-exhaustion-and-denial-of-service-with-test_report-api-calls&quot;&gt;Resource exhaustion and denial of service with test_report API calls&lt;&#x2F;h3&gt;

&lt;p&gt;A denial of service (DoS) condition was discovered in GitLab CE&#x2F;EE affecting all versions from 13.2.4 up to 16.10.6, 16.11 up to 16.11.3, and 17.0 up to 17.0.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1947&quot;&gt;CVE-2024-1947&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;luryus&quot;&gt;luryus&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;guest-user-can-view-dependency-lists-of-private-projects-through-job-artifacts&quot;&gt;Guest user can view dependency lists of private projects through job artifacts&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.11 prior to 16.10.6, starting from 16.11 prior to 16.11.3, and starting from 17.0 prior to 17.0.1. A Guest user can view dependency lists of private projects through job artifacts.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-5318&quot;&gt;CVE-2024-5318&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ricardobrito&quot;&gt;ricardobrito&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;stored-xss-via-pdfjs&quot;&gt;Stored XSS via PDFjs&lt;&#x2F;h3&gt;

&lt;p&gt;Mitigations were made to take care of vulnerability in PDF.js &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2024-4367&quot;&gt;CVE-2024-4367&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;h4x0r_dz&quot;&gt;h4x0r_dz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;mattermost-security-updates-april-25th-2024&quot;&gt;Mattermost Security Updates April 25th, 2024&lt;&#x2F;h3&gt;

&lt;p&gt;Mattermost has been updated to versions 9.7.2, which contains several patches and security fixes.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1701&quot;&gt;17.0.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6922&quot;&gt;Makefile: update Git versions (v17.0 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153144&quot;&gt;Merge branch &#x27;rymai-master-patch-5345&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153330&quot;&gt;Don&#x27;t fail so loudly if default work item type is invalid&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;152962&quot;&gt;[17.0 backport] Project transfer fix for ES indexing&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153304&quot;&gt;Ensure BLPOP&#x2F;BRPOP returns nil instead of raising ReadTimeoutError&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153574&quot;&gt;[17-0] Fix Sidekiq migration timeout&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16113&quot;&gt;16.11.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6919&quot;&gt;Makefile: update Git versions (v16.11 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;152328&quot;&gt;Revert removal of bitbucket_server_convert_mentions_to_users FF&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;152915&quot;&gt;Cherry pick print-out-release-environment-variables to 16.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;152891&quot;&gt;[16-11] Fix Sidekiq migration timeout&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153146&quot;&gt;Merge branch &#x27;rymai-master-patch-5345&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153302&quot;&gt;Ensure BLPOP&#x2F;BRPOP returns nil instead of raising ReadTimeoutError&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7602&quot;&gt;Draft: Update changelog for 16.11.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7586&quot;&gt;BACKPORT-16-11-stable: Use bundler to install Omnibus gems&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16106&quot;&gt;16.10.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6920&quot;&gt;Makefile: update Git versions (v16.10 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;152248&quot;&gt;Revert &quot;Remove bitbucket_server_convert_mentions_to_users feature flag&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;152916&quot;&gt;Cherry pick print-out-release-environment-variables to 16.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153147&quot;&gt;Merge branch &#x27;rymai-master-patch-5345&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;153301&quot;&gt;Ensure BLPOP&#x2F;BRPOP returns nil instead of raising ReadTimeoutError&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7585&quot;&gt;BACKPORT-16-10-stable: Use bundler to install Omnibus gems&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 16.11.2, 16.10.5, 16.9.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/05/08/patch-release-gitlab-16-11-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/05/08/patch-release-gitlab-16-11-2-released/</id>
<published>2024-05-08T00:00:00+00:00</published>
<updated>2024-05-08T00:00:00+00:00</updated>
<author>
<name>Rohit Shambhuni</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 16.11.2, 16.10.5, 16.9.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-in-branch-search-when-using-wildcards&quot;&gt;ReDoS in branch search when using wildcards&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-in-markdown-render-pipeline&quot;&gt;ReDoS in markdown render pipeline&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-on-discord-integrations&quot;&gt;Redos on Discord integrations&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-on-google-chat-integration&quot;&gt;Redos on Google Chat Integration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-attack--via-pin-menu&quot;&gt;Denial of Service Attack via Pin Menu&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dos-by-filtering-tags-and-branches-via-the-api&quot;&gt;DoS by filtering tags and branches via the API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#mr-approval-via-csrf-in-saml-sso&quot;&gt;MR approval via CSRF in SAML SSO&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#banned-user-from-groups-can-read-issues-updates-via-the-api&quot;&gt;Banned user from groups can read issues updates via the api&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#require-confirmation-before-linking-jwt-identity&quot;&gt;Require confirmation before linking JWT identity&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#view-confidential-issues-title-and-description-of-any-public-project-via-export&quot;&gt;View confidential issues title and description of any public project via export&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ssrf-via-github-importer&quot;&gt;SSRF via Github importer&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;redos-in-branch-search-when-using-wildcards&quot;&gt;ReDoS in branch search when using wildcards&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2878&quot;&gt;CVE-2024-2878&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-in-markdown-render-pipeline&quot;&gt;ReDoS in markdown render pipeline&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously crafted markdown content.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2651&quot;&gt;CVE-2024-2651&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-on-discord-integrations&quot;&gt;Redos on Discord integrations&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.9 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. A problem with the processing logic for Discord Integrations Chat Messages can lead to a regular expression DoS attack on the server.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6682&quot;&gt;CVE-2023-6682&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;code&gt;Anonymizer&lt;&#x2F;code&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-on-google-chat-integration&quot;&gt;Redos on Google Chat Integration&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.11 prior to 16.11.2. A problem with the processing logic for Google Chat Messages integration may lead to a regular expression DoS attack on the server.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6688&quot;&gt;CVE-2023-6688&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;code&gt;Anonymizer&lt;&#x2F;code&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;denial-of-service-attack-via-pin-menu&quot;&gt;Denial of Service Attack via Pin Menu&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted request.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2454&quot;&gt;CVE-2024-2454&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ac7n0w&quot;&gt;ac7n0w&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;dos-by-filtering-tags-and-branches-via-the-api&quot;&gt;DoS by filtering tags and branches via the API&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 where abusing the API to filter branch and tags could lead to Denial of Service.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4539&quot;&gt;CVE-2024-4539&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was reported internally by a GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;vyaklushin&quot;&gt;Vasilii Iakliushin&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;mr-approval-via-csrf-in-saml-sso&quot;&gt;MR approval via CSRF in SAML SSO&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4597&quot;&gt;CVE-2024-4597&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was reported internally by a GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;joernchen&quot;&gt;joernchen&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;banned-user-from-groups-can-read-issues-updates-via-the-api&quot;&gt;Banned user from groups can read issues updates via the api&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using the API.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1539&quot;&gt;CVE-2024-1539&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;require-confirmation-before-linking-jwt-identity&quot;&gt;Require confirmation before linking JWT identity&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAuth provider.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1211&quot;&gt;CVE-2024-1211&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sim4n6&quot;&gt;sim4n6&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;view-confidential-issues-title-and-description-of-any-public-project-via-export&quot;&gt;View confidential issues title and description of any public project via export&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose via the UI the confidential issues title and description from a public project to unauthorised instance users.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-3976&quot;&gt;CVE-2024-3976&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ahacker1&quot;&gt;ahacker1&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;ssrf-via-github-importer&quot;&gt;SSRF via Github importer&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown image value when importing a GitHub repository.
This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 2.6).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6195&quot;&gt;CVE-2023-6195&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;imrerad&quot;&gt;imrerad&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;16112&quot;&gt;16.11.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6888&quot;&gt;ci: Remove license scanning job (16.11)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;150488&quot;&gt;Backport &#x27;Zoekt: Fix exact search mode&#x27; into 16.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;150600&quot;&gt;Return or display Gitlab version if GITLAB_KAS_VERSION is a SHA&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;151040&quot;&gt;Allow self-managed instances to require licensed seats for Duo Chat&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;151533&quot;&gt;Merge branch &#x27;release-environment-notification&#x27; into &#x27;16-11-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;151526&quot;&gt;Changed the email validation for only encoded chars&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;151547&quot;&gt;Backport &#x27;hide archived filter in search when project selected&#x27; 16.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;151884&quot;&gt;Cherry-pick MR 151750 into &#x27;16-11-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7571&quot;&gt;Fix reconfigure failure if Redis node has Rails Sentinel config&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16105&quot;&gt;16.10.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6887&quot;&gt;ci: Remove license scanning job (16.10)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6890&quot;&gt;Upgrade gRPC to v1.62.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;150602&quot;&gt;Return or display Gitlab version if GITLAB_KAS_VERSION is a SHA&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;151535&quot;&gt;Merge branch &#x27;release-environment-notification&#x27; into &#x27;16-10-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;151529&quot;&gt;Changed the email validation for only encoded chars&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;151904&quot;&gt;Cherry-pick MR 151750 into &#x27;16-10-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1697&quot;&gt;16.9.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6886&quot;&gt;ci: Remove license scanning job (16.9)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;150605&quot;&gt;Return or display Gitlab version if GITLAB_KAS_VERSION is a SHA&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;151539&quot;&gt;Merge branch &#x27;release-environment-notification&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;151530&quot;&gt;Changed the email validation for only encoded chars&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;151908&quot;&gt;Cherry-pick MR 151750 into &#x27;16-9-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 16.11.1, 16.10.4, 16.9.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/04/24/patch-release-gitlab-16-11-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/04/24/patch-release-gitlab-16-11-1-released/</id>
<published>2024-04-24T00:00:00+00:00</published>
<updated>2024-04-24T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 16.11.1, 16.10.4, 16.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;accidental-breaking-changes-in-kas-configuration&quot;&gt;Accidental breaking changes in KAS configuration&lt;&#x2F;h4&gt;

&lt;p&gt;The following KAS patch releases contain breaking changes from the %17.0 revision, because they were tagged from the wrong source (master instead of stable branches):&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;v16.11.1&lt;&#x2F;li&gt;
  &lt;li&gt;v16.10.4&lt;&#x2F;li&gt;
  &lt;li&gt;v16.9.6&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;The next GitLab patch release will fix those changes. &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;458462&quot;&gt;Issue 458462&lt;&#x2F;a&gt; provides more information.&lt;&#x2F;p&gt;

&lt;p&gt;As a workaround KAS can be downgraded to the last release. Working KAS versions are:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;v16.11.0&lt;&#x2F;li&gt;
  &lt;li&gt;v16.10.1&lt;&#x2F;li&gt;
  &lt;li&gt;v16.9.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#gitlab-account-takeover-under-certain-conditions-when-using-bitbucket-as-an-oauth-provider&quot;&gt;GitLab account takeover, under certain conditions, when using Bitbucket as an OAuth provider&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#path-traversal-leads-to-dos-and-restricted-file-read&quot;&gt;Path Traversal leads to DoS and Restricted File Read&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthenticated-redos-in-filefinder-when-using-wildcard-filters-in-project-file-search&quot;&gt;Unauthenticated ReDoS in FileFinder when using wildcard filters in project file search&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#personal-access-token-scopes-not-honoured-by-graphql-subscriptions&quot;&gt;Personal Access Token scopes not honoured by GraphQL subscriptions&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#domain-based-restrictions-bypass-using-a-crafted-email-address&quot;&gt;Domain based restrictions bypass using a crafted email address&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;gitlab-account-takeover-under-certain-conditions-when-using-bitbucket-as-an-oauth-provider&quot;&gt;GitLab account takeover, under certain conditions, when using Bitbucket as an OAuth provider&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user&#x27;s Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4024&quot;&gt;CVE-2024-4024&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team members &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;SamWord&quot;&gt;Sam Word&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;rodrigo.tomonari&quot;&gt;Rodrigo Tomonari&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;On 2024-04-24, GitLab changed the way Bitbucket authentication works with GitLab. To continue using Bitbucket Authentication, please sign in to GitLab with your Bitbucket account credentials, before 2024-05-16.&lt;&#x2F;p&gt;

&lt;p&gt;If you do not sign into GitLab using your Bitbucket account until after 2024-05-16, you will need to &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;profile&#x2F;#sign-in-services&quot;&gt;re-link your Bitbucket account&lt;&#x2F;a&gt; to your GitLab account manually. For some users, signing in to GitLab using their Bitbucket account may not work after this fix is applied. If this happens to you, your Bitbucket and GitLab accounts have different email addresses. To resolve this, you must log in to your GitLab account with your GitLab username and password and &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;profile&#x2F;#sign-in-services&quot;&gt;re-link your Bitbucket account&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;path-traversal-leads-to-dos-and-restricted-file-read&quot;&gt;Path Traversal leads to DoS and Restricted File Read&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions of GitLab CE&#x2F;EE  16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 8.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2434&quot;&gt;CVE-2024-2434&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unauthenticated-redos-in-filefinder-when-using-wildcard-filters-in-project-file-search&quot;&gt;Unauthenticated ReDoS in FileFinder when using wildcard filters in project file search&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2829&quot;&gt;CVE-2024-2829&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;personal-access-token-scopes-not-honoured-by-graphql-subscriptions&quot;&gt;Personal Access Token scopes not honoured by GraphQL subscriptions&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-4006&quot;&gt;CVE-2024-4006&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was internally discovered and reported by a GitLab team member, &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;DylanGriffith&quot;&gt;Dylan Griffith&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;domain-based-restrictions-bypass-using-a-crafted-email-address&quot;&gt;Domain based restrictions bypass using a crafted email address&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1347&quot;&gt;CVE-2024-1347&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;garethheyes&quot;&gt;garethheyes&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;16111&quot;&gt;16.11.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;150027&quot;&gt;Backport fixing release environment pipeline triggering rule to 16.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7556&quot;&gt;Fix for missing branch_build_package_download_url&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7559&quot;&gt;Fix missing arguments when PostgreSQL upgrade times out&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;16104&quot;&gt;16.10.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6825&quot;&gt;go.mod: Update &lt;code&gt;golang.org&#x2F;x&#x2F;net&lt;&#x2F;code&gt; dependency&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;149253&quot;&gt;Update vulnerability_reads scanner in the ingestion pipeline&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;149810&quot;&gt;Fix migration error when updating from GitLab 16.x to 16.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;150029&quot;&gt;Backport fixing release environment pipeline triggering rule to 16.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1696&quot;&gt;16.9.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;150030&quot;&gt;Backport fixing release environment pipeline triggering rule to 16.9&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 16.10.2, 16.9.4, 16.8.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/04/10/patch-release-gitlab-16-10-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/04/10/patch-release-gitlab-16-10-2-released/</id>
<published>2024-04-10T00:00:00+00:00</published>
<updated>2024-04-10T00:00:00+00:00</updated>
<author>
<name>Greg Alfaro</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 16.10.2, 16.9.4, 16.8.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;engineering&#x2F;releases&#x2F;&quot;&gt;releases handbook&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of GitLab release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For security fixes, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-fixes&quot;&gt;Security fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;table-of-security-fixes&quot;&gt;Table of security fixes&lt;&#x2F;h3&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-injected-in-diff-viewer&quot;&gt;Stored XSS injected in diff viewer&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-via-autocomplete-results&quot;&gt;Stored XSS via autocomplete results&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-on-integrations-chat-messages&quot;&gt;Redos on Integrations Chat Messages&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-during-parse-junit-test-report&quot;&gt;Redos During Parse Junit Test Report&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;stored-xss-injected-in-diff-viewer&quot;&gt;Stored XSS injected in diff viewer&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. A payload may lead to a stored XSS while using the diff viewer, allowing attackers to perform arbitrary actions on behalf of victims.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-3092&quot;&gt;CVE-2024-3092&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;stored-xss-via-autocomplete-results&quot;&gt;Stored XSS via autocomplete results&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.7 to 16.8.6 all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. Using the autocomplete for issues references feature a crafted payload may lead to a stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2279&quot;&gt;CVE-2024-2279&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-on-integrations-chat-messages&quot;&gt;Redos on Integrations Chat Messages&lt;&#x2F;h3&gt;

&lt;p&gt;A denial of service vulnerability was identified in GitLab CE&#x2F;EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6489&quot;&gt;CVE-2023-6489&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;code&gt;Anonymizer&lt;&#x2F;code&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-during-parse-junit-test-report&quot;&gt;Redos During Parse Junit Test Report&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. It was possible for an attacker to cause a  denial of service using malicious crafted content in a junit test report file.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6678&quot;&gt;CVE-2023-6678&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;code&gt;Anonymizer&lt;&#x2F;code&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bug-fixes&quot;&gt;Bug fixes&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;16102&quot;&gt;16.10.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;147975&quot;&gt;Quarantine flaky atomic processing ResetSkippedJobsService specs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;148103&quot;&gt;Fix include_optional_metrics_in_service_ping during migration to 16.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;148227&quot;&gt;Use alpine:latest instead of alpine:edge in CI images [16.10]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;147937&quot;&gt;[16.10] Backport Delete callback should use namespace_id&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;148417&quot;&gt;[16.10] Backport handle null owner when indexing projects&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;147942&quot;&gt;Backport Zoekt: Retry indexing if too many requests to 16.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;148687&quot;&gt;Backport https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;148596&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;148663&quot;&gt;Fix URL validator for mirror services when using localhost&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;148571&quot;&gt;Backport !148105 into 16.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7503&quot;&gt;Cherry-pick &#x27;fix-omnibus-gitconfig-deprecation&#x27; into &#x27;16-10-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1694&quot;&gt;16.9.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;147985&quot;&gt;Quarantine flaky atomic processing ResetSkippedJobsService specs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;148229&quot;&gt;Use alpine:latest instead of alpine:edge in CI images [16.9]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1686&quot;&gt;16.8.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;147986&quot;&gt;Quarantine flaky atomic processing ResetSkippedJobsService specs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;148231&quot;&gt;Use alpine:latest instead of alpine:edge in CI images [16.8]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-patch-notifications&quot;&gt;Receive Patch Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive patch blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;patch release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.10.1, 16.9.3, 16.8.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/03/27/security-release-gitlab-16-10-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/03/27/security-release-gitlab-16-10-1-released/</id>
<published>2024-03-27T00:00:00+00:00</published>
<updated>2024-03-27T00:00:00+00:00</updated>
<author>
<name>Kevin Morrison</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 16.10.1, 16.9.3, 16.8.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases:
a monthly, scheduled security release, released a week after the feature release (which deploys on the 3rd Thursday of each month),
and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.
In addition, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest security release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-injected-in-wiki-page-via-banzai-pipeline&quot;&gt;Stored-XSS injected in Wiki page via Banzai pipeline&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dos-using-crafted-emojis&quot;&gt;DOS using crafted emojis&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;stored-xss-injected-in-wiki-page-via-banzai-pipeline&quot;&gt;Stored-XSS injected in Wiki page via Banzai pipeline&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6371&quot;&gt;CVE-2023-6371&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;dos-using-crafted-emojis&quot;&gt;DOS using crafted emojis&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. It was possible for an attacker to cause a denial of service using malicious crafted description parameter for labels.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-2818&quot;&gt;CVE-2024-2818&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks Quintin Crist of Trend Micro for reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;bump-postgresql-to-1314-1411&quot;&gt;Bump PostgreSQL to 13.14, 14.11&lt;&#x2F;h3&gt;

&lt;p&gt;The PostgreSQL project released an update so we are updating to versions 13.14 and 14.11.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;16101&quot;&gt;16.10.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1767&quot;&gt;CI: bump CI_TOOLS_VERSIONS to 5.8.0 (Backport 16.10)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6778&quot;&gt;Backport protobuf and pgx upgrades [16.10]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;147552&quot;&gt;Fix new project group templates pagination (16-10-stable-ee)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;147704&quot;&gt;Update redis-client to v0.21.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1693&quot;&gt;16.9.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1768&quot;&gt;CI: bump CI_TOOLS_VERSIONS to 5.8.0 (Backport 16.9)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6780&quot;&gt;Backport protobuf and pgx upgrades [16.9]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146777&quot;&gt;Fix detect-tests CI job&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146820&quot;&gt;Collect the artifacts from the same namespace&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;147554&quot;&gt;Fix new project group templates pagination (16-9-stable-ee)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7471&quot;&gt;Backport: RSpec changes for .com handling nightly packages&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1685&quot;&gt;16.8.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1769&quot;&gt;CI: bump CI_TOOLS_VERSIONS to 5.8.0 (Backport 16.8)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146774&quot;&gt;Fix detect-tests CI job&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7472&quot;&gt;Backport: RSpec changes for .com handling nightly packages&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7479&quot;&gt;Backport c2a94ae8 for creating stable tag for 16-8-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;were-combining-patch-and-security-releases&quot;&gt;We’re combining patch and security releases&lt;&#x2F;h2&gt;

&lt;p&gt;This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;were-combining-patch-and-security-releases&#x2F;&quot;&gt;read the blog post here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.9.2, 16.8.4, 16.7.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released/</id>
<published>2024-03-06T00:00:00+00:00</published>
<updated>2024-03-06T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>
&lt;p&gt;Today we are releasing versions 16.9.2, 16.8.4, 16.7.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases:
a monthly, scheduled security release, released a week after the feature release (which deploys on the 3rd Thursday of each month),
and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.
In addition, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest security release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypassing-codeowners-approval-allowing-to-steal-protected-variables&quot;&gt;Bypassing CODEOWNERS approval allowing to steal protected variables&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#guest-with-manage-group-access-tokens-can-rotate-and-see-group-access-token-with-owner-permissions&quot;&gt;Guest with manage group access tokens can rotate and see group access token with owner permissions&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;bypassing-codeowners-approval-allowing-to-steal-protected-variables&quot;&gt;Bypassing CODEOWNERS approval allowing to steal protected variables&lt;&#x2F;h3&gt;

&lt;p&gt;An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-0199&quot;&gt;CVE-2024-0199&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ali_shehab&quot;&gt;ali_shehab&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;guest-with-manage-group-access-tokens-can-rotate-and-see-group-access-token-with-owner-permissions&quot;&gt;Guest with manage group access tokens can rotate and see group access token with owner permissions&lt;&#x2F;h3&gt;

&lt;p&gt;A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of &lt;code&gt;manage_group_access_tokens&lt;&#x2F;code&gt; to rotate group access tokens with owner privileges.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1299&quot;&gt;CVE-2024-1299&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;upgrade-kubectl-to-the-latest-stable-version&quot;&gt;Upgrade Kubectl to the latest stable version&lt;&#x2F;h3&gt;

&lt;p&gt;&lt;code&gt;kubectl&lt;&#x2F;code&gt; has been updated to version 1.29.2.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;mattermost-security-updates-february-14-2024&quot;&gt;Mattermost Security Updates February 14, 2024&lt;&#x2F;h3&gt;

&lt;p&gt;Mattermost has been updated to version 9.5, which contains several patches and security fixes.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1692&quot;&gt;16.9.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146113&quot;&gt;Merge branch &#x27;hm-rescue-stale-element-error-in-base&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146033&quot;&gt;Fix broken master&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146202&quot;&gt;Use fixed date for failing specs [16.9]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146031&quot;&gt;Backport &#x27;pb-fix-broken-master-elastic&#x27; into 16.9&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;145946&quot;&gt;Backport Fix Search::Zoekt.index? logic to 16.9&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146036&quot;&gt;Backport &#x27;Don&#x27;t escape search term in modal twice&#x27; into 16.9&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146315&quot;&gt;Backport &#x27;add-praefect-to-release-environment-template&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146035&quot;&gt;Backport &#x27;Shows branch name in non-blob…scopes&#x27;  into 16.9&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146181&quot;&gt;Backport: Geo - Fix container repositories checksum mismatch errors&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146074&quot;&gt;Backport 145801 (Fix CI linter error when repository is empty) to 16.9&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7444&quot;&gt;Merge branch &#x27;remove-pi-os-12-release&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;145036&quot;&gt;Backport to 16.9: Fix Geo: Personal snippets not syncing&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1684&quot;&gt;16.8.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;145037&quot;&gt;Backport to 16.8: Fix Geo: Personal snippets not syncing&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;145451&quot;&gt;Backport to 16.8: Fix pg_dump failing with multiple PG read-replicas&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146233&quot;&gt;Update tests for broken 16.8&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146316&quot;&gt;Backport &#x27;add-praefect-to-release-environment-template&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146183&quot;&gt;Backport: Geo - Fix container repositories checksum mismatch errors&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146073&quot;&gt;Backport 145801 (Fix CI linter error when repository is empty) to 16.8&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1677&quot;&gt;16.7.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;145569&quot;&gt;Backport to 16.7: Fix pg_dump failing with multiple PG read-replicas&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;146318&quot;&gt;Merge branch &#x27;add-praefect-to-release-environment-template&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update GitLab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.9.1, 16.8.3, 16.7.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/02/21/security-release-gitlab-16-9-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/02/21/security-release-gitlab-16-9-1-released/</id>
<published>2024-02-21T00:00:00+00:00</published>
<updated>2024-02-21T00:00:00+00:00</updated>
<author>
<name>Nikhil George</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 16.9.1, 16.8.3, 16.7.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases:
a monthly, scheduled security release, released a week after the feature release (which deploys on the 3rd Thursday of each month),
and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.
In addition, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest security release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-users-profile-page&quot;&gt;Stored-XSS in user&#x27;s profile page&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#user-with-admin_group_members-permission-can-invite-other-groups-to-gain-owner-access&quot;&gt;User with &quot;admin_group_members&quot; permission can invite other groups to gain owner access&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-issue-in-the-codeowners-reference-extractor&quot;&gt;ReDoS issue in the Codeowners reference extractor&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ldap-user-can-reset-password-using-secondary-email-and-login-using-direct-authentication&quot;&gt;LDAP user can reset password using secondary email and login using direct authentication&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypassing-group-ip-restriction-settings-to-access-environment-details-of-projects-through-environmentsoperations-dashboard&quot;&gt;Bypassing group ip restriction settings to access environment details of projects through Environments&#x2F;Operations Dashboard&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#users-with-the-guest-role-can-change-custom-dashboard-projects-settings-for-projects-in-the-victim-group&quot;&gt;Users with the &lt;code&gt;Guest&lt;&#x2F;code&gt; role can change &lt;code&gt;Custom dashboard projects&lt;&#x2F;code&gt; settings for projects in the victim group&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-member-with-sub-maintainer-role-can-change-title-of-shared-private-deploy-keys&quot;&gt;Group member with sub-maintainer role can change title of shared private deploy keys&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypassing-approvals-of-codeowners&quot;&gt;Bypassing approvals of CODEOWNERS&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;stored-xss-in-users-profile-page&quot;&gt;Stored-XSS in user&#x27;s profile page&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting version 16.9 only. A crafted payload added to the user profile page could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1451&quot;&gt;CVE-2024-1451&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;user-with-admin_group_members-permission-can-invite-other-groups-to-gain-owner-access&quot;&gt;User with &quot;admin_group_members&quot; permission can invite other groups to gain owner access&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admin_group_member permission, they may be able to make a group, other members or themselves Owners of that group, which may lead to privilege escalation. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:L&lt;&#x2F;code&gt;, 6.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6477&quot;&gt;CVE-2023-6477&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-issue-in-the-codeowners-reference-extractor&quot;&gt;ReDoS issue in the Codeowners reference extractor&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted content in the CODEOWNERS file.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6736&quot;&gt;CVE-2023-6736&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;ldap-user-can-reset-password-using-secondary-email-and-login-using-direct-authentication&quot;&gt;LDAP user can reset password using secondary email and login using direct authentication&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.1 before 16.7.2, all versions starting from 16.8 before 16.8.2, all versions starting from 16.9 before 16.9.2. Under some specialized conditions, an LDAP user may be able to reset their password using their verified secondary email address and sign-in using direct authentication with the reset password, bypassing LDAP. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1525&quot;&gt;CVE-2024-1525&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by a GitLab team member, &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;dblessing&quot;&gt;Drew Blessing&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;bypassing-group-ip-restriction-settings-to-access-environment-details-of-projects-through-environmentsoperations-dashboard&quot;&gt;Bypassing group ip restriction settings to access environment details of projects through Environments&#x2F;Operations Dashboard&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This vulnerability allows for bypassing the &#x27;group ip restriction&#x27; settings to access environment details of projects. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4895&quot;&gt;CVE-2023-4895&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;albatraoz&quot;&gt;albatraoz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;users-with-the-guest-role-can-change-custom-dashboard-projects-settings-for-projects-in-the-victim-group&quot;&gt;Users with the &lt;code&gt;Guest&lt;&#x2F;code&gt; role can change &lt;code&gt;Custom dashboard projects&lt;&#x2F;code&gt; settings for projects in the victim group&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the &lt;code&gt;Guest&lt;&#x2F;code&gt; role can change &lt;code&gt;Custom dashboard projects&lt;&#x2F;code&gt; settings contrary to permissions. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-0861&quot;&gt;CVE-2024-0861&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;them4les_l1r&quot;&gt;them4les_l1r&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;group-member-with-sub-maintainer-role-can-change-title-of-shared-private-deploy-keys&quot;&gt;Group member with sub-maintainer role can change title of shared private deploy keys&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated with projects in the group.
This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3509&quot;&gt;CVE-2023-3509&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;bypassing-approvals-of-codeowners&quot;&gt;Bypassing approvals of CODEOWNERS&lt;&#x2F;h3&gt;

&lt;p&gt;An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-0410&quot;&gt;CVE-2024-0410&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ali_shehab&quot;&gt;ali_shehab&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;441094&quot;&gt;Invalidate markdown cache to clear up stored XSS&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1691&quot;&gt;16.9.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;144758&quot;&gt;Merge branch &#x27;ac-fix-16-9-0-changelog&#x27; into &#x27;master&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;144759&quot;&gt;[Backport] Revert &#x27;437616_fix_changelog_tag_detection&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;144956&quot;&gt;Backport Web IDE upgrade into 16.9&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;144995&quot;&gt;Fix deny_all_requests_except_allowed of AddressableUrlValidator&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;144952&quot;&gt;Introduce back ci_pipeline_variables routing table FF&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1683&quot;&gt;16.8.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6674&quot;&gt;Backport &#x27;jc&#x2F;fix-add-tree-entry&#x27; into 16-8-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;144119&quot;&gt;Allow creation of group-level custom-roles on self-managed instances&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;144217&quot;&gt;Backport &#x27;Fix stable cache for quick actions&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;144355&quot;&gt;Fix X.509 commit signing for OpenSSL 3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;144349&quot;&gt;Fix urlblocker validate calls with more options&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1676&quot;&gt;16.7.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6675&quot;&gt;Backport jc&#x2F;fix-add-tree-entry into 16-7-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;144357&quot;&gt;Fix X.509 commit signing for OpenSSL 3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.8.2, 16.7.5, 16.6.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/02/07/security-release-gitlab-16-8-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/02/07/security-release-gitlab-16-8-2-released/</id>
<published>2024-02-07T00:00:00+00:00</published>
<updated>2024-02-07T00:00:00+00:00</updated>
<author>
<name>Ottilia Westerlund</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 16.8.2, 16.7.5, 16.6.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases:
a monthly, scheduled security release, released a week after the feature release (which deploys on the 3rd Thursday of each month),
and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.
In addition, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest security release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#restrict-group-access-token-creation-for-custom-roles&quot;&gt;Restrict group access token creation for custom roles&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-maintainers-can-bypass-groups-scan-result-policy-block_branch_modification-setting&quot;&gt;Project maintainers can bypass group&#x27;s scan result policy &lt;code&gt;block_branch_modification&lt;&#x2F;code&gt; setting&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-in-ci&#x2F;cd-pipeline-editor-while-verifying-pipeline-syntax&quot;&gt;ReDoS in CI&#x2F;CD Pipeline Editor while verifying Pipeline syntax&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#resource-exhaustion-using-graphql-vulnerabilitiescountbyday&quot;&gt;Resource exhaustion using GraphQL &lt;code&gt;vulnerabilitiesCountByDay&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;restrict-group-access-token-creation-for-custom-roles&quot;&gt;Restrict group access token creation for custom roles&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 
16.8.2. When a user is assigned a custom role with manage_group_access_tokens permission, 
they may be able to create group access tokens with Owner privileges, which may lead to privilege escalation. 
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). 
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1250&quot;&gt;CVE-2024-1250&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;rshambhuni&quot;&gt;Rohit Shambhuni&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;project-maintainers-can-bypass-groups-scan-result-policy-block_branch_modification-setting&quot;&gt;Project maintainers can bypass group&#x27;s scan result policy &lt;code&gt;block_branch_modification&lt;&#x2F;code&gt; setting&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 6.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6840&quot;&gt;CVE-2023-6840&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-in-cicd-pipeline-editor-while-verifying-pipeline-syntax&quot;&gt;ReDoS in CI&#x2F;CD Pipeline Editor while verifying Pipeline syntax.&lt;&#x2F;h3&gt;

&lt;p&gt;A denial of service vulnerability was identified in GitLab CE&#x2F;EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an attacker to spike the GitLab instance resource usage resulting in service degradation.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6386&quot;&gt;CVE-2023-6386&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;code&gt;Anonymizer&lt;&#x2F;code&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;resource-exhaustion-using-graphql-vulnerabilitiescountbyday&quot;&gt;Resource exhaustion using GraphQL &lt;code&gt;vulnerabilitiesCountByDay&lt;&#x2F;code&gt;&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL &lt;code&gt;vulnerabilitiesCountByDay&lt;&#x2F;code&gt;.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-1066&quot;&gt;CVE-2024-1066&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;bwill&quot;&gt;Brian Williams&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;update-to-postgresql-1410-and-1313&quot;&gt;Update to PostgreSQL 14.10 and 13.13&lt;&#x2F;h3&gt;

&lt;p&gt;PostgreSQL has been updated.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1682&quot;&gt;16.8.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1714&quot;&gt;Gitaly: properly set PYTHON_TAG in CI, for Dockerfile (16.8)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;142960&quot;&gt;Update GDK base build image and update QA GEM&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;142919&quot;&gt;Revert &quot;Validate scopes for importing collaborators&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;142926&quot;&gt;Backport !142896 into 16.8 stable branch&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;143172&quot;&gt;Update dependency prometheus-client-mmap to &#x27;~&amp;gt; 1.1&#x27;, &#x27;&amp;gt;= 1.1.1&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;143173&quot;&gt;Defer ConnectionPool instrumentation setup&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;143302&quot;&gt;Add item_to_preload method in helper and migrations to prevent N+1 query&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;143316&quot;&gt;Fix bug for devfile with multiple container components&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;143526&quot;&gt;Backport &quot;Fix Redis 6.0 compatibility breakage with Sidekiq 7 gem&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;142906&quot;&gt;Finalize UUID backfilling before performing cleanup&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7402&quot;&gt;Backport - Ensure post upgrade steps are run after geo_pg_upgrade&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1675&quot;&gt;16.7.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;143174&quot;&gt;Update dependency prometheus-client-mmap to &#x27;~&amp;gt; 1.1&#x27;, &#x27;&amp;gt;= 1.1.1&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;143500&quot;&gt;Backport UUID migration finalization to 16.7&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1667&quot;&gt;16.6.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1708&quot;&gt;Add missing IMAGE_TAG_EXT to referenced PostgreSQL image&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;143579&quot;&gt;Backport: Update GDK base build image&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7388&quot;&gt;[Backport] Control runner tags for package promotion via env vars&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 16.8.1, 16.7.4, 16.6.6, 16.5.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/</id>
<published>2024-01-25T00:00:00+00:00</published>
<updated>2024-01-25T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 16.8.1, 16.7.4, 16.6.6, 16.5.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com and GitLab Dedicated environments are already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases:
a monthly, scheduled security release, released a week after the feature release (which deploys on the 3rd Thursday of each month),
and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.
In addition, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest security release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-file-write-while-creating-workspace&quot;&gt;Arbitrary file write while creating workspace&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-in-cargotoml-blob-viewer&quot;&gt;ReDoS in &lt;code&gt;Cargo.toml&lt;&#x2F;code&gt; blob viewer&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-api-put-requests-via-html-injection-in-users-name&quot;&gt;Arbitrary API PUT requests via HTML injection in user&#x27;s name&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#disclosure-of-the-public-email-in-tags-rss-feed&quot;&gt;Disclosure of the public email in Tags RSS Feed&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#non-member-can-update-mr-assignees-of-owned-mrs&quot;&gt;Non-Member can update MR Assignees of owned MRs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;arbitrary-file-write-while-creating-workspace&quot;&gt;Arbitrary file write while creating workspace&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 16.0 prior to 16.5.8, 16.6 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.
This is a critical severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 9.9).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-0402&quot;&gt;CVE-2024-0402&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;The fix for this security vulnerability has been backported to 16.5.8 in addition to 16.6.6, 16.7.4, and 16.8.1. GitLab 16.5.8 &lt;em&gt;only&lt;&#x2F;em&gt; includes a fix for this vulnerability and does &lt;em&gt;not&lt;&#x2F;em&gt; contain any of the other fixes or changes mentioned in this blog post.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;joernchen&quot;&gt;joernchen&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;redos-in-cargotoml-blob-viewer&quot;&gt;ReDoS in &lt;code&gt;Cargo.toml&lt;&#x2F;code&gt; blob viewer&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a &lt;code&gt;Cargo.toml&lt;&#x2F;code&gt; containing maliciously crafted input.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6159&quot;&gt;CVE-2023-6159&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;arbitrary-api-put-requests-via-html-injection-in-users-name&quot;&gt;Arbitrary API PUT requests via HTML injection in user&#x27;s name&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.4).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5933&quot;&gt;CVE-2023-5933&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;disclosure-of-the-public-email-in-tags-rss-feed&quot;&gt;Disclosure of the public email in Tags RSS Feed&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5612&quot;&gt;CVE-2023-5612&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;erruqill&quot;&gt;erruqill&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;non-member-can-update-mr-assignees-of-owned-mrs&quot;&gt;Non-Member can update MR Assignees of owned MRs&lt;&#x2F;h3&gt;

&lt;p&gt;An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project .
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2024-0456&quot;&gt;CVE-2024-0456&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;Taucher2003&quot;&gt;Niklas&lt;&#x2F;a&gt; for reporting this vulnerability.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;update-xmlsoftlibxml2-to--v2116&quot;&gt;Update xmlsoft&#x2F;libxml2 to &amp;gt;= v2.11.6&lt;&#x2F;h3&gt;

&lt;p&gt;The &lt;code&gt;xmlsoft&#x2F;libxml2&lt;&#x2F;code&gt; version has been upgraded to 2.12.3 to mitigate &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-45322&quot;&gt;CVE-2023-45322&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;upgrade-redis-to-address-cve-2023-41056-redis-rce&quot;&gt;Upgrade redis to address CVE-2023-41056 (Redis RCE)&lt;&#x2F;h3&gt;

&lt;p&gt;Redis has been upgraded to version 7.0.15 to mitigate &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-41056&quot;&gt;CVE-2023-41056&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1681&quot;&gt;16.8.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;142344&quot;&gt;Update dependency gitlab-glfm-markdown to &#x27;~&amp;gt; 0.0.11&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;142307&quot;&gt;Backport Redis migration to 16.8&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;142398&quot;&gt;[Backport] Optimize garbage collection process&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;142628&quot;&gt;[Backport] Bump GitLab Shell version to 14.33.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1674&quot;&gt;16.7.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;141413&quot;&gt;Backport - Bring legacy verification behavior back for repositories&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7352&quot;&gt;Sync chef-gem and chef-bin (16.7)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1666&quot;&gt;16.6.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;141821&quot;&gt;Backport: Move release-environments pipeline to be sourced from master&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;141412&quot;&gt;Backport - Bring legacy verification behavior back for repositories&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/</id>
<published>2024-01-11T00:00:00+00:00</published>
<updated>2024-01-11T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 16.7.2, 16.6.4, 16.5.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases fixes for security vulnerabilities in security releases.
For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.
In addition, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest security release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;. If you have not upgraded yet, be aware that there is &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;releases&#x2F;2024&#x2F;01&#x2F;12&#x2F;gitlab-16-7-3-released&#x2F;&quot;&gt;a newer patch&lt;&#x2F;a&gt; that includes additional fixes for recently discovered DB migration issue. Please upgrade to 16.7.3, 16.6.5, 16.5.7, or newer to prevent the migration issue.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#account-takeover-via-password-reset-without-user-interactions&quot;&gt;Account Takeover via password reset without user interactions&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypass-codeowners-approval-removal&quot;&gt;Bypass CODEOWNERS approval removal&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#attacker-can-abuse-slackmattermost-integrations-to-execute-slash-commands-as-another-user&quot;&gt;Attacker can abuse Slack&#x2F;Mattermost integrations to execute slash commands as another user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#workspaces-able-to-be-created-under-different-root-namespace&quot;&gt;Workspaces able to be created under different root namespace&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#commit-signature-validation-ignores-headers-after-signature&quot;&gt;Commit signature validation ignores headers after signature&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;account-takeover-via-password-reset-without-user-interactions&quot;&gt;Account Takeover via Password Reset without user interactions&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
This is a Critical severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 10.0).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-7028&quot;&gt;CVE-2023-7028&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This security fix has been backported to GitLab versions and 16.1.6, 16.2.9, 16.3.7, and 16.4.5 in addition to 16.5.6, 16.6.4, and 16.7.2.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;asterion04&quot;&gt;asterion04&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;faq&quot;&gt;FAQ&lt;&#x2F;h3&gt;

&lt;p&gt;&lt;strong&gt;What should I do if I believe my GitLab instance is compromised?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;&lt;em&gt;In addition to following your incident response plan&lt;&#x2F;em&gt;&lt;&#x2F;p&gt;

&lt;ol&gt;
  &lt;li&gt;Apply the Critical Security Release to your GitLab instance&lt;&#x2F;li&gt;
  &lt;li&gt;Enable &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;security&#x2F;two_factor_authentication.html&quot;&gt;Two-Factor Authentication&lt;&#x2F;a&gt; (2FA) for all GitLab accounts&lt;&#x2F;li&gt;
  &lt;li&gt;Rotate all secrets stored in GitLab:
    &lt;ol&gt;
      &lt;li&gt;All credentials, including GitLab account passwords&lt;&#x2F;li&gt;
      &lt;li&gt;API tokens&lt;&#x2F;li&gt;
      &lt;li&gt;Any certificates&lt;&#x2F;li&gt;
      &lt;li&gt;Any other secrets&lt;&#x2F;li&gt;
    &lt;&#x2F;ol&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;Follow steps in our incident response guide, &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;security&#x2F;responding_to_security_incidents.html#suspected-compromised-user-account&quot;&gt;here&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;p&gt;&lt;strong&gt;Who is impacted by this?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;GitLab self-managed instances using the following affected versions:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;16.1 to 16.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;16.2 to 16.2.8&lt;&#x2F;li&gt;
  &lt;li&gt;16.3 to 16.3.6&lt;&#x2F;li&gt;
  &lt;li&gt;16.4 to 16.4.4&lt;&#x2F;li&gt;
  &lt;li&gt;16.5 to 16.5.5&lt;&#x2F;li&gt;
  &lt;li&gt;16.6 to 16.6.3&lt;&#x2F;li&gt;
  &lt;li&gt;16.7 to 16.7.1&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;Within these versions, all authentication mechanisms are impacted.
Additionally, users who have two-factor authentication enabled are vulnerable to password reset but not account takeover as their second authentication factor is required to login.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;What actions should I take?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;Upgrade self-managed instances to a &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;patched version&lt;&#x2F;a&gt; following our upgrade path. Do not skip upgrade stops as this could create instability.
    &lt;ul&gt;
      &lt;li&gt;Note: 16.3.x is a &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;#required-upgrade-stops&quot;&gt;required upgrade stop&lt;&#x2F;a&gt; in the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;update&#x2F;#upgrade-paths&quot;&gt;GitLab upgrade path&lt;&#x2F;a&gt;.&lt;&#x2F;li&gt;
    &lt;&#x2F;ul&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;Enable &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;security&#x2F;two_factor_authentication.html&quot;&gt;Two-Factor Authentication&lt;&#x2F;a&gt; (2FA) for all GitLab accounts, especially for users with elevated privileges (e.g. administrator accounts).&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;&lt;strong&gt;Has the vulnerability been resolved?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was resolved with this security release.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Were any accounts actually compromised due to this vulnerability?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;We have not detected any abuse of this vulnerability on platforms managed by GitLab, including GitLab.com and GitLab Dedicated instances. Self-managed customers can review their logs to check for possible attempts to exploit this vulnerability:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;Check &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;logs&#x2F;#production_jsonlog&quot;&gt;gitlab-rails&#x2F;production_json.log&lt;&#x2F;a&gt; for HTTP requests to the &lt;code&gt;&#x2F;users&#x2F;password&lt;&#x2F;code&gt; path with params.value.email consisting of a JSON array with &lt;em&gt;multiple&lt;&#x2F;em&gt; email addresses.&lt;&#x2F;li&gt;
  &lt;li&gt;Check &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;logs&#x2F;#audit_jsonlog&quot;&gt;gitlab-rails&#x2F;audit_json.log&lt;&#x2F;a&gt; for entries with &lt;code&gt;meta.caller_id&lt;&#x2F;code&gt; of &lt;code&gt;PasswordsController#create&lt;&#x2F;code&gt; and &lt;code&gt;target_details&lt;&#x2F;code&gt; consisting of a JSON array with &lt;em&gt;multiple&lt;&#x2F;em&gt; email addresses.&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;&lt;strong&gt;When was the vulnerability introduced?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;The vulnerability was introduced in 16.1.0 on May 1, 2023.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;How was the vulnerability discovered?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;The vulnerability was responsibly reported through our Bug Bounty program.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;What security measures do you have in place to prevent such vulnerabilities?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;We have added multiple tests that validate the password reset logic as a whole, in particular handling of email provided, the email generation, and content to prevent similar vulnerabilities.&lt;&#x2F;li&gt;
  &lt;li&gt;Security reviews are a required part of the MR checklist that developers must complete.&lt;&#x2F;li&gt;
  &lt;li&gt;We have a code review process that requires multiple approvals for changes.&lt;&#x2F;li&gt;
  &lt;li&gt;We have started the &lt;a href=&quot;https:&#x2F;&#x2F;handbook.gitlab.com&#x2F;handbook&#x2F;security&#x2F;root-cause-analysis&#x2F;&quot;&gt;Root Cause Analysis process&lt;&#x2F;a&gt; in order to determine a comprehensive list of follow-up actions, including ways to prevent vulnerabilities like this one.&lt;&#x2F;li&gt;
  &lt;li&gt;We have a &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;profile&#x2F;account&#x2F;two_factor_authentication.html&quot;&gt;two-factor authentication feature&lt;&#x2F;a&gt; that prevents such a vulnerability if enabled. It is currently enabled for all GitLab Team Members.&lt;&#x2F;li&gt;
  &lt;li&gt;We have added additional developer documentation in the code base to ensure implementation and security considerations are available to engineers working in this area in the future.&lt;&#x2F;li&gt;
  &lt;li&gt;Revised the implementation logic to not support the submission of multiple email addresses for reset links.&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;&lt;strong&gt;How did this happen?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;A change was made in 16.1.0 to allow users to reset their password through a secondary email address. The vulnerability is a result of a bug in the email verification process. The bug has been fixed with this patch, and as mentioned above, we have implemented a number of preventive security measures to protect customers.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Does this affect me if I use an Identity Provider, like Okta or Azure AD?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Users without SSO enforcement are vulnerable. If your configuration allows a username and password to be used in addition to SSO options, then you are impacted. Disabling all password authentication options via &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;settings&#x2F;sign_in_restrictions.html#password-authentication-enabled&quot;&gt;Sign-in restrictions settings&lt;&#x2F;a&gt; will mitigate the vulnerability for Self-Managed customers that have an external identity provider configured, as this will disable the ability to perform password reset.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Am I affected by this vulnerability if I have 2FA enforced?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;An attacker will not be able to takeover your account if you have 2FA enabled. They may still be able to reset your password but will not be able to access your second factor authentication method. If you are suddenly redirected to login, or see a reset email triggered, please reset your password.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Does this vulnerability affect GitLab Runner?&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;p&gt;No, this vulnerability does not affect GitLab Runner. This vulnerability affected the GitLab Rails codebase for impacted versions of GitLab itself. GitLab Runner has a separate code base that is unaffected.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;bypass-codeowners-approval-removal&quot;&gt;Bypass CODEOWNERS approval removal&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 15.3 before 16.5.5, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.6).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4812&quot;&gt;CVE-2023-4812&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ali_shehab&quot;&gt;ali_shehab&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;attacker-can-abuse-slackmattermost-integrations-to-execute-slash-commands-as-another-user&quot;&gt;Attacker can abuse Slack&#x2F;Mattermost integrations to execute slash commands as another user&lt;&#x2F;h3&gt;

&lt;p&gt;Incorrect authorization checks in GitLab CE&#x2F;EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse Slack&#x2F;Mattermost integrations to execute slash commands as another user.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5356&quot;&gt;CVE-2023-5356&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;workspaces-able-to-be-created-under-different-root-namespace&quot;&gt;Workspaces able to be created under different root namespace&lt;&#x2F;h3&gt;

&lt;p&gt;An improper access control vulnerability exists in GitLab Workspaces affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 6.6).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6955&quot;&gt;CVE-2023-6955&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;j.seto&quot;&gt;@j.seto&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;commit-signature-validation-ignores-headers-after-signature&quot;&gt;Commit signature validation ignores headers after signature&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.
This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2030&quot;&gt;CVE-2023-2030&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;lotsofloops&quot;&gt;lotsofloops&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1672&quot;&gt;16.7.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1688&quot;&gt;Backport 16.7: Clean mocked tags from assets&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;140347&quot;&gt;Backport: Solving database cross joins on HookData::ProjectBuilder&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;140621&quot;&gt;Fix order-dependent Sidekiq config spec failures&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;140772&quot;&gt;Harden Internal Events CLI specs against flakiness&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;140892&quot;&gt;Enable Apollo Boards by default&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;140934&quot;&gt;Backport &quot;Add missing ci_sources_pipelines indexes for self-host&quot; 16.7&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7338&quot;&gt;Temporarily pin Faraday related gems&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1664&quot;&gt;16.6.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1675&quot;&gt;Merge branch &#x27;ci-clean-mocked-tags&#x27; into &#x27;16-6-stable&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1689&quot;&gt;Backport 16.6 : Clean mocked tags from assets&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;139540&quot;&gt;Backport-Search::IndexRepairService using Repository index for projects&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;141018&quot;&gt;Backport !140718 into 16.6 stable branch&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7337&quot;&gt;Temporarily pin Faraday related gems&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1656&quot;&gt;16.5.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1678&quot;&gt;CI: clean mocked tags from assets, don&#x27;t pollute artifacts (backport to 16.5)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1690&quot;&gt;Backport 16.5 : Clean mocked tags from assets&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6583&quot;&gt;Backport 16.5: Fix chatty loopWriter logs when log level config is empty&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;141027&quot;&gt;Bump allure-report and backport clickhouse version fix to 16.5&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7336&quot;&gt;Temporarily pin Faraday related gems&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.6.2, 16.5.4, 16.4.4</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/</id>
<published>2023-12-13T00:00:00+00:00</published>
<updated>2023-12-13T00:00:00+00:00</updated>
<author>
<name>Dominic Couture</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 16.6.2, 16.5.4, and 16.4.4 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases:
a monthly, scheduled security release, released a week after the feature release (which deploys on the 3rd Thursday of each month),
and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.
In addition, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest security release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#smartcard-authentication-allows-impersonation-of-arbitrary-user-using-user&#x27;s-public-certificate&quot;&gt;Smartcard authentication allows impersonation of arbitrary user using user&#x27;s public certificate&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#when-subgroup-is-allowed-to-merge-or-push-to-protected-branches,-subgroup-members-with-the-developer-role-may-gain-the-ability-to-push-or-merge&quot;&gt;When subgroup is allowed to merge or push to protected branches, subgroup members with the Developer role may gain the ability to push or merge&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#the-gitlab-web-interface-does-not-ensure-the-integrity-of-information-when-downloading-the-source-code-from-installation-packages-or-tags&quot;&gt;The GitLab web interface does not ensure the integrity of information when downloading the source code from installation packages or tags.&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-maintainer-can-escalate-to-project-owner-using-project-access-token-rotate-api&quot;&gt;Project maintainer can escalate to Project owner using project access token rotate API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#omission-of-double-encoding-in-file-names-facilitates-the-creation-of-repositories-with-malicious-content&quot;&gt;Omission of Double Encoding in File Names Facilitates the Creation of Repositories with Malicious Content.&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unvalidated-timespent-value-leads-to-unable-to-load-issues-on-issue-board&quot;&gt;Unvalidated timeSpent value leads to unable to load issues on Issue board&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#developer-can-bypass-predefined-variables-via-rest-api&quot;&gt;Developer can bypass predefined variables via REST API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#auditor-users-can-create-merge-requests-on-projects-they-dont-have-access-to&quot;&gt;Auditor users can create merge requests on projects they don&#x27;t have access to&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;smartcard-authentication-allows-impersonation-of-arbitrary-user-using-users-public-certificate&quot;&gt;Smartcard authentication allows impersonation of arbitrary user using user&#x27;s public certificate&lt;&#x2F;h3&gt;

&lt;p&gt;An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication. Smartcard authentication is an experimental feature and has to be manually enabled by an administrator. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6680&quot;&gt;CVE-2023-6680&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks Lucas Serrano from PEReN (&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;LSerranoPEReN&quot;&gt;@LSerranoPEReN&lt;&#x2F;a&gt;) for reporting this vulnerability.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;when-subgroup-is-allowed-to-merge-or-push-to-protected-branches-subgroup-members-with-the-developer-role-may-gain-the-ability-to-push-or-merge&quot;&gt;When subgroup is allowed to merge or push to protected branches, subgroup members with the Developer role may gain the ability to push or merge&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and&#x2F;or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6564&quot;&gt;CVE-2023-6564&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by a GitLab team member.&lt;&#x2F;p&gt;

&lt;p&gt;The following script can help you identify projects that may be subject to a vulnerable configuration. This script can be used to create a CSV file listing projects that have a group set as &quot;Allowed to merge&quot; or &quot;Allowed to push and merge&quot; along with the web_url and project_id for the project and the group_name&#x2F;group_id for the group. Note that this is not an indication that unauthorized changes were made to protected branches, but rather an indication that these projects were subject to this vulnerable configuration. For impacted projects, customers will need to check merge requests that were merged on their self-managed GitLab instances running 16.4.3, 16.5.3, or 16.6.1 prior to updating to 16.4.4, 16.5.4, or 16.6.2 or on GitLab.com prior to 2023-12-04 18:10 UTC.&lt;&#x2F;p&gt;

&lt;details&gt;&lt;summary&gt;Click to expand the script&lt;&#x2F;summary&gt;

```sh
## install `glab` (if not already installed)
# https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;cli#installation
## install `jq` (if not already installed)
# https:&#x2F;&#x2F;jqlang.github.io&#x2F;jq&#x2F;download&#x2F;

# authenticate with `glab` as Admin (self-managed) or group owner (SaaS)
glab auth login

## get `project_id` and `web_url` for all projects at the instance level (self-managed) or group level (SaaS), save it as `project-list.csv`
# self-managed - instance level (use Admin PAT for authentication)
glab api --hostname &quot;self-managed-gitlab.example.com&quot; --paginate projects 2&amp;gt;&amp;gt; error.log | jq -c &#x27;.[]&#x27; | jq -rc &#x27;[.id, .web_url] | @csv&#x27; | tee -a project-list.csv
# SaaS - group level (use group owner PAT for authentication)
glab api --paginate &quot;groups&#x2F;$GROUP_ID&#x2F;projects&quot; 2&amp;gt;&amp;gt; error.log | jq -c &#x27;.[]&#x27; | jq -rc &#x27;[.id, .web_url] | @csv&#x27; | tee -a project-list.csv 

## add headers to protected_branch_report.csv file
echo &quot;project_id, web_url, group_name_push_access, group_id_push_access, group_name_merge_access, group_id_merge_access&quot; &amp;gt; protected_branch_report.csv

## loop through each project to check for protected branches that have a group with push or merge access
while IFS=&#x27;,&#x27; read -r PROJECT_ID WEB_URL; do
  glab api &quot;projects&#x2F;$PROJECT_ID&#x2F;protected_branches&quot; 2&amp;gt;&amp;gt; error.log \
  | jq -c &#x27;.[]&#x27; \
  | jq &#x27;select((any(.push_access_levels[]; .group_id != null and .access_level == 40)) or (any(.merge_access_levels[]; .group_id != null and .access_level == 40)))&#x27; 2&amp;gt;&amp;gt; error.log \
  | jq -c &quot;{project_id: $PROJECT_ID, web_url: $WEB_URL, group_id_push_access: .push_access_levels.[].group_id, group_name_push_access: .push_access_levels.[].access_level_description, group_id_merge_access: .merge_access_levels.[].group_id, group_name_merge_access: .merge_access_levels.[].access_level_description}&quot; 2&amp;gt;&amp;gt; error.log \
  | jq &#x27;select((.group_id_push_access != null or .group_id_merge_access != null) and (.group_name_push_access != &quot;Maintainers&quot; or .group_name_merge_access != &quot;Maintainers&quot;))&#x27; 2&amp;gt;&amp;gt; error.log \
  | jq -rc &#x27;[.project_id, .web_url, .group_name_push_access, .group_id_push_access, .group_name_merge_access, .group_id_merge_access] | @csv&#x27; \
  | tee -a protected_branch_report.csv  
done &amp;lt; project-list.csv
```

GitLab has conducted limited testing to validate this script. As such this script is provided AS-IS and GitLab makes no warranties of any kind. GITLAB HEREBY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

&lt;&#x2F;details&gt;

&lt;h3 id=&quot;the-gitlab-web-interface-does-not-ensure-the-integrity-of-information-when-downloading-the-source-code-from-installation-packages-or-tags&quot;&gt;The GitLab web interface does not ensure the integrity of information when downloading the source code from installation packages or tags.&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6051&quot;&gt;CVE-2023-6051&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;project-maintainer-can-escalate-to-project-owner-using-project-access-token-rotate-api&quot;&gt;Project maintainer can escalate to Project owner using project access token rotate API&lt;&#x2F;h3&gt;

&lt;p&gt;A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 4.9).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3907&quot;&gt;CVE-2023-3907&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;omission-of-double-encoding-in-file-names-facilitates-the-creation-of-repositories-with-malicious-content&quot;&gt;Omission of Double Encoding in File Names Facilitates the Creation of Repositories with Malicious Content.&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading for incorrect representation in the UI.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 4.8).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5512&quot;&gt;CVE-2023-5512&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unvalidated-timespent-value-leads-to-unable-to-load-issues-on-issue-board&quot;&gt;Unvalidated timeSpent value leads to unable to load issues on Issue board&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3904&quot;&gt;CVE-2023-3904&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;toukakirishima&quot;&gt;toukakirishima&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;developer-can-bypass-predefined-variables-via-rest-api&quot;&gt;Developer can bypass predefined variables via REST API&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI variables via the REST API. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5061&quot;&gt;CVE-2023-5061&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ali_shehab&quot;&gt;ali_shehab&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;auditor-users-can-create-merge-requests-on-projects-they-dont-have-access-to&quot;&gt;Auditor users can create merge requests on projects they don&#x27;t have access to&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge requests to private projects they&#x27;re not a member of. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3511&quot;&gt;CVE-2023-3511&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1662&quot;&gt;16.6.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1649&quot;&gt;[Backport 16.6] Fix redis-namspace dependency version for UBI mailroom&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1658&quot;&gt;Fix backup id parsing from backup URLs (16.6 Backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;138449&quot;&gt;Package Registry: Truncate Pypi metadata description field&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;138535&quot;&gt;Fix adding confidential child tasks&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;138797&quot;&gt;Backport Hide obsolete migration warning into 16.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;138911&quot;&gt;[16.6 Backport] Fix Admin Mode bug in DeactivateDormantUsersWorker&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;138929&quot;&gt;Backport Fix cluster reindexing service preflight check to 16.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;138804&quot;&gt;Backport Sanitize string provided to to_tsvector&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;138602&quot;&gt;Backport &quot;Update migration to work for any fk name&quot; to 16.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;139051&quot;&gt;Fix Environment destroy job is retried endlessly (16.6 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;138431&quot;&gt;Allow users to authenticate via OAuth with password-based providers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7275&quot;&gt;Do not scan entire &#x2F;var&#x2F;opt&#x2F;gitlab for stale pids (16.6 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1654&quot;&gt;16.5.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1641&quot;&gt;gitlab-rails: support skipping post-migrations in db checks&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1650&quot;&gt;[Backport 16.5] Fix redis-namspace dependency version for UBI mailroom&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;137712&quot;&gt;Backport - Truncate verification failure message to 255&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;138912&quot;&gt;[16.5 Backport] Fix Admin Mode bug in DeactivateDormantUsersWorker&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1644&quot;&gt;16.4.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1651&quot;&gt;[Backport 16.4] Fix redis-namspace dependency version for UBI mailroom&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;138913&quot;&gt;[16.4 Backport] Fix Admin Mode bug in DeactivateDormantUsersWorker&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.6.1, 16.5.3, 16.4.3</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/11/30/security-release-gitlab-16-6-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/11/30/security-release-gitlab-16-6-1-released/</id>
<published>2023-11-30T00:00:00+00:00</published>
<updated>2023-11-30T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>
&lt;p&gt;Today we are releasing versions 16.6.1, 16.5.3, 16.4.3 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases:
a monthly, scheduled security release, released a week after the feature release (which deploys on the 3rd Thursday of each month),
and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.
In addition, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest security release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#xss-and-redos-in-markdown-via-banzai-pipeline-of-jira&quot;&gt;XSS and ReDoS in Markdown via Banzai pipeline of Jira&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#members-with-admin_group_member-custom-permission-can-add-members-with-higher-role&quot;&gt;Members with admin_group_member custom permission can add members with higher role&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#release-description-visible-in-public-projects-despite-release-set-as-project-members-only-through-atom-response&quot;&gt;Release Description visible in public projects despite release set as project members only through atom response&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#manipulate-the-repository-content-in-the-ui-cve-2023-3401-bypass&quot;&gt;Manipulate the repository content in the UI (CVE-2023-3401 bypass)&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#external-user-can-abuse-policy-bot-to-gain-access-to-internal-projects&quot;&gt;External user can abuse policy bot to gain access to internal projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#developers-can-update-pipeline-schedules-to-use-protected-branches-even-if-they-dont-have-permission-to-merge&quot;&gt;Developers can update pipeline schedules to use protected branches even if they don&#x27;t have permission to merge&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#users-can-install-composer-packages-from-public-projects-even-when-package-registry-is-turned-off&quot;&gt;Users can install Composer packages from public projects even when &lt;code&gt;Package registry&lt;&#x2F;code&gt; is turned off&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#client-side-dos-via-mermaid-flowchart&quot;&gt;Client-side DOS via Mermaid Flowchart&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-member-can-gain-allowed-to-push-and-merge-access-and-affect-integrity-of-protected-branches&quot;&gt;Unauthorized member can gain &lt;code&gt;Allowed to push and merge&lt;&#x2F;code&gt; access and affect integrity of protected branches&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#guest-users-can-react-emojis-on-confidential-work-items-which-they-cant-see-in-a-project&quot;&gt;Guest users can react (emojis) on confidential work items which they cant see in a project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;xss-and-redos-in-markdown-via-banzai-pipeline-of-jira&quot;&gt;XSS and ReDoS in Markdown via Banzai pipeline of Jira&lt;&#x2F;h3&gt;

&lt;p&gt;Improper neutralization of input in Jira integration configuration in GitLab CE&#x2F;EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allowed attacker to execute javascript in victim&#x27;s browser.&lt;&#x2F;p&gt;

&lt;p&gt;This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6033&quot;&gt;CVE-2023-6033&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;members-with-admin_group_member-custom-permission-can-add-members-with-higher-role&quot;&gt;Members with admin_group_member custom permission can add members with higher role&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.5.3, 
all versions starting from 16.6 before 16.6.1. When a user is assigned a custom role with &lt;code&gt;admin_group_member&lt;&#x2F;code&gt;` enabled, they may be able to add a member with a higher static role than themselves to the group which may lead to privilege escalation.&lt;&#x2F;p&gt;

&lt;p&gt;This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.1).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-6396&quot;&gt;CVE-2023-6396&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;jarka&quot;&gt;jarka&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;release-description-visible-in-public-projects-despite-release-set-as-project-members-only-through-atom-response&quot;&gt;Release Description visible in public projects despite release set as project members only through atom response&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1.
It was possible for unauthorized users to view a public projects&#x27; release descriptions via an atom endpoint when release access on the public was set to only project members&lt;&#x2F;p&gt;

&lt;p&gt;This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3949&quot;&gt;CVE-2023-3949&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;manipulate-the-repository-content-in-the-ui-cve-2023-3401-bypass&quot;&gt;Manipulate the repository content in the UI (CVE-2023-3401 bypass)&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI.&lt;&#x2F;p&gt;

&lt;p&gt;This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 4.8).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5226&quot;&gt;CVE-2023-5226&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shells3c&quot;&gt;shells3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;external-user-can-abuse-policy-bot-to-gain-access-to-internal-projects&quot;&gt;External user can abuse policy bot to gain access to internal projects&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects.&lt;&#x2F;p&gt;

&lt;p&gt;This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5995&quot;&gt;CVE-2023-5995&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;client-side-dos-via-mermaid-flowchart&quot;&gt;Client-side DOS via Mermaid Flowchart&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input.&lt;&#x2F;p&gt;

&lt;p&gt;This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 2.6).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4912&quot;&gt;CVE-2023-4912&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;toukakirishima&quot;&gt;toukakirishima&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;developers-can-update-pipeline-schedules-to-use-protected-branches-even-if-they-dont-have-permission-to-merge&quot;&gt;Developers can update pipeline schedules to use protected branches even if they don&#x27;t have permission to merge&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch to a protected branch.&lt;&#x2F;p&gt;

&lt;p&gt;This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4317&quot;&gt;CVE-2023-4317&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;users-can-install-composer-packages-from-public-projects-even-when-package-registry-is-turned-off&quot;&gt;Users can install Composer packages from public projects even when &lt;code&gt;Package registry&lt;&#x2F;code&gt; is turned off&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings.&lt;&#x2F;p&gt;

&lt;p&gt;This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3964&quot;&gt;CVE-2023-3964&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;unauthorized-member-can-gain-allowed-to-push-and-merge-access-and-affect-integrity-of-protected-branches&quot;&gt;Unauthorized member can gain &lt;code&gt;Allowed to push and merge&lt;&#x2F;code&gt; access and affect integrity of protected branches&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the &lt;code&gt;Allowed to merge&lt;&#x2F;code&gt; permission as a guest user, when granted the permission through a group.&lt;&#x2F;p&gt;

&lt;p&gt;This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4658&quot;&gt;CVE-2023-4658&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;guest-users-can-react-emojis-on-confidential-work-items-which-they-cant-see-in-a-project&quot;&gt;Guest users can react (emojis) on confidential work items which they cant see in a project&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items.&lt;&#x2F;p&gt;

&lt;p&gt;This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3443&quot;&gt;CVE-2023-3443&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;mattermost-security-update&quot;&gt;Mattermost Security Update&lt;&#x2F;h3&gt;

&lt;p&gt;Mattermost has been updated to the latest patch release to mitigate several security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;update-to-pg-149-and-1312&quot;&gt;Update to PG 14.9 and 13.12&lt;&#x2F;h3&gt;

&lt;p&gt;PostgreSQL has been updated to 14.9 and 13.12 to mitigate CVE-2023-39417.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;update-pcre2-to-1042&quot;&gt;Update pcre2 to 10.42&lt;&#x2F;h3&gt;

&lt;p&gt;&lt;code&gt;pcre2&lt;&#x2F;code&gt; has been updated to version 10.42 to mitigate CVE-2022-41409.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1661&quot;&gt;16.6.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1639&quot;&gt;Install Gitaly dependencies for project archiving (16.6 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;137167&quot;&gt;Fix intermittent 404 errors loading GitLab Pages&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;136888&quot;&gt;Prefer custom sort order with search in users API&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;136902&quot;&gt;Backport &quot;Fix group page erroring because of nil user&quot; to 16-6-stable-ee&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;137296&quot;&gt;Skip encrypted settings logic for Redis when used by Mailroom&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;137687&quot;&gt;Allow &lt;code&gt;+&lt;&#x2F;code&gt; char in abuse detection for global search&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;137800&quot;&gt;Backport &quot;Move unlock pipeline cron scheduler out of ee&quot; to 16.6&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;137899&quot;&gt;Fix bug with pages_deployments files not being deleted on disk&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;137711&quot;&gt;Backport - Truncate verification failure message to 255&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;138131&quot;&gt;Backport &quot;Revert &quot;Merge branch &#x27;sc1-release-goredis&#x27; into &#x27;master&#x27;&quot;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1653&quot;&gt;16.5.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1636&quot;&gt;Backport  10871d71b171db38701bfefe15883b05c234ca6d to &lt;code&gt;16-5-stable&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;136934&quot;&gt;Geo: Reduce batch size of verification state backfill&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1643&quot;&gt;16.4.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1622&quot;&gt;Backport  10871d71b171db38701bfefe15883b05c234ca6d to &lt;code&gt;16-4-stable&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6554&quot;&gt;Backport to 16.4 the fix for test failure due to &quot;not-existing.com&quot; being registered&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;135647&quot;&gt;Bump &lt;code&gt;asdf-bootstrapped-verify&lt;&#x2F;code&gt; version on 16.4&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;133886&quot;&gt;Fix bulk batch export of badges and uploads&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;136764&quot;&gt;[16.4] ci: Fix broken master by not reading GITLAB_ENV&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;136433&quot;&gt;Fix assign security check permission checks&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;136774&quot;&gt;For 16.4: Fix Geo verification state backfill job can exceed batch size&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;136937&quot;&gt;Geo: Reduce batch size of verification state backfill&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.5.1, 16.4.2, 16.3.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/10/31/security-release-gitlab-16-5-1-16-4-2-16-3-6-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/10/31/security-release-gitlab-16-5-1-16-4-2-16-3-6-released/</id>
<published>2023-10-31T00:00:00+00:00</published>
<updated>2023-10-31T00:00:00+00:00</updated>
<author>
<name>Greg Alfaro</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;-&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing versions 16.5.1, 16.4.2, 16.3.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases:
a monthly, scheduled security release, released a week after the feature release (which deploys on the 3rd Thursday of each month),
and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;.
You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.
In addition, the issues detailing each vulnerability are made public on our
&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt;
30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest security release for their supported version. You can read more
&lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;p&gt;On 2023-10-20 11:03 UTC, GitLab internally discovered (CVE-2023-5831) that a change in the GitLab sidebar feature resulted in self-managed GitLab instances sending version-checks to version.gitlab.com each time they opened a page on their GitLab instance. This means that the hostnames and current versions of self-managed GitLab instances were being sent to version.gitlab.com any time a user of that GitLab instance opened any page, regardless of whether or not the sending of version-check was enabled. This information was only accessible to some GitLab team members and was not exposed externally, and GitLab is working to purge the erroneously collected data from our database.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#disclosure-of-cicd-variables-using-custom-project-templates&quot;&gt;Disclosure of CI&#x2F;CD variables using Custom project templates&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;High&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#gitlab-omnibus-dos-crash-via-oom-with-ci-catalogs&quot;&gt;GitLab omnibus DoS crash via OOM with CI Catalogs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#parsing--gitlab-ciyml-with-large-string-via-timeout-input-leads-to-denial-of-service&quot;&gt;Parsing  gitlab-ci.yml with large string via &lt;code&gt;timeout&lt;&#x2F;code&gt; input leads to Denial of Service&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dos---blocking-fifo-files-in-tar-archives&quot;&gt;DoS - Blocking FIFO files in Tar archives&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#titles-exposed-by-service-desk-template&quot;&gt;Titles exposed by service-desk template&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#approval-on-protected-environments-can-be-bypassed&quot;&gt;Approval on protected environments can be bypassed&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#version-information-disclosure-when-super_sidebar_logged_out-feature-flag-is-enabled&quot;&gt;Version information disclosure when &lt;code&gt;super_sidebar_logged_out&lt;&#x2F;code&gt; feature flag is enabled&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#add-abuse-detection-for-search-syntax-filter-pipes&quot;&gt;Add abuse detection for search syntax filter pipes&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h3 id=&quot;disclosure-of-cicd-variables-using-custom-project-templates&quot;&gt;Disclosure of CI&#x2F;CD variables using Custom project templates&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 11.6 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. It was possible for an unauthorised project or group member to read the CI&#x2F;CD variables using the custom project templates.
This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 8.5).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3399&quot;&gt;CVE-2023-3399&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;gitlab-omnibus-dos-crash-via-oom-with-ci-catalogs&quot;&gt;GitLab omnibus DoS crash via OOM with CI Catalogs&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A low-privileged attacker can point a CI&#x2F;CD Component to an incorrect path and cause the server to exhaust all available memory through an infinite loop and cause Denial of Service. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5825&quot;&gt;CVE-2023-5825&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;blakbat&quot;&gt;blakbat&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&quot;&lt;&#x2F;p&gt;

&lt;h3 id=&quot;parsing--gitlab-ciyml-with-large-string-via-timeout-input-leads-to-denial-of-service&quot;&gt;Parsing  gitlab-ci.yml with large string via &lt;code&gt;timeout&lt;&#x2F;code&gt; input leads to Denial of Service&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible  by adding a large string in timeout input in gitlab-ci.yml file.&quot; This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3909&quot;&gt;CVE-2023-3909&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;akadrian&quot;&gt;akadrian&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;dos---blocking-fifo-files-in-tar-archives&quot;&gt;DoS - Blocking FIFO files in Tar archives&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE&#x2F;CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3246&quot;&gt;CVE-2023-3246&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;zhutyra&quot;&gt;zhutyra&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;titles-exposed-by-service-desk-template&quot;&gt;Titles exposed by service-desk template&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. Arbitrary access to the titles of an private specific references could be leaked through the service-desk custom email template. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5600&quot;&gt;CVE-2023-5600&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;approval-on-protected-environments-can-be-bypassed&quot;&gt;Approval on protected environments can be bypassed&lt;&#x2F;h3&gt;

&lt;p&gt;An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments, bypassing any required approvals. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4700&quot;&gt;CVE-2023-4700&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;gregodfather&quot;&gt;Gregor Pirolt&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;version-information-disclosure-when-super_sidebar_logged_out-feature-flag-is-enabled&quot;&gt;Version information disclosure when &lt;code&gt;super_sidebar_logged_out&lt;&#x2F;code&gt; feature flag is enabled&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the &lt;code&gt;super_sidebar_logged_out&lt;&#x2F;code&gt; feature flag enabled. Affected versions with this default-disabled feature flag enabled may unintentionally disclose GitLab version metadata to unauthorized actors. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.7).
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5831&quot;&gt;CVE-2023-5831&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;add-abuse-detection-for-search-syntax-filter-pipes&quot;&gt;Add abuse detection for search syntax filter pipes&lt;&#x2F;h3&gt;

&lt;p&gt;An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release. We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was found internally by GitLab.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;update-curl-to-v840&quot;&gt;Update curl to v8.4.0&lt;&#x2F;h3&gt;

&lt;p&gt;curl has been updated to v8.4.0 to mitigate &lt;a href=&quot;https:&#x2F;&#x2F;curl.se&#x2F;docs&#x2F;CVE-2023-38545.html&quot;&gt;CVE-2023-38545&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;update-mermaid-to-1050&quot;&gt;Update mermaid to 10.5.0&lt;&#x2F;h3&gt;

&lt;p&gt;mermaid has been updated to 10.5.0 to mitigate a security issue.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;patch-nginx-for-cve-2023-44487&quot;&gt;Patch NGINX for CVE-2023-44487&lt;&#x2F;h3&gt;

&lt;p&gt;NGINX has been patched to mitigate CVE-2023-44487.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1651&quot;&gt;16.5.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;134835&quot;&gt;Revert better-error-messages-for-pull-mirroring&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;134867&quot;&gt;Update post migration to drop column only if it exists&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;135226&quot;&gt;Downgrade vue-apollo to prevent auto-restarting subscriptions on error&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1642&quot;&gt;16.4.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1554&quot;&gt;UBI: Explicitly add webrick gem to mailroom build&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;133882&quot;&gt;Update VERSION files&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;133877&quot;&gt;Update dependency prometheus-client-mmap to &#x27;&amp;gt;= 0.28.1&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;133833&quot;&gt;Backport: fix migration when commit_message_negative_regex is missing&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;134197&quot;&gt;Backport to 16.4: Geo: Avoid getting resources stuck in Queued&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;134481&quot;&gt;Fix pipeline schedules view when owner is nil&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;134565&quot;&gt;Quarantine flaky delete_job_spec:46&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;134264&quot;&gt;Create Geo event when project is created&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;134328&quot;&gt;Fix bug with batched gitaly ref deletion duplicates&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1636&quot;&gt;16.3.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1555&quot;&gt;UBI: Explicitly add webrick gem to mailroom build&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1499&quot;&gt;Backport 16.3: Upgrade exiftool to 12.65&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;135401&quot;&gt;Fixes the 16-3-stable branch&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;134196&quot;&gt;Backport to 16.3: Geo: Avoid getting resources stuck in Queued&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.4.1, 16.3.5, and 16.2.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/09/28/security-release-gitlab-16-4-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/09/28/security-release-gitlab-16-4-1-released/</id>
<published>2023-09-28T00:00:00+00:00</published>
<updated>2023-09-28T00:00:00+00:00</updated>
<author>
<name>Félix Veillette-Potvin</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 16.4.1, 16.3.5, and 16.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#attacker-can-add-other-projects-policy-bot-as-member-to-their-own-project-and-use-that-bot-to-trigger-pipelines-in-victims-project&quot;&gt;Attacker can add other projects policy bot as member to their own project and use that bot to trigger pipelines in victims project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-import-allows-impersonation-of-users-in-ci-pipelines&quot;&gt;Group import allows impersonation of users in CI pipelines&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#developers-can-bypass-code-owners-approval-by-changing-a-mrs-base-branch&quot;&gt;Developers can bypass code owners approval by changing a MR&#x27;s base branch&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#leaking-source-code-of-restricted-project-through-a-fork&quot;&gt;Leaking source code of restricted project through a fork&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#third-party-library-consul-requires-enable-script-checks-to-be-false-to-enable-patch&quot;&gt;Third party library Consul requires enable-script-checks to be False to enable patch&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#service-account-not-deleted-when-namespace-is-deleted-allowing-access-to-internal-projects&quot;&gt;Service account not deleted when namespace is deleted allowing access to internal projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#enforce-sso-settings-bypassed-for-public-projects-for-members-without-identity&quot;&gt;Enforce SSO settings bypassed for public projects for Members without identity&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#removed-project-member-can-write-to-protected-branches&quot;&gt;Removed project member can write to protected branches&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorised-association-of-ci-jobs-for-machine-learning-experiments&quot;&gt;Unauthorised association of CI jobs for Machine Learning experiments&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#force-pipelines-to-not-have-access-to-protected-variables-and-will-likely-fail-using-tags&quot;&gt;Force pipelines to not have access to protected variables and will likely fail using tags&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-create-a-fork-relationship-between-existing-projects&quot;&gt;Maintainer can create a fork relationship between existing projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#disclosure-of-masked-ci-variables-via-processing-cicd-configuration-of-forks&quot;&gt;Disclosure of masked CI variables via processing CI&#x2F;CD configuration of forks&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#asset-proxy-bypass-using-non-ascii-character-in-asset-uri&quot;&gt;Asset Proxy Bypass using non-ASCII character in asset URI&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-member-can-gain-allowed-to-push-and-merge-access-and-affect-integrity-of-protected-branches&quot;&gt;Unauthorized member can gain &lt;code&gt;Allowed to push and merge&lt;&#x2F;code&gt; access and affect integrity of protected branches&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#removed-developer-can-continue-editing-the-source-code-of-a-public-project&quot;&gt;Removed Developer can continue editing the source code of a public project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#a-project-reporter-can-leak-owners-sentry-instance-projects&quot;&gt;A project reporter can leak owner&#x27;s Sentry instance projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#math-rendering-in-markdown-can-escape-container-and-hijack-clicks&quot;&gt;Math rendering in markdown can escape container and hijack clicks&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;attacker-can-add-other-projects-policy-bot-as-member-to-their-own-project-and-use-that-bot-to-trigger-pipelines-in-victims-project&quot;&gt;Attacker can add other projects policy bot as member to their own project and use that bot to trigger pipelines in victims project&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;982 --&gt;

&lt;p&gt;A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.2). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5207&quot;&gt;CVE-2023-5207&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-import-allows-impersonation-of-users-in-ci-pipelines&quot;&gt;Group import allows impersonation of users in CI pipelines&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;980 --&gt;

&lt;p&gt;Two issues have been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports. These are a high severity issues (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.2). They are now mitigated in the latest release and are assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5106&quot;&gt;CVE-2023-5106&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;These issues have been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;joernchen&quot;&gt;Joern Schneeweisz&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;developers-can-bypass-code-owners-approval-by-changing-a-mrs-base-branch&quot;&gt;Developers can bypass code owners approval by changing a MR&#x27;s base branch&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;976 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting 15.3 prior to prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4379&quot;&gt;CVE-2023-4379&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This issue was reported by a customer.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;leaking-source-code-of-restricted-project-through-a-fork&quot;&gt;Leaking source code of restricted project through a fork&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;939 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that an unauthorised user to fork a public project. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3413&quot;&gt;CVE-2023-3413&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shells3c&quot;&gt;shells3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;third-party-library-consul-requires-enable-script-checks-to-be-false-to-enable-patch&quot;&gt;Third party library Consul requires enable-script-checks to be False to enable patch&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;99 --&gt;

&lt;p&gt;Patch in third party library Consul requires &#x27;enable-script-checks&#x27; to be set to False. This only affects GitLab-EE. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5332&quot;&gt;CVE-2023-5332&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This issue was reported by a customer.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;service-account-not-deleted-when-namespace-is-deleted-allowing-access-to-internal-projects&quot;&gt;Service account not deleted when namespace is deleted allowing access to internal projects&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;962 --&gt;

&lt;p&gt;A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3914&quot;&gt;CVE-2023-3914&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;enforce-sso-settings-bypassed-for-public-projects-for-members-without-identity&quot;&gt;Enforce SSO settings bypassed for public projects for Members without identity&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;930 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositories. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3115&quot;&gt;CVE-2023-3115&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;removed-project-member-can-write-to-protected-branches&quot;&gt;Removed project member can write to protected branches&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;972 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5198&quot;&gt;CVE-2023-5198&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorised-association-of-ci-jobs-for-machine-learning-experiments&quot;&gt;Unauthorised association of CI jobs for Machine Learning experiments&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;960 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI&#x2F;CD jobs of private projects which they are not a member of. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4532&quot;&gt;CVE-2023-4532&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ricardobrito&quot;&gt;ricardobrito&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;force-pipelines-to-not-have-access-to-protected-variables-and-will-likely-fail-using-tags&quot;&gt;Force pipelines to not have access to protected variables and will likely fail using tags&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;955 --&gt;

&lt;p&gt;Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3917&quot;&gt;CVE-2023-3917&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-can-create-a-fork-relationship-between-existing-projects&quot;&gt;Maintainer can create a fork relationship between existing projects&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;963 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that a maintainer to create a fork relationship between existing projects contrary to the documentation. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3920&quot;&gt;CVE-2023-3920&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-masked-ci-variables-via-processing-cicd-configuration-of-forks&quot;&gt;Disclosure of masked CI variables via processing CI&#x2F;CD configuration of forks&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;964 --&gt;

&lt;p&gt;An information disclosure issue in GitLab CE&#x2F;EE affecting all versions from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI&#x2F;CD variables by tricking a user to visit a fork with a malicious CI&#x2F;CD configuration. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0989&quot;&gt;CVE-2023-0989&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shells3c&quot;&gt;shells3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;asset-proxy-bypass-using-non-ascii-character-in-asset-uri&quot;&gt;Asset Proxy Bypass using non-ASCII character in asset URI&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;973 --&gt;

&lt;p&gt;An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3906&quot;&gt;CVE-2023-3906&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;afewgoats&quot;&gt;afewgoats&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-member-can-gain-allowed-to-push-and-merge-access-and-affect-integrity-of-protected-branches&quot;&gt;Unauthorized member can gain &lt;code&gt;Allowed to push and merge&lt;&#x2F;code&gt; access and affect integrity of protected branches&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from X.Y before 16.X, all versions starting from 16.X before 16.X. It was possible for an attacker to abuse the &lt;code&gt;Allowed to merge&lt;&#x2F;code&gt; permission as a guest user, when granted the permission through a group. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4658&quot;&gt;CVE-2023-4658&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;removed-developer-can-continue-editing-the-source-code-of-a-public-project&quot;&gt;Removed Developer can continue editing the source code of a public project&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;953 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch. . This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3979&quot;&gt;CVE-2023-3979&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;a-project-reporter-can-leak-owners-sentry-instance-projects&quot;&gt;A project reporter can leak owner&#x27;s Sentry instance projects&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;968 --&gt;

&lt;p&gt;An improper authorization issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.8 before 16.2.x8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4.0 before 16.4.1. It allows a project reporter to leak the owner&#x27;s Sentry instance projects. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2233&quot;&gt;CVE-2023-2233&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;math-rendering-in-markdown-can-escape-container-and-hijack-clicks&quot;&gt;Math rendering in markdown can escape container and hijack clicks&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;974 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 3.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3922&quot;&gt;CVE-2023-3922&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ammar2&quot;&gt;ammar2&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h1 id=&quot;update-exiftool&quot;&gt;Update Exiftool&lt;&#x2F;h1&gt;
&lt;p&gt;Exiftool has been updated to version 1.12 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h1 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h1&gt;
&lt;p&gt;Mattermost has been updated to version 8.1.2 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h1 id=&quot;update-auto-deploy-image&quot;&gt;Update Auto deploy image&lt;&#x2F;h1&gt;
&lt;p&gt;Auto deploy image has been updated to version 2.55.0 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;h3 id=&quot;1635&quot;&gt;16.3.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;132398&quot;&gt;Backport disable v1 package metadata sync&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 16.3.4 and 16.2.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/09/18/security-release-gitlab-16-3-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/09/18/security-release-gitlab-16-3-4-released/</id>
<published>2023-09-18T00:00:00+00:00</published>
<updated>2023-09-18T00:00:00+00:00</updated>
<author>
<name>Nick Malcolm</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 16.3.4 and 16.2.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;. For versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4, see the &lt;a href=&quot;#mitigations-for-impacted-versions&quot;&gt;mitigations&lt;&#x2F;a&gt; offered below.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#attacker-can-abuse-scan-execution-policies-to-run-pipelines-as-another-user&quot;&gt;Attacker can abuse scan execution policies to run pipeline as another user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;attacker-can-abuse-scan-execution-policies-to-run-pipelines-as-another-user&quot;&gt;Attacker can abuse scan execution policies to run pipelines as another user&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;975 --&gt;
&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting
from 13.12 before 16.2.7 and all
versions starting from 16.3 before 16.3.4. It was possible for an attacker to run 
pipelines as an arbitrary user via scheduled security scan policies. 
This was a bypass of &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3932&quot;&gt;CVE-2023-3932&lt;&#x2F;a&gt; showing additional impact.
This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.2). 
It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-5009&quot;&gt;CVE-2023-5009&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;mitigations-for-impacted-versions&quot;&gt;Mitigations for impacted versions&lt;&#x2F;h3&gt;

&lt;p&gt;Instances running versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4 are vulnerable if both of the features below are enabled at the same time. In order to mitigate this vulnerability in situations where it&#x27;s not possible to upgrade, it is required to disable one or both features.&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;settings&#x2F;import_and_export_settings.html#enable-migration-of-groups-and-projects-by-direct-transfer&quot;&gt;Direct transfers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;application_security&#x2F;policies&#x2F;scan-execution-policies.html&quot;&gt;Security policies&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;&lt;strong&gt;If both features are turned on, the instance is in a vulnerable state.&lt;&#x2F;strong&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;p&gt;This security release also includes the following non-security patches.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;1634&quot;&gt;16.3.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;131073&quot;&gt;Use new indexer, fix removing blobs from index&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;131920&quot;&gt;Backport &quot;Fix Geo secondary proxying Git pulls unnecessarily&quot; to 16.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1627&quot;&gt;16.2.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;131193&quot;&gt;Revert &quot;Merge branch &#x27;md-play-all-skipped-button&#x27; into &#x27;master&#x27;&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.3.1, 16.2.5, and 16.1.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/08/31/security-release-gitlab-16-3-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/08/31/security-release-gitlab-16-3-1-released/</id>
<published>2023-08-31T00:00:00+00:00</published>
<updated>2023-08-31T00:00:00+00:00</updated>
<author>
<name>Félix Veillette-Potvin</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 16.3.1, 16.2.5 and 16.1.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#privilege-escalation-of-external-user-to-internal-access-through-group-service-account&quot;&gt;Privilege escalation of &quot;external user&quot; to internal access through group service account&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-leak-sentry-token-by-changing-the-configured-url-fix-bypass&quot;&gt;Maintainer can leak sentry token by changing the configured URL (fix bypass)&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#google-cloud-logging-private-key-showed-in-plain-text-in-gitlab-ui-leaking-to-other-group-owners&quot;&gt;Google Cloud Logging private key showed in plain text in GitLab UI leaking to other group owners&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#information-disclosure-via-project-import-endpoint&quot;&gt;Information disclosure via project import endpoint&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#developer-can-leak-dast-scanners-site-profile-request-headers-and-auth-password&quot;&gt;Developer can leak DAST scanners &quot;Site Profile&quot; request headers and auth password&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-forking-outside-current-group&quot;&gt;Project forking outside current group&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#user-is-capable-of-creating-model-experiment-and-updating-existing-run&#x27;s-status-in-public-project&quot;&gt;User is capable of creating Model experiment and updating existing run&#x27;s status in public project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-in-bulk-import-api&quot;&gt;ReDoS in bulk import API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#pagination-for-branches-and-tags-can-be-skipped-leading-to-dos&quot;&gt;Pagination for Branches and Tags can be skipped leading to DoS&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#internal-open-redirection-due-to-improper-handling-of-characters&quot;&gt;Internal Open Redirection Due to Improper handling of  &quot;..&#x2F;&quot; characters&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#subgroup-member-with-reporter-role-can-edit-group-labels&quot;&gt;Subgroup Member With Reporter Role Can Edit Group Labels&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#banned-user-can-delete-package-registries&quot;&gt;Banned user can delete package registries&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;privilege-escalation-of-external-user-to-internal-access-through-group-service-account&quot;&gt;Privilege escalation of &quot;external user&quot; to internal access through group service account&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified as external and may be used to access internal projects. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3915&quot;&gt;CVE-2023-3915&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-can-leak-sentry-token-by-changing-the-configured-url-fix-bypass&quot;&gt;Maintainer can leak sentry token by changing the configured URL (fix bypass)&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;950 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned [CVE-2023-4378](https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4378.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;70rpedo&quot;&gt;70rpedo&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;google-cloud-logging-private-key-showed-in-plain-text-in-gitlab-ui-leaking-to-other-group-owners&quot;&gt;Google Cloud Logging private key showed in plain text in GitLab UI leaking to other group owners&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;940 --&gt;

&lt;p&gt;An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5), and affects only GitLab EE. It is now mitigated in the latest release and is assigned [CVE-2023-3950](https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3950.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-via-project-import-endpoint&quot;&gt;Information disclosure via project import endpoint&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project&#x27;s imports. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4630&quot;&gt;CVE-2023-4630&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was found internally by a GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;rodrigo.tomonari&quot;&gt;Rodrigo Tomonari&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;developer-can-leak-dast-scanners-site-profile-request-headers-and-auth-password&quot;&gt;Developer can leak DAST scanners &quot;Site Profile&quot; request headers and auth password&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;954 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site profile. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.0), and only affects GitLab EE. It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4343&quot;&gt;CVE-2022-4343&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-forking-outside-current-group&quot;&gt;Project forking outside current group&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.3 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to fork a project outside of current group by an unauthorised user. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4638&quot;&gt;CVE-2023-4638&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-is-capable-of-creating-model-experiment-and-updating-existing-runs-status-in-public-project&quot;&gt;User is capable of creating Model experiment and updating existing run&#x27;s status in public project&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4018&quot;&gt;CVE-2023-4018&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ricardobrito&quot;&gt;ricardobrito&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h2 id=&quot;redos-in-bulk-import-api&quot;&gt;ReDoS in bulk import API&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlahttps:&#x2F;&#x2F;about.gitlab.com&#x2F;releases&#x2F;2023&#x2F;08&#x2F;01&#x2F;b&#x2F;-&#x2F;issues&#x2F;935 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;,6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3205&quot;&gt;CVE-2023-3205&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h2 id=&quot;pagination-for-branches-and-tags-can-be-skipped-leading-to-dos&quot;&gt;Pagination for Branches and Tags can be skipped leading to DoS&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.3 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4647&quot;&gt;CVE-2023-4647&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;vyaklushin&quot;&gt;Vasilii Iakliushin&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;internal-open-redirection-due-to-improper-handling-of---characters&quot;&gt;Internal Open Redirection Due to Improper handling of  &quot;..&#x2F;&quot; characters&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;934 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1279&quot;&gt;CVE-2023-1279&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;akadrian&quot;&gt;akadrian&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;subgroup-member-with-reporter-role-can-edit-group-labels&quot;&gt;Subgroup Member With Reporter Role Can Edit Group Labels&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0120&quot;&gt;CVE-2023-0120&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;drjgouveia&quot;&gt;drjgouveia&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;banned-user-can-delete-package-registries&quot;&gt;Banned user can delete package registries&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1555&quot;&gt;CVE-2023-1555&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ali_shehab&quot;&gt;ali_shehab&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-commonmarker&quot;&gt;Update commonmarker&lt;&#x2F;h2&gt;

&lt;p&gt;Commonmarker has been updated to version 0.23.10 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-openssl&quot;&gt;Update openssl&lt;&#x2F;h2&gt;
&lt;p&gt;Openssl has been updated to version to 1.1.1u in order to mitigate security issues.&lt;&#x2F;p&gt;
&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;p&gt;This security release also includes the following non-security patches.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;1631&quot;&gt;16.3.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;129854&quot;&gt;Remove unified URL limitation for GitLab chart (16.3 backport)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;129910&quot;&gt;Revert migration to backfill archived in wikis&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;129922&quot;&gt;Add .net to context selector to skip live envs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;129882&quot;&gt;Backport &quot;Geo: Resync direct upload object stored artifacts&quot; to 16.3&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;130200&quot;&gt;CSP: disable LFS url when not using object storage&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;129971&quot;&gt;Backport LicenseScanning fix for AutoDevOps&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1625&quot;&gt;16.2.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;6172&quot;&gt;Backport &quot;cgroup: using a noop manager on linux without cgroup&quot; fix to 16.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;128763&quot;&gt;Adjust Danger logic for stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;129883&quot;&gt;Backport &quot;Geo: Resync direct upload object stored artifacts&quot; to 16.2&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1615&quot;&gt;16.1.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;128779&quot;&gt;Revert &quot;Log rails response length&quot; - 16.1 Backport&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;128764&quot;&gt;Adjust Danger logic for stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;129884&quot;&gt;Backport &quot;Geo: Resync direct upload object stored artifacts&quot; to 16.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.2.2, 16.1.3, and 16.0.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/08/01/security-release-gitlab-16-2-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/08/01/security-release-gitlab-16-2-2-released/</id>
<published>2023-08-01T00:00:00+00:00</published>
<updated>2023-08-01T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 16.2.2, 16.1.3, and 16.0.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-via-projectreferencefilter-in-any-markdown-fields&quot;&gt;ReDoS via ProjectReferenceFilter in any Markdown fields&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-via-autolinkfilter-in-any-markdown-fields&quot;&gt;ReDoS via AutolinkFilter in any Markdown fields&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#an-attacker-can-run-pipeline-jobs-as-arbitrary-user&quot;&gt;An attacker can run pipeline jobs as arbitrary user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#regex-dos-in-harbor-registry-search&quot;&gt;Regex DoS in Harbor Registry search&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-read-of-files-owned-by-the-git-user-via-malicious-targz-file-upload-using-gitlab-export-functionality&quot;&gt;Arbitrary read of files owned by the &quot;git&quot; user via malicious tar.gz file upload using GitLab export functionality&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-web-ide-beta-via-crafted-url&quot;&gt;Stored XSS in Web IDE Beta via crafted URL&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#securitypolicyprojectassign-mutation-does-not-authorize-security-policy-project-id&quot;&gt;&lt;code&gt;securityPolicyProjectAssign&lt;&#x2F;code&gt; mutation does not authorize security policy project ID&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#possible-pages-unique-domain-overwrite&quot;&gt;Possible Pages Unique Domain Overwrite&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#access-tokens-may-have-been-logged-when-a-query-was-made-to-an-endpoint&quot;&gt;Access tokens may have been logged when a query was made to an endpoint&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#reflected-xss-via-plantuml-diagram&quot;&gt;Reflected XSS via PlantUML diagram&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#the-main-branch-of-a-repository-with-a-specially-designed-name-may-allow-an-attacker-to-create-repositories-with-malicious-code&quot;&gt;The main branch of a repository with a specially designed name may allow an attacker to create repositories with malicious code&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#invalid-start_sha-value-on-merge-requests-page-may-lead-to-denial-of-service&quot;&gt;Invalid &#x27;start_sha&#x27; value on merge requests page may lead to Denial of Service&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#developers-can-create-pipeline-schedules-on-protected-branches-even-if-they-dont-have-access-to-merge&quot;&gt;Developers can create pipeline schedules on protected branches even if they don&#x27;t have access to merge&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#potential-dos-due-to-lack-of-pagination-while-loading-license-data&quot;&gt;Potential DOS due to lack of pagination while loading license data&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#leaking-emails-of-newly-created-users&quot;&gt;Leaking emails of newly created users&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;redos-via-projectreferencefilter-in-any-markdown-fields&quot;&gt;ReDoS via ProjectReferenceFilter in any Markdown fields&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;910 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3994&quot;&gt;CVE-2023-3994&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryhmnlfj&quot;&gt;ryhmnlfj&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;redos-via-autolinkfilter-in-any-markdown-fields&quot;&gt;ReDoS via AutolinkFilter in any Markdown fields&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;925 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3364&quot;&gt;CVE-2023-3364&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryhmnlfj&quot;&gt;ryhmnlfj&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;an-attacker-can-run-pipeline-jobs-as-arbitrary-user&quot;&gt;An attacker can run pipeline jobs as arbitrary user&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;917 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.2). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3932&quot;&gt;CVE-2023-3932&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky&quot;&gt;vaib25vicky&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regex-dos-in-harbor-registry-search&quot;&gt;Regex DoS in Harbor Registry search&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;913 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0632&quot;&gt;CVE-2023-0632&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-read-of-files-owned-by-the-git-user-via-malicious-targz-file-upload-using-gitlab-export-functionality&quot;&gt;Arbitrary read of files owned by the &quot;git&quot; user via malicious tar.gz file upload using GitLab export functionality&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;926 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project &#x27;from export&#x27; could access and read unrelated files via uploading a specially crafted file. This was due to a bug in &lt;code&gt;tar&lt;&#x2F;code&gt;, fixed in &lt;a href=&quot;https:&#x2F;&#x2F;lists.gnu.org&#x2F;archive&#x2F;html&#x2F;info-gnu&#x2F;2023-07&#x2F;msg00005.html&quot;&gt;&lt;code&gt;tar-1.35&lt;&#x2F;code&gt;&lt;&#x2F;a&gt;. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3385&quot;&gt;CVE-2023-3385&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ubercomp&quot;&gt;ubercomp&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-web-ide-beta-via-crafted-url&quot;&gt;Stored XSS in Web IDE Beta via crafted URL&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2164&quot;&gt;CVE-2023-2164&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;viridian_40826d&quot;&gt;viridian_40826d&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;securitypolicyprojectassign-mutation-does-not-authorize-security-policy-project-id&quot;&gt;&lt;code&gt;securityPolicyProjectAssign&lt;&#x2F;code&gt; mutation does not authorize security policy project ID&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;929 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to projects or groups the user has access to, potentially revealing the security projects&#x27;s configured security policies. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4002&quot;&gt;CVE-2023-4002&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;bauerdominic&quot;&gt;bauerdominic&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;possible-pages-unique-domain-overwrite&quot;&gt;Possible Pages Unique Domain Overwrite&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;920 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4008&quot;&gt;CVE-2023-4008&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;kassio&quot;&gt;kassio&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;access-tokens-may-have-been-logged-when-a-query-was-made-to-an-endpoint&quot;&gt;Access tokens may have been logged when a query was made to an endpoint&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;906 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3993&quot;&gt;CVE-2023-3993&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;mjozenazemian&quot;&gt;mjozenazemian&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;reflected-xss-via-plantuml-diagram&quot;&gt;Reflected XSS via PlantUML diagram&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;932 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3500&quot;&gt;CVE-2023-3500&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ankitsingh&quot;&gt;ankitsingh&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;the-main-branch-of-a-repository-with-a-specially-designed-name-may-allow-an-attacker-to-create-repositories-with-malicious-code&quot;&gt;The main branch of a repository with a specially designed name may allow an attacker to create repositories with malicious code&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;915 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 4.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3401&quot;&gt;CVE-2023-3401&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h2 id=&quot;invalid-start_sha-value-on-merge-requests-page-may-lead-to-denial-of-service&quot;&gt;Invalid &#x27;start_sha&#x27; value on merge requests page may lead to Denial of Service&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;928 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid &#x27;start_sha&#x27; value on merge requests page may lead to Denial of Service as Changes tab would not load. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3900&quot;&gt;CVE-2023-3900&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;toukakirishima&quot;&gt;toukakirishima&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;developers-can-create-pipeline-schedules-on-protected-branches-even-if-they-dont-have-access-to-merge&quot;&gt;Developers can create pipeline schedules on protected branches even if they don&#x27;t have access to merge&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;901 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don&#x27;t have access to merge. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2022&quot;&gt;CVE-2023-2022&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;potential-dos-due-to-lack-of-pagination-while-loading-license-data&quot;&gt;Potential DOS due to lack of pagination while loading license data&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;931 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption by loading Dependency List page, resulting in a possible DoS. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is mitigated in the latest 16.2.2 release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-4011&quot;&gt;CVE-2023-4011&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gonzoyumo&quot;&gt;gonzoyumo&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;leaking-emails-of-newly-created-users&quot;&gt;Leaking emails of newly created users&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;927 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user&#x27;s email via an error message for groups that restrict membership by email domain. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1210&quot;&gt;CVE-2023-1210&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shells3c&quot;&gt;shells3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;p&gt;Mattermost has been updated to version 7.10.4  in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-redis&quot;&gt;Update Redis&lt;&#x2F;h2&gt;

&lt;p&gt;Redis has been updated to version 6.2.13 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;p&gt;This security release also includes the following non-security patches.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;1622&quot;&gt;16.2.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;127238&quot; title=&quot;Merge branch &#x27;418983-fix-issue-type-update&#x27; into &#x27;master&#x27;&quot;&gt;Issue type change to incident results in 404&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;127045&quot; title=&quot;Enable descendant_security_scans by default&quot;&gt;Enable &lt;code&gt;descendant_security_scans&lt;&#x2F;code&gt; by default&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;127516&quot; title=&quot;Disable IAT verification by default&quot;&gt;Disable IAT verification by default&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;127777&quot; title=&quot;BitBucket Server Importer - Preserve PR (MR) reviewers&quot;&gt;BitBucket Server Importer - Preserve PR (MR) reviewers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7060&quot; title=&quot;Toggle recommend_pg_upgrade to false for now&quot;&gt;Toggle &lt;code&gt;recommend_pg_upgrade&lt;&#x2F;code&gt; to false for now&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1613&quot;&gt;16.1.3&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;125261&quot; title=&quot;Geo: Backport design repos verification bug fix&quot;&gt;Geo: Backport design repos verification bug fix&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;125316&quot; title=&quot;Geo - Backport wiki repository verification fix&quot;&gt;Geo - Backport wiki repository verification fix&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;126783&quot; title=&quot;Fix FOUC when new sidebar enabled&quot;&gt;Fix FOUC when new sidebar enabled&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;127515&quot; title=&quot;[16.1] Repair the trigger for Release Environments&quot;&gt;Repair the trigger for Release Environments&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;127517&quot; title=&quot;Disable IAT verification by default&quot;&gt;Disable IAT verification by default&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;127402&quot; title=&quot;Backport fix for pending direct uploads completion to 16.1&quot;&gt;Backport fix for pending direct uploads completion to 16.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;127778&quot; title=&quot;BitBucket Server Importer - Preserve PR (MR) reviewers&quot;&gt;BitBucket Server Importer - Preserve PR (MR) reviewers&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7050&quot; title=&quot;Fix pg-upgrade failure on Geo secondary nodes [16.1]&quot;&gt;Fix pg-upgrade failure on Geo secondary nodes [16.1]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7034&quot; title=&quot;Don&#x27;t 500 when pages tries to serve a chunked file&quot;&gt;Don&#x27;t 500 when pages tries to serve a chunked file&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;1608&quot;&gt;16.0.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;127518&quot; title=&quot;Disable IAT verification by default&quot;&gt;Disable IAT verification by default&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;7051&quot; title=&quot;Fix pg-upgrade failure on Geo secondary nodes [16.0]&quot;&gt;Fix pg-upgrade failure on Geo secondary nodes [16.0]&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.1.2, 16.0.7, and 15.11.11</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/07/05/security-release-gitlab-16-1-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/07/05/security-release-gitlab-16-1-2-released/</id>
<published>2023-07-05T00:00:00+00:00</published>
<updated>2023-07-05T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 16.1.2, 16.0.7, and 15.11.11 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab Enterprise Edition installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all GitLab EE installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#a-user-can-change-the-name-and-path-of-some-public-gitlab-groups&quot;&gt;A user can change the name and path of some public GitLab groups&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;a-user-can-change-the-name-and-path-of-some-public-gitlab-groups&quot;&gt;A user can change the name and path of some public GitLab groups&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;912 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 8.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3484&quot;&gt;CVE-2023-3484&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;zeb0x01&quot;&gt;zeb0x01&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;p&gt;This security release also includes the following non-security patches.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;1612&quot;&gt;16.1.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;124818&quot; title=&quot;Fix environments tab is empty after upgrading to 16.1&quot;&gt;Fix environments tab is empty after upgrading to 16.1&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;125074&quot; title=&quot;Fix Bitbucket Cloud Importer: 16.1 backport&quot;&gt;Fix Bitbucket Cloud Importer: 16.1 backport&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;125111&quot; title=&quot;Fix GitHub Importer: 16.1 Backport&quot;&gt;Fix GitHub Importer: 16.1 Backport&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;125116&quot; title=&quot;Fix overlapping titles in wiki sidebar navigation&quot;&gt;Fix overlapping titles in wiki sidebar navigation&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;124613&quot; title=&quot;Reset webpack path for Mermaid iFrames&quot;&gt;Reset webpack path for Mermaid iFrames&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.1.1, 16.0.6, and 15.11.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/06/29/security-release-gitlab-16-1-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/06/29/security-release-gitlab-16-1-1-released/</id>
<published>2023-06-29T00:00:00+00:00</published>
<updated>2023-06-29T00:00:00+00:00</updated>
<author>
<name>Nikhil George</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 16.1.1, 16.0.6, and 15.11.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-via-epicreferencefilter-in-any-markdown-fields&quot;&gt;ReDoS via EpicReferenceFilter in any Markdown fields&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#new-commits-to-private-projects-visible-in-forks-created-while-project-was-public&quot;&gt;New commits to private projects visible in forks created while project was public&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#code-owners-approvals-are-not-removed-allowing-merge-into-protected-branches&quot;&gt;Code Owners approvals are not removed allowing merge into protected branches&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-leak-masked-webhook-secrets-by-manipulating-url-masking&quot;&gt;Maintainer can leak masked webhook secrets by manipulating URL masking&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#information-disclosure-of-project-import-errors&quot;&gt;Information disclosure of project import errors&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#sensitive-information-disclosure-via-value-stream-analytics-controller&quot;&gt;Sensitive information disclosure via value stream analytics controller&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypassing-code-owners-branch-protection-rule-in-gitlab&quot;&gt;Bypassing Code Owners branch protection rule in GitLab&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#html-injection-in-email-address&quot;&gt;HTML injection in email address&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#webhook-token-leaked-in-sidekiq-logs-if-log-format-is-default&quot;&gt;Webhook token leaked in Sidekiq logs if log format is &#x27;default&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#private-email-address-of-service-desk-issue-creator-disclosed-via-issues-api&quot;&gt;Private email address of service desk issue creator disclosed via issues API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;redos-via-epicreferencefilter-in-any-markdown-fields&quot;&gt;ReDoS via EpicReferenceFilter in any Markdown fields&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;902 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3424&quot;&gt;CVE-2023-3424&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryhmnlfj&quot;&gt;ryhmnlfj&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;new-commits-to-private-projects-visible-in-forks-created-while-project-was-public&quot;&gt;New commits to private projects visible in forks created while project was public&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;905 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2190&quot;&gt;CVE-2023-2190&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;code-owners-approvals-are-not-removed-allowing-merge-into-protected-branches&quot;&gt;Code Owners approvals are not removed allowing merge into protected branches&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;907 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches due to a CODEOWNERS approval bug. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3444&quot;&gt;CVE-2023-3444&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;glan1k&quot;&gt;glan1k&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-can-leak-masked-webhook-secrets-by-manipulating-url-masking&quot;&gt;Maintainer can leak masked webhook secrets by manipulating URL masking&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;908 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions. This addresses an incomplete fix for CVE-2023-0838. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2620&quot;&gt;CVE-2023-2620&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-of-project-import-errors&quot;&gt;Information disclosure of project import errors&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;903 --&gt;

&lt;p&gt;An information disclosure issue in GitLab CE&#x2F;EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3362&quot;&gt;CVE-2023-3362&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;rodrigo.tomonari&quot;&gt;Rodrigo Tomonari&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sensitive-information-disclosure-via-value-stream-analytics-controller&quot;&gt;Sensitive information disclosure via value stream analytics controller&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;898 --&gt;

&lt;p&gt;A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issues and merge requests. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3102&quot;&gt;CVE-2023-3102&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypassing-code-owners-branch-protection-rule-in-gitlab&quot;&gt;Bypassing Code Owners branch protection rule in GitLab&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;894 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and merge to a protected branch. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2576&quot;&gt;CVE-2023-2576&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;inspector-ambitious&quot;&gt;inspector-ambitious&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;html-injection-in-email-address&quot;&gt;HTML injection in email address&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;900 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2200&quot;&gt;CVE-2023-2200&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;cryptopone&quot;&gt;cryptopone&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;webhook-token-leaked-in-sidekiq-logs-if-log-format-is-default&quot;&gt;Webhook token leaked in Sidekiq logs if log format is &#x27;default&#x27;&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;904 --&gt;

&lt;p&gt;An information disclosure issue in Gitlab CE&#x2F;EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to &lt;code&gt;default&lt;&#x2F;code&gt;. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:L&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-3363&quot;&gt;CVE-2023-3363&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was reported by Martin Vaisset from MyMoneyBank.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-email-address-of-service-desk-issue-creator-disclosed-via-issues-api&quot;&gt;Private email address of service desk issue creator disclosed via issues API&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;897 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user who created a service desk issue. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1936&quot;&gt;CVE-2023-1936&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ricardobrito&quot;&gt;ricardobrito&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;
&lt;p&gt;Mattermost has been updated to version 7.10.2 in GitLab 16.0.6 and version 7.9.4 in GitLab 15.11.10 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-xmlsoftlibxml2-to-version-2104&quot;&gt;Update xmlsoft&#x2F;libxml2 to version 2.10.4&lt;&#x2F;h2&gt;
&lt;p&gt;xmlsoft&#x2F;libxml2 has been updated to version 2.10.4 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 16.0.2, 15.11.7, and 15.10.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/06/05/security-release-gitlab-16-0-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/06/05/security-release-gitlab-16-0-2-released/</id>
<published>2023-06-05T00:00:00+00:00</published>
<updated>2023-06-05T00:00:00+00:00</updated>
<author>
<name>Rohit Shambhuni</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 16.0.2, 15.11.7, and 15.10.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-with-csp-bypass-in-merge-requests&quot;&gt;Stored-XSS with CSP-bypass in Merge requests&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-via-frontmatterfilter-in-any-markdown-fields&quot;&gt;ReDoS via FrontMatterFilter in any Markdown fields&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-via-inlinedifffilter-in-any-markdown-fields&quot;&gt;ReDoS via InlineDiffFilter in any Markdown fields&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-via-dollarmathpostfilter-in-markdown-fields&quot;&gt;ReDoS via DollarMathPostFilter in Markdown fields&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dos-via-malicious-test-report-artifacts&quot;&gt;DoS via malicious test report artifacts&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#restricted-ip-addresses-can-clone-repositories-of-public-projects&quot;&gt;Restricted IP addresses can clone repositories of public projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#reflected-xss-in-report-abuse-functionality&quot;&gt;Reflected XSS in Report Abuse Functionality&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#privilege-escalation-from-maintainer-to-owner-by-importing-members-from-a-project&quot;&gt;Privilege escalation from maintainer to owner by importing members from a project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypassing-tags-protection-in-gitlab&quot;&gt;Bypassing tags protection in GitLab&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-using-multiple-labels-with-arbitrarily-large-descriptions&quot;&gt;Denial of Service using multiple labels with arbitrarily large descriptions&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ability-to-use-an-unverified-email-for-public-and-commit-emails&quot;&gt;Ability to use an unverified email for public and commit emails&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#open-redirection-through-http-response-splitting&quot;&gt;Open Redirection Through HTTP Response Splitting&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#disclosure-of-issue-notes-to-an-unauthorized-user-when-exporting-a-project&quot;&gt;Disclosure of issue notes to an unauthorized user when exporting a project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ambiguous-branch-name-exploitation&quot;&gt;Ambiguous branch name exploitation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;stored-xss-with-csp-bypass-in-merge-requests&quot;&gt;Stored-XSS with CSP-bypass in Merge requests&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;893 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2442&quot;&gt;CVE-2023-2442&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;redos-via-frontmatterfilter-in-any-markdown-fields&quot;&gt;ReDoS via FrontMatterFilter in any Markdown fields&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;888 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2199&quot;&gt;CVE-2023-2199&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryhmnlfj&quot;&gt;ryhmnlfj&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;redos-via-inlinedifffilter-in-any-markdown-fields&quot;&gt;ReDoS via InlineDiffFilter in any Markdown fields&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;887 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2198&quot;&gt;CVE-2023-2198&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryhmnlfj&quot;&gt;ryhmnlfj&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;redos-via-dollarmathpostfilter-in-markdown-fields&quot;&gt;ReDoS via DollarMathPostFilter in Markdown fields&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;881 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted payloads to the preview_markdown endpoint. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2132&quot;&gt;CVE-2023-2132&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryhmnlfj&quot;&gt;ryhmnlfj&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;dos-via-malicious-test-report-artifacts&quot;&gt;DoS via malicious test report artifacts&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;850 --&gt;

&lt;p&gt;A denial of service issue was discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0121&quot;&gt;CVE-2023-0121&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;luryus&quot;&gt;luryus&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;restricted-ip-addresses-can-clone-repositories-of-public-projects&quot;&gt;Restricted IP addresses can clone repositories of public projects&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;889 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker can clone a repository from a public project, from a disallowed IP, even after the top-level group has enabled IP restrictions on the group. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2589&quot;&gt;CVE-2023-2589&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ali_shehab&quot;&gt;ali_shehab&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;reflected-xss-in-report-abuse-functionality&quot;&gt;Reflected XSS in Report Abuse Functionality&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;875 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform arbitrary actions on behalf of victims. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2015&quot;&gt;CVE-2023-2015&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;akadrian&quot;&gt;akadrian&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;privilege-escalation-from-maintainer-to-owner-by-importing-members-from-a-project&quot;&gt;Privilege escalation from maintainer to owner by importing members from a project&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;892 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 4.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2485&quot;&gt;CVE-2023-2485&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypassing-tags-protection-in-gitlab&quot;&gt;Bypassing tags protection in GitLab&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;890 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2001&quot;&gt;CVE-2023-2001&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;inspector-ambitious&quot;&gt;inspector-ambitious&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-using-multiple-labels-with-arbitrarily-large-descriptions&quot;&gt;Denial of Service using multiple labels with arbitrarily large descriptions&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;880 --&gt;

&lt;p&gt;A lack of length validation in GitLab CE&#x2F;EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0921&quot;&gt;CVE-2023-0921&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;cryptopone&quot;&gt;cryptopone&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ability-to-use-an-unverified-email-for-public-and-commit-emails&quot;&gt;Ability to use an unverified email for public and commit emails&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;867 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sending a specifically crafted request on user update settings. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1204&quot;&gt;CVE-2023-1204&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;theluci&quot;&gt;theluci&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h2 id=&quot;open-redirection-through-http-response-splitting&quot;&gt;Open Redirection Through HTTP Response Splitting&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;885 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0508&quot;&gt;CVE-2023-0508&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;akadrian&quot;&gt;akadrian&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-issue-notes-to-an-unauthorized-user-when-exporting-a-project&quot;&gt;Disclosure of issue notes to an unauthorized user when exporting a project&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;854 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. It was possible to disclose issue notes to an unauthorized user at project export. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1825&quot;&gt;CVE-2023-1825&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ambiguous-branch-name-exploitation&quot;&gt;Ambiguous branch name exploitation&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;886 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2013&quot;&gt;CVE-2023-2013&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;inspector-ambitious&quot;&gt;inspector-ambitious&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;p&gt;Mattermost has been updated to version 7.9.3 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-ncurses&quot;&gt;Update Ncurses&lt;&#x2F;h2&gt;

&lt;p&gt;Ncurses has been updated to version 6.4-20230225 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-postgresql&quot;&gt;Update PostgreSQL&lt;&#x2F;h2&gt;

&lt;p&gt;PostgreSQL has been updated to versions 12.14 and 13.11 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;p&gt;This security release also includes the following non-security patches.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;1602&quot;&gt;16.0.2&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;121518&quot;&gt;Update the upgrade path for 15.11 and 16.x&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;121470&quot;&gt;Introduce parallelised BitBucket Server Importer&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;121872&quot;&gt;Fix Sidekiq crash when gitlab.yml contains UTF-8 characters&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;121745&quot;&gt;Revert &quot;Remove legacy project routes&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;121843&quot;&gt;Merge branch &#x27;344594-fix-migration&#x27; into &#x27;16-0-stable-ee&#x27;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;121606&quot;&gt;Do not run notify-package-and-test-failure on sec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;121894&quot;&gt;Add task to fix migrations for 15.11 upgrades (16.0 Stable)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;122345&quot;&gt;Do not requeue the indexing worker if failures occur&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;6918&quot;&gt;Stop supporting and using deprecated Gitaly configuration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;15117&quot;&gt;15.11.7&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;-&#x2F;merge_requests&#x2F;5868&quot;&gt;Backport &#x27;Remove uncessary fields from pack-objects cache key computation&#x27; to 15.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;121608&quot;&gt;Do not run notify-package-and-test-failure on sec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;121895&quot;&gt;Add task to fix migrations for 15.11 upgrades (15.11 Stable)&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;15108&quot;&gt;15.10.8&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1397&quot;&gt;Update redis-namespace dependency in MailRoom&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1406&quot;&gt;Skip weak dependencies during install on UBI&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1404&quot;&gt;Fix restore with azcopy&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;120163&quot;&gt;Backport &#x27;fix-container-replication&#x27; into 15.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;121305&quot;&gt;Convert some regex to use Gitlab::UntrustedRegexp&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;121609&quot;&gt;Do not run notify-package-and-test-failure on sec&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;6887&quot;&gt;Add SMTP timeout configuration options&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;6877&quot;&gt;Validate that SMTP settings do not enable both TLS and STARTTLS&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 16.0.1</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/05/23/critical-security-release-gitlab-16-0-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/05/23/critical-security-release-gitlab-16-0-1-released/</id>
<published>2023-05-23T00:00:00+00:00</published>
<updated>2023-05-23T00:00:00+00:00</updated>
<author>
<name>Rohit Shambhuni</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing version 16.0.1 for GitLab Community Edition (CE) and Enterprise Edition (EE). It is only required for installations running 16.0.0. Earlier versions are not affected.&lt;&#x2F;p&gt;

&lt;p&gt;This version contains important security fixes, and we strongly recommend that GitLab installations running 16.0.0 be upgraded immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-file-read-via-uploads-path-traversal&quot;&gt;Arbitrary file read via uploads path traversal&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;arbitrary-file-read-via-uploads-path-traversal&quot;&gt;Arbitrary file read via uploads path traversal&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;891 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read 
arbitrary files on the server when an attachment exists in a public project nested within at least five groups. This is a critical severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 10.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2825&quot;&gt;CVE-2023-2825&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pwnie&quot;&gt;pwnie&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Coordinated Security Release: 15.11.3, 15.10.7, 15.9.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/05/10/security-release-gitlab-15-11-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/05/10/security-release-gitlab-15-11-3-released/</id>
<published>2023-05-10T00:00:00+00:00</published>
<updated>2023-05-10T00:00:00+00:00</updated>
<author>
<name>Nick Malcolm</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.11.3, 15.10.7, 15.9.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). This is a coordinated security release, aligning with a disclosure date provided by Git.&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are three types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), ad-hoc security releases for critical vulnerabilities, as well as coordinated security releases. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#smuggling-code-changes-via-merge-requests-with-refs-replace&quot;&gt;Smuggling code changes via merge requests with refs&#x2F;replace&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;smuggling-code-changes-via-merge-requests-with-refsreplace&quot;&gt;Smuggling code changes via merge requests with refs&#x2F;replace&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitaly&#x2F;-&#x2F;issues&#x2F;11 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs&#x2F;replace to smuggle content into a merge request which would not be visible during review in the UI. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.3 Medium). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2181&quot;&gt;CVE-2023-2181&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;inspector-ambitious&quot;&gt;inspector-ambitious&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non-security patches&lt;&#x2F;h2&gt;

&lt;p&gt;This security release also includes the following non-security patches.&lt;&#x2F;p&gt;

&lt;p&gt;Into 15.11.3:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;119164&quot;&gt;Restrict bigint cleanup migrations to GitLab.com only&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;119520&quot;&gt;Revert migration squash that breaks 15.11&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;119742&quot;&gt;[15.11] ci: Fix omnibus trigger target branch for MR targeting stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;119456&quot;&gt;Fix custom template import permission&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;119374&quot;&gt;[15.11] Fix for the rebase merge request state being shown incorrectly&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;119299&quot;&gt;Back with UNSTRUCTURED_RAILS_LOG environment variable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;120028&quot;&gt;Fix issue description keeping autosave after save&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;Into 15.10.7:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;119744&quot;&gt;[15.10] ci: Fix omnibus trigger target branch for MR targeting stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;119452&quot;&gt;Fix custom template import permission&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;119376&quot;&gt;[15.10] Fix for the rebase merge request state being shown incorrectly&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;Into 15.9.8:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;119746&quot;&gt;[15.9] ci: Fix omnibus trigger target branch for MR targeting stable branches&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;119377&quot;&gt;[15.9] Fix for the rebase merge request state being shown incorrectly&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 15.11.2, 15.10.6, and 15.9.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/05/05/critical-security-release-gitlab-15-11-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/05/05/critical-security-release-gitlab-15-11-2-released/</id>
<published>2023-05-05T00:00:00+00:00</published>
<updated>2023-05-05T00:00:00+00:00</updated>
<author>
<name>Rohit Shambhuni</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.11.2, 15.10.6, and 15.9.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#malicious-runner-attachment-via-graphql&quot;&gt;Malicious Runner Attachment via GraphQL&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;malicious-runner-attachment-via-graphql&quot;&gt;Malicious Runner Attachment via GraphQL&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;884 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 15.11 before 15.11.2. Under certain conditions, any GitLab user account on the instance may use a GraphQL endpoint to attach a malicious runner to any project on the instance. This is a critical severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 9.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2478&quot;&gt;CVE-2023-2478&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;p&gt;This security release also includes the following non-security patches.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;15106&quot;&gt;15.10.6&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;118703&quot;&gt;Backport IP enforcement FF to 15.10&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;6824&quot;&gt;Bundle libarchive in the package&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 15.11.1, 15.10.5, and 15.9.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/05/02/security-release-gitlab-15-11-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/05/02/security-release-gitlab-15-11-1-released/</id>
<published>2023-05-02T00:00:00+00:00</published>
<updated>2023-05-02T00:00:00+00:00</updated>
<author>
<name>Dominic Couture</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.11.1, 15.10.5, and 15.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#privilege-escalation-for-external-users-when-oidc-is-enabled-under-certain-conditions&quot;&gt;Privilege escalation for external users when OIDC is enabled under certain conditions&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#account-takeover-through-open-redirect-for-group-saml-accounts&quot;&gt;Account takeover through open redirect for Group SAML accounts&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#users-on-banned-ip-addresses-can-still-commit-to-projects&quot;&gt;Users on banned IP addresses can still commit to projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#user-with-developer-role-group-can-modify-protected-branches-setting-on-imported-project-and-leak-group-cicd-variables&quot;&gt;User with developer role (group) can modify Protected branches setting on imported project and leak group CI&#x2F;CD variables&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#the-gitlab-web-interface-does-not-guarantee-file-integrity-when-downloading-source-code-or-installation-packages-from-a-tag-or-from-a-release&quot;&gt;The GitLab web interface does not guarantee file integrity when downloading source code or installation packages from a tag or from a release.&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#banned-group-member-continues-to-have-access-to-the-public-projects-of-a-public-group-with-the-access-level-as-same-as-before-the-ban&quot;&gt;Banned group member continues to have access to the public projects of a public group with the access level as same as before the ban.&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#the-main-branch-of-a-repository-with-a-specially-designed-name-allows-an-attacker-to-create-repositories-with-malicious-code&quot;&gt;The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#xss-and-content-injection-and-iframe-injection-when-viewing-raw-files-under-specific-circumstances&quot;&gt;XSS and content injection and iframe injection when viewing raw files under specific circumstances&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#authenticated-users-can-find-other-users-by-their-private-email&quot;&gt;Authenticated users can find other users by their private email&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;privilege-escalation-for-external-users-when-oidc-is-enabled-under-certain-conditions&quot;&gt;Privilege escalation for external users when OIDC is enabled under certain conditions&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;871 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as &#x27;external&#x27; to become &#x27;regular&#x27; users thus leading to privilege escalation for those users. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2182&quot;&gt;CVE-2023-2182&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was reported to us by a customer.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;account-takeover-through-open-redirect-for-group-saml-accounts&quot;&gt;Account takeover through open redirect for Group SAML accounts&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;876 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access tokens granted for 3rd party Group SAML SSO logins. This feature isn&#x27;t enabled by default. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1965&quot;&gt;CVE-2023-1965&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;If you are seeing an unexpected redirect after sign in through SAML, ensure the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;saml.html#additional-configuration-for-saml-apps-on-your-idp&quot;&gt;&lt;code&gt;RelayState&lt;&#x2F;code&gt; setting&lt;&#x2F;a&gt; on the identity provider side is set to a valid URL.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;bull&quot;&gt;bull&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;users-on-banned-ip-addresses-can-still-commit-to-projects&quot;&gt;Users on banned IP addresses can still commit to projects&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects even from a restricted IP address. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1621&quot;&gt;CVE-2023-1621&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-with-developer-role-group-can-modify-protected-branches-setting-on-imported-project-and-leak-group-cicd-variables&quot;&gt;User with developer role (group) can modify Protected branches setting on imported project and leak group CI&#x2F;CD variables&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI&#x2F;CD variables. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 6.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-2069&quot;&gt;CVE-2023-2069&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;js_noob&quot;&gt;js_noob&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;p&gt;Fix for this issue was to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;387891&quot;&gt;restrict imports to users with Maintainer and above role&lt;&#x2F;a&gt;. That however affected usage of &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;project&#x2F;index.html#create-a-project-from-a-custom-template&quot;&gt;custom project templates, on group and instance levels&lt;&#x2F;a&gt; as well, and Developers are no longer able to create projects from custom templates. We are working on the fix, that will allow users with Developer role to create projects from templates again, and will release a patch with this fix to GitLab versions 15.11.1, 15.10.5.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;the-gitlab-web-interface-does-not-guarantee-file-integrity-when-downloading-source-code-or-installation-packages-from-a-tag-or-from-a-release&quot;&gt;The GitLab web interface does not guarantee file integrity when downloading source code or installation packages from a tag or from a release.&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;877 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1178&quot;&gt;CVE-2023-1178&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;banned-group-member-continues-to-have-access-to-the-public-projects-of-a-public-group-with-the-access-level-as-same-as-before-the-ban&quot;&gt;Banned group member continues to have access to the public projects of a public group with the access level as same as before the ban.&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;868 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to have access to the public projects of a public group even after being banned from the public group by the owner. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 4.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0805&quot;&gt;CVE-2023-0805&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;albatraoz&quot;&gt;albatraoz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;the-main-branch-of-a-repository-with-a-specially-designed-name-allows-an-attacker-to-create-repositories-with-malicious-code&quot;&gt;The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;873 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on their systems. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 4.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0756&quot;&gt;CVE-2023-0756&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-and-content-injection-and-iframe-injection-when-viewing-raw-files-under-specific-circumstances&quot;&gt;XSS and content injection and iframe injection when viewing raw files under specific circumstances&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;869 --&gt;

&lt;p&gt;A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in &quot;raw&quot; mode, it can be made to render as HTML if viewed under specific circumstances. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1836&quot;&gt;CVE-2023-1836&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;authenticated-users-can-find-other-users-by-their-private-email&quot;&gt;Authenticated users can find other users by their private email&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;878 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab account on an instance. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4376&quot;&gt;CVE-2022-4376&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shells3c&quot;&gt;shells3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;p&gt;Mattermost has been updated to versions 7.9.1 and 7.9.2 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;patch-openssl&quot;&gt;Patch OpenSSL&lt;&#x2F;h2&gt;

&lt;p&gt;A patch has been applied to mitigate CVE-2023-0464 in GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;patch-grafana&quot;&gt;Patch Grafana&lt;&#x2F;h2&gt;

&lt;p&gt;A patch has been applied to mitigate CVE-2023-1410 in GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;

&lt;p&gt;This security release also includes the following non-security patches.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;15111&quot;&gt;15.11.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;118637&quot;&gt;15.11: Fix Web IDE Beta icons not loading in Safari&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;118956&quot;&gt;Move approved filter behind &lt;code&gt;mr_approved_filter&lt;&#x2F;code&gt; feature flag&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;118849&quot;&gt;Fix search cron worker when indexing is disabled&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;15105&quot;&gt;15.10.5&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;118219&quot;&gt;Use proxied_site for geo proxied clone urls&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 15.10.1, 15.9.4, and 15.8.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/</id>
<published>2023-03-30T00:00:00+00:00</published>
<updated>2023-03-30T00:00:00+00:00</updated>
<author>
<name>Greg Alfaro</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.10.1, 15.9.4, and 15.8.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cross-site-scripting-in-maximum-page-reached-page&quot;&gt;Cross-site scripting in &quot;Maximum page reached&quot; page&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#private-project-guests-can-read-new-changes-using-a-fork&quot;&gt;Private project guests can read new changes using a fork&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#mirror-repository-error-reveals-password-in-settings-ui&quot;&gt;Mirror repository error reveals password in Settings UI&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dos-and-high-resource-consumption-of-prometheus-server-through-abuse-of-prometheus-integration-proxy-endpoint&quot;&gt;DOS and high resource consumption of Prometheus server through abuse of Prometheus integration proxy endpoint&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthenticated-users-can-view-environment-names-from-public-projects-limited-to-project-members-only&quot;&gt;Unauthenticated users can view Environment names from public projects limited to project members only&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#copying-information-to-the-clipboard-could-lead-to-the-execution-of-unexpected-commands&quot;&gt;Copying information to the clipboard could lead to the execution of unexpected commands&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-leak-masked-webhook-secrets-by-adding-a-new-parameter-to-the-webhook-url&quot;&gt;Maintainer can leak masked webhook secrets by adding a new parameter to the webhook URL&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-html-injection-possible-when-soft_email_confirmation-feature-flag-is-enabled-in-the-latest-release&quot;&gt;Arbitrary HTML injection possible when :soft_email_confirmation feature flag is enabled in the latest release&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#framing-of-arbitrary-content-leading-to-open-redirects-on-any-page-allowing-user-controlled-markdown&quot;&gt;Framing of arbitrary content (leading to open redirects) on any page allowing user controlled markdown&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#mr-for-security-reports-are-available-to-everyone&quot;&gt;MR for security reports are available to everyone&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#api-timeout-when-searching-for-group-issues&quot;&gt;API timeout when searching for group issues&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorised-user-can-add-child-epics-linked-to-victims-epic-in-an-unrelated-group&quot;&gt;Unauthorised user can add child epics linked to victim&#x27;s epic in an unrelated group&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#gitlab-search-allows-to-leak-internal-notes&quot;&gt;GitLab search allows to leak internal notes&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ambiguous-branch-name-exploitation-in-gitlab&quot;&gt;Ambiguous branch name exploitation in GitLab&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-permissions-checks-for-moving-an-issue&quot;&gt;Improper permissions checks for moving an issue&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#private-project-branches-names-can-be-leaked-through-a-fork&quot;&gt;Private project branches names can be leaked through a fork&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;cross-site-scripting-in-maximum-page-reached-page&quot;&gt;Cross-site scripting in &quot;Maximum page reached&quot; page&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;849 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10  before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 6.1)). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3513&quot;&gt;CVE-2022-3513&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryotak&quot;&gt;ryotak&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-project-guests-can-read-new-changes-using-a-fork&quot;&gt;Private project guests can read new changes using a fork&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;838 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10  before 15.10.1. It was possible that a project member demoted to a user role could read project updates by doing a diff with a pre-existing fork. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0485&quot;&gt;CVE-2023-0485&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shells3c&quot;&gt;shells3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;mirror-repository-error-reveals-password-in-settings-ui&quot;&gt;Mirror repository error reveals password in Settings UI&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;834 --&gt;

&lt;p&gt;An information disclosure vulnerability has been discovered in GitLab EE&#x2F;CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all  versions starting from 15.10  before 15.10.1 will allow an admin to leak password from repository mirror configuration. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1098&quot;&gt;CVE-2023-1098&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;tennox_&quot;&gt;tennox_&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;dos-and-high-resource-consumption-of-prometheus-server-through-abuse-of-prometheus-integration-proxy-endpoint&quot;&gt;DOS and high resource consumption of Prometheus server through abuse of Prometheus integration proxy endpoint&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;861 --&gt;

&lt;p&gt;A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 5.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1733&quot;&gt;CVE-2023-1733&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthenticated-users-can-view-environment-names-from-public-projects-limited-to-project-members-only&quot;&gt;Unauthenticated users can view Environment names from public projects limited to project members only&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;837 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10  before 15.10.1, allowing reading of environment names supposed to be restricted to project members only. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0319&quot;&gt;CVE-2023-0319&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;copying-information-to-the-clipboard-could-lead-to-the-execution-of-unexpected-commands&quot;&gt;Copying information to the clipboard could lead to the execution of unexpected commands&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;858 --&gt;

&lt;p&gt;An issue was identified in GitLab CE&#x2F;EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters are copied from clipboard, allowing unexpected commands to be executed on the victim machine. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1708&quot;&gt;CVE-2023-1708&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-can-leak-masked-webhook-secrets-by-adding-a-new-parameter-to-the-webhook-url&quot;&gt;Maintainer can leak masked webhook secrets by adding a new parameter to the webhook URL&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;856 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0838&quot;&gt;CVE-2023-0838&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;0xn3va&quot;&gt;0xn3va&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-html-injection-possible-when-soft_email_confirmation-feature-flag-is-enabled-in-the-latest-release&quot;&gt;Arbitrary HTML injection possible when :soft_email_confirmation feature flag is enabled in the latest release&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;840 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. On certain instances, a stored XSS was possible via a malicious email address, which only affected the admins when they tried to impersonate the account with the malicious payload. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0523&quot;&gt;CVE-2023-0523&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;cryptopone&quot;&gt;cryptopone&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;framing-of-arbitrary-content-leading-to-open-redirects-on-any-page-allowing-user-controlled-markdown&quot;&gt;Framing of arbitrary content (leading to open redirects) on any page allowing user controlled markdown&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from all versions starting from 15.7 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10  before 15.10.1. It was possible to iframe arbitrary origins in the browser via specially crafted markdown on any page. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:N&#x2F;I:L&#x2F;A:L&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0155&quot;&gt;CVE-2023-0155&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;mr-for-security-reports-are-available-to-everyone&quot;&gt;MR for security reports are available to everyone&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;845 --&gt;

&lt;p&gt;Improper authorization in GitLab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in merge requests. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1167&quot;&gt;CVE-2023-1167&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by GitLab team member &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;minac&quot;&gt;@minac&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;api-timeout-when-searching-for-group-issues&quot;&gt;API timeout when searching for group issues&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;851 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeout could be triggered if a specific HTML payload was used in the issue description. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1787&quot;&gt;CVE-2023-1787&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by a GitLab team member.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorised-user-can-add-child-epics-linked-to-victims-epic-in-an-unrelated-group&quot;&gt;Unauthorised user can add child epics linked to victim&#x27;s epic in an unrelated group&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;857 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10  before 15.10.1. It was possible for an unauthorised user to add child epics linked to a victim&#x27;s epic in an unrelated group. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1417&quot;&gt;CVE-2023-1417&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;cryptopone&quot;&gt;cryptopone&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-search-allows-to-leak-internal-notes&quot;&gt;GitLab search allows to leak internal notes&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;852 --&gt;

&lt;p&gt;A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allows an attacker to view the count of internal notes for a given issue. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1710&quot;&gt;CVE-2023-1710&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shells3c&quot;&gt;shells3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ambiguous-branch-name-exploitation-in-gitlab&quot;&gt;Ambiguous branch name exploitation in GitLab&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;846 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0450&quot;&gt;CVE-2023-0450&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;inspector-ambitious&quot;&gt;inspector-ambitious&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-permissions-checks-for-moving-an-issue&quot;&gt;Improper permissions checks for moving an issue&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;835 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue from an epic. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1071&quot;&gt;CVE-2023-1071&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-project-branches-names-can-be-leaked-through-a-fork&quot;&gt;Private project branches names can be leaked through a fork&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;826 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10  before 15.10.1. It was possible to disclose the branch names when an attacker has a fork of a project that was switched to private. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3375&quot;&gt;CVE-2022-3375&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shells3c&quot;&gt;shells3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;84 --&gt;

&lt;p&gt;Mattermost has been updated to versions 7.7.3 and 7.8.2 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-curl&quot;&gt;Update curl&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;82 --&gt;

&lt;p&gt;Curl has been updated to version 8.0.1 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-redis&quot;&gt;Update redis&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;83 --&gt;

&lt;p&gt;Redis has been updated to version 6.2.11 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-openssl&quot;&gt;Update OpenSSL&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;81 --&gt;

&lt;p&gt;OpenSSL has been updated to version &#x27;OpenSSL_1_1_1t&#x27; in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non Security Patches&lt;&#x2F;h2&gt;
&lt;p&gt;This security release also includes the following non-security patches.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;into-15101&quot;&gt;Into 15.10.1&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1347&quot;&gt;Cherry pick &quot;Use the ubi packaged libedit-devel&quot; to 15-10-stable&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;115465&quot;&gt;Don&#x27;t autofocus comment field with content editor&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;115579&quot;&gt;Sync security policy rule schedules that may have been deleted by bug&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;115668&quot;&gt;Fix issue dashboard returning issues from archived projects&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;into-1594&quot;&gt;Into 15.9.4&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;114287&quot;&gt;Resolve &quot;Duplicate todo is created for already mentioned user&quot;&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 15.9.2, 15.8.4, and 15.7.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/03/02/security-release-gitlab-15-9-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/03/02/security-release-gitlab-15-9-2-released/</id>
<published>2023-03-02T00:00:00+00:00</published>
<updated>2023-03-02T00:00:00+00:00</updated>
<author>
<name>Greg Myers</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.9.2, 15.8.4, and 15.7.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;?sort=created_date&amp;amp;state=closed&amp;amp;label_name%5B%5D=bug%3A%3Avulnerability&amp;amp;confidential=no&amp;amp;first_page_size=100&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-via-kroki-diagram&quot;&gt;Stored XSS via Kroki diagram&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#prometheus-integration-google-iap-details-are-not-hidden-may-leak-account-details-from-instancegroupproject-settings&quot;&gt;Prometheus integration Google IAP details are not hidden, may leak account details from instance&#x2F;group&#x2F;project settings&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-validation-of-sso-and-scim-tokens-while-managing-groups&quot;&gt;Improper validation of SSO and SCIM tokens while managing groups&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-leak-datadog-api-key-by-changing-datadog-site&quot;&gt;Maintainer can leak Datadog API key by changing Datadog site&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#clipboard-based-xss-in-the-title-field-of-work-items&quot;&gt;Clipboard based XSS in the title field of work items&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-user-right-checks-for-personal-snippets&quot;&gt;Improper user right checks for personal snippets&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#release-description-visible-in-public-projects-despite-release-set-as-project-members-only&quot;&gt;Release Description visible in public projects despite release set as project members only&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-integration-settings-sensitive-information-exposed-to-project-maintainers&quot;&gt;Group integration settings sensitive information exposed to project maintainers&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improve-pagination-limits-for-commits&quot;&gt;Improve pagination limits for commits&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#gitlab-open-redirect-vulnerability&quot;&gt;Gitlab Open Redirect Vulnerability&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-may-become-an-owner-of-a-project&quot;&gt;Maintainer may become an Owner of a project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;stored-xss-via-kroki-diagram&quot;&gt;Stored XSS via Kroki diagram&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;833 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0050&quot;&gt;CVE-2023-0050&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;prometheus-integration-google-iap-details-are-not-hidden-may-leak-account-details-from-instancegroupproject-settings&quot;&gt;Prometheus integration Google IAP details are not hidden, may leak account details from instance&#x2F;group&#x2F;project settings&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;844 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 6.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4289&quot;&gt;CVE-2022-4289&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-validation-of-sso-and-scim-tokens-while-managing-groups&quot;&gt;Improper validation of SSO and SCIM tokens while managing groups&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;819 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it&#x27;s possible previously removed malicious maintainer or owner of the child group can still gain access to the group via SSO or a SCIM token to perform actions on the group. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4331&quot;&gt;CVE-2022-4331&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky&quot;&gt;vaib25vicky&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-can-leak-datadog-api-key-by-changing-datadog-site&quot;&gt;Maintainer can leak Datadog API key by changing Datadog site&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;843 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible for a project maintainer to extract a Datadog integration API key by modifying the site. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0483&quot;&gt;CVE-2023-0483&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;akadrian&quot;&gt;akadrian&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;clipboard-based-xss-in-the-title-field-of-work-items&quot;&gt;Clipboard based XSS in the title field of work items&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;836 --&gt;

&lt;p&gt;A issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2  A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behalf of victims at client side. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4007&quot;&gt;CVE-2022-4007&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryotak&quot;&gt;ryotak&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-user-right-checks-for-personal-snippets&quot;&gt;Improper user right checks for personal snippets&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;816 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Due to improper permissions checks an unauthorised user was able to read, add or edit a users private snippet. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3758&quot;&gt;CVE-2022-3758&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;cryptopone&quot;&gt;cryptopone&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;release-description-visible-in-public-projects-despite-release-set-as-project-members-only&quot;&gt;Release Description visible in public projects despite release set as project members only&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;832 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0223&quot;&gt;CVE-2023-0223&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-integration-settings-sensitive-information-exposed-to-project-maintainers&quot;&gt;Group integration settings sensitive information exposed to project maintainers&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;842 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. This vulnerability could allow a user to unmask the Discord Webhook URL through viewing the raw API response. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4462&quot;&gt;CVE-2022-4462&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky&quot;&gt;vaib25vicky&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improve-pagination-limits-for-commits&quot;&gt;Improve pagination limits for commits&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;839 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1072&quot;&gt;CVE-2023-1072&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;nico28&quot;&gt;Nico Jones&lt;&#x2F;a&gt; for reporting this vulnerability.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-open-redirect-vulnerability&quot;&gt;Gitlab Open Redirect Vulnerability&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;836 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15.9 prior to 15.9.2. A crafted URL could be used to redirect users to arbitrary sites. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3381&quot;&gt;CVE-2022-3381&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;burpheart&quot;&gt;burpheart&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-may-become-an-owner-of-a-project&quot;&gt;Maintainer may become an Owner of a project&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;841 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-1084&quot;&gt;CVE-2023-1084&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shubham_sohi,&quot;&gt;@shubham_sohi&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-libksba&quot;&gt;Update &lt;code&gt;libksba&lt;&#x2F;code&gt;&lt;&#x2F;h2&gt;

&lt;p&gt;&lt;code&gt;libksba&lt;&#x2F;code&gt; and &lt;code&gt;libksba_project&lt;&#x2F;code&gt; have been updated to version 1.6.3 to mitigate potential security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-gnupg&quot;&gt;Update &lt;code&gt;gnupg&lt;&#x2F;code&gt;&lt;&#x2F;h2&gt;

&lt;p&gt;&lt;code&gt;gnupg&lt;&#x2F;code&gt; has been updated to 2.2.41 to mitigate potential security issues.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 15.8.2, 15.7.7 and 15.6.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/02/14/critical-security-release-gitlab-15-8-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/02/14/critical-security-release-gitlab-15-8-2-released/</id>
<published>2023-02-14T00:00:00+00:00</published>
<updated>2023-02-14T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.8.2, 15.7.7, and 15.6.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com and GitLab Dedicated are already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#security-issues-in-git&quot;&gt;Security issues in Git&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;security-issues-in-git&quot;&gt;Security issues in Git&lt;&#x2F;h2&gt;

&lt;p&gt;This release addresses the security issues &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2023-23946&quot;&gt;CVE-2023-23946&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2023-22490&quot;&gt;CVE-2023-22490&lt;&#x2F;a&gt; in &lt;a href=&quot;https:&#x2F;&#x2F;git-scm.com&#x2F;&quot;&gt;Git&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;These vulnerabilities affect all previous versions of GitLab.&lt;&#x2F;p&gt;

&lt;p&gt;The details of these vulnerabilities are as follows:&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2023-23946&quot;&gt;CVE-2023-23946&lt;&#x2F;h3&gt;

&lt;p&gt;A user can feed a specially crafted input to &lt;code&gt;git apply&lt;&#x2F;code&gt; to overwrite a path outside the working tree.&lt;&#x2F;p&gt;

&lt;p&gt;This can be used to execute arbitrary commands in GitLab installations within GitLab&#x27;s Gitaly environment.&lt;&#x2F;p&gt;

&lt;p&gt;Credit for finding CVE-2023-23946 goes to Joern Schneeweisz of GitLab.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2023-22490&quot;&gt;CVE-2023-22490&lt;&#x2F;h3&gt;

&lt;p&gt;Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GIT_DIR&#x2F;objects directory contains symbolic links (c.f., CVE-2022-39253), the objects  directory itself may still be a symbolic link.&lt;&#x2F;p&gt;

&lt;p&gt;These two may be combined to include arbitrary files based on known paths on the victim&#x27;s filesystem within the malicious repository&#x27;s working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253.&lt;&#x2F;p&gt;

&lt;p&gt;Credit for finding CVE-2023-22490 goes to yvvdwf.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-python&quot;&gt;Update Python&lt;&#x2F;h2&gt;

&lt;p&gt;Python has been updated to version 3.9.16 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all GitLab Omnibus versions from 14.1 to 15.6.7, all 15.7 versions before 15.7.7, and all 15.8 versions before 15.8.2.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non-security patches&lt;&#x2F;h2&gt;

&lt;p&gt;This security release also includes the following non-security patches.&lt;&#x2F;p&gt;

&lt;p&gt;Into 15.8.2:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;110651&quot;&gt;Fix false positives for approved by insufficient users violation&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;111527&quot;&gt;gitaly: Remove readiness check&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;Into 15.7.7:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;111585&quot;&gt;GitLab Version Check - Add feature flag&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;111527&quot;&gt;gitaly: Remove readiness check&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 15.8.1, 15.7.6, and 15.6.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/01/31/security-release-gitlab-15-8-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/01/31/security-release-gitlab-15-8-1-released/</id>
<published>2023-01-31T00:00:00+00:00</published>
<updated>2023-01-31T00:00:00+00:00</updated>
<author>
<name>Nick Malcolm</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.8.1, 15.7.6, and 15.6.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-via-arbitrarily-large-issue-descriptions&quot;&gt;Denial of Service via arbitrarily large Issue descriptions&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#csrf-via-file-upload-allows-an-attacker-to-take-over-a-repository&quot;&gt;CSRF via file upload allows an attacker to take over a repository.&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#sidekiq-background-job-dos-by-uploading-malicious-ci-job-artifact-zips&quot;&gt;Sidekiq background job DoS by uploading malicious CI job artifact zips&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#sidekiq-background-job-dos-by-uploading-a-malicious-helm-package&quot;&gt;Sidekiq background job DoS by uploading a malicious Helm package&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;denial-of-service-via-arbitrarily-large-issue-descriptions&quot;&gt;Denial of Service via arbitrarily large Issue descriptions&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;817 --&gt;

&lt;p&gt;A lack of length validation in GitLab CE&#x2F;EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3411&quot;&gt;CVE-2022-3411&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;cryptopone&quot;&gt;cryptopone&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;csrf-via-file-upload-allows-an-attacker-to-take-over-a-repository&quot;&gt;CSRF via file upload allows an attacker to take over a repository.&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;820 --&gt;

&lt;p&gt;A Cross Site Request Forgery issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4138&quot;&gt;CVE-2022-4138&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sidekiq-background-job-dos-by-uploading-malicious-ci-job-artifact-zips&quot;&gt;Sidekiq background job DoS by uploading malicious CI job artifact zips&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;810 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3759&quot;&gt;CVE-2022-3759&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;luryus&quot;&gt;luryus&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sidekiq-background-job-dos-by-uploading-a-malicious-helm-package&quot;&gt;Sidekiq background job DoS by uploading a malicious Helm package&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;818 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0518&quot;&gt;CVE-2023-0518&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;luryus&quot;&gt;luryus&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;79 --&gt;

&lt;p&gt;Mattermost has been updated to versions 7.5.2, 7.4.1, and 7.1.5 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 15.6 and 15.7 of GitLab Omnibus. GitLab 15.8 already included Mattermost 7.5.2.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-patches&quot;&gt;Non-security patches&lt;&#x2F;h2&gt;

&lt;p&gt;This security release also includes the following non-security patches.&lt;&#x2F;p&gt;

&lt;p&gt;Into 15.6.7:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1233&quot;&gt;Ensure Workhorse is built with FIPS for CNG&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1252&quot;&gt;Grab gitlab-logger archives from the new project location&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;6575&quot;&gt;Ensure Workhorse is built in FIPS mode for Omnibus&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;106592&quot;&gt;Doc: FIPS, update omnibus language&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;106986&quot;&gt;Only refresh indexes that exist&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;109098&quot;&gt;Clear DuplicateJobs cookies from post-deployment migration&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;build&#x2F;CNG&#x2F;-&#x2F;merge_requests&#x2F;1273&quot;&gt;Upgrade GitLab logger to v2.3.0&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;Into 15.7.6:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;109690&quot;&gt;Geo - Remove parameter validation for registry notification request&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;Into 15.8.1:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;merge_requests&#x2F;6644&quot;&gt;Fix command in print-release-contents job&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;109991&quot;&gt;Fix resource_parent in FOSS instances&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;merge_requests&#x2F;109690&quot;&gt;Geo - Remove parameter validation for registry notification request&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 15.7.5, 15.6.6, and 15.5.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/01/17/critical-security-release-gitlab-15-7-5-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/01/17/critical-security-release-gitlab-15-7-5-released/</id>
<published>2023-01-17T00:00:00+00:00</published>
<updated>2023-01-17T00:00:00+00:00</updated>
<author>
<name>Nick Malcolm</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.7.5, 15.6.6, and 15.5.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com and GitLab Dedicated are already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;UPDATE (2023-01-20): In addition, we have released GitLab Runner versions 15.8.0, 15.7.3, 15.6.3, and 15.5.2. These images contain updates to the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;configuration&#x2F;advanced-configuration.html#helper-image&quot;&gt;Docker helper images&lt;&#x2F;a&gt; to address the Git vulnerabilities.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#critical-security-issues-in-git&quot;&gt;Critical security issues in Git&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;critical-security-issues-in-git&quot;&gt;Critical security issues in Git&lt;&#x2F;h2&gt;

&lt;p&gt;This release addresses the security issues &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2022-41903&quot;&gt;CVE-2022-41903&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2022-23521&quot;&gt;CVE-2022-23521&lt;&#x2F;a&gt; in &lt;a href=&quot;https:&#x2F;&#x2F;git-scm.com&#x2F;&quot;&gt;Git&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;These vulnerabilities affect all previous versions of GitLab.&lt;&#x2F;p&gt;

&lt;p&gt;The details of these vulnerabilities are as follows:&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2022-41903&quot;&gt;CVE-2022-41903&lt;&#x2F;h3&gt;

&lt;p&gt;The &lt;code&gt;git-log&lt;&#x2F;code&gt; command has the ability to display commits using an arbitrary format with its &lt;code&gt;--format&lt;&#x2F;code&gt; specifiers. This functionality is also exposed to &lt;code&gt;git-archive&lt;&#x2F;code&gt; via the &lt;code&gt;export-subst&lt;&#x2F;code&gt; gitattribute.&lt;&#x2F;p&gt;

&lt;p&gt;When processing the padding operators (e.g., &lt;code&gt;%&amp;lt;(&lt;&#x2F;code&gt;, &lt;code&gt;%&amp;lt;|(&lt;&#x2F;code&gt;, &lt;code&gt;%&amp;gt;(&lt;&#x2F;code&gt;, &lt;code&gt;%&amp;gt;&amp;gt;(&lt;&#x2F;code&gt;, or &lt;code&gt;%&amp;gt;&amp;lt;( )&lt;&#x2F;code&gt;, an integer overflow can occur in &lt;code&gt;pretty.c::format_and_pad_commit()&lt;&#x2F;code&gt; where a &lt;code&gt;size_t&lt;&#x2F;code&gt; is improperly stored as an &lt;code&gt;int&lt;&#x2F;code&gt;, and then added as an offset to a subsequent &lt;code&gt;memcpy()&lt;&#x2F;code&gt; call.&lt;&#x2F;p&gt;

&lt;p&gt;This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., &lt;code&gt;git log --format=...&lt;&#x2F;code&gt;). It may also be triggered indirectly through &lt;code&gt;git-archive&lt;&#x2F;code&gt; via the &lt;code&gt;export-subst&lt;&#x2F;code&gt; mechanism, which expands format specifiers inside of files within the repository during a git archive.&lt;&#x2F;p&gt;

&lt;p&gt;This integer overflow can result in arbitrary heap writes, which may result in remote code execution.&lt;&#x2F;p&gt;

&lt;p&gt;Credit for finding CVE-2022-41903 goes to Joern Schneeweisz of GitLab.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-2022-23521&quot;&gt;CVE-2022-23521&lt;&#x2F;h3&gt;

&lt;p&gt;gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a &lt;code&gt;.gitattributes&lt;&#x2F;code&gt; file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern.&lt;&#x2F;p&gt;

&lt;p&gt;When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge.&lt;&#x2F;p&gt;

&lt;p&gt;These overflows can be triggered via a crafted &lt;code&gt;.gitattributes&lt;&#x2F;code&gt; file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both.&lt;&#x2F;p&gt;

&lt;p&gt;This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution.&lt;&#x2F;p&gt;

&lt;p&gt;Credit for finding CVE-2022-23521 goes to Markus Vervier and Eric Sesterhenn of X41 D-Sec.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Note: GitLab releases have skipped 15.7.4, 15.6.5, and 15.5.8. There are no patches with these version numbers.&lt;&#x2F;p&gt;

&lt;p&gt;To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.
These security releases update Git on the helper images, which are used
by the Docker and Kubernetes executors. If you are using a shell
executor, you will need to update Git on your operating system.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 15.7.2, 15.6.4, and 15.5.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2023/01/09/security-release-gitlab-15-7-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2023/01/09/security-release-gitlab-15-7-2-released/</id>
<published>2023-01-09T00:00:00+00:00</published>
<updated>2023-01-09T00:00:00+00:00</updated>
<author>
<name>Kevin Morrison</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.7.2, 15.6.4, and 15.5.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#race-condition-on-gitlabcom-enables-verified-email-forgery--third-party-account-hijacking&quot;&gt;Race condition on gitlab.com enables verified email forgery &amp;amp; third-party account hijacking&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dos-and-high-resource-consumption-of-prometheus-server-through-abuse-of-grafana-integration-proxy-endpoint&quot;&gt;DOS and high resource consumption of Prometheus server through abuse of Grafana integration proxy endpoint&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-leak-sentry-token-by-changing-the-configured-url&quot;&gt;Maintainer can leak sentry token by changing the configured URL&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-leak-masked-webhook-secrets-by-changing-target-url-of-the-webhook&quot;&gt;Maintainer can leak masked webhook secrets by changing target URL of the webhook&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cross-site-scripting-in-wiki-changes-page-affecting-self-hosted-instances-running-without-strict-csp&quot;&gt;Cross-site scripting in wiki changes page affecting self-hosted instances running without strict CSP&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-access-tokens-continue-to-work-after-owner-loses-ability-to-revoke-them&quot;&gt;Group access tokens continue to work after owner loses ability to revoke them&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#users-avatar-disclosure-by-user-id-in-private-gitlab-instances&quot;&gt;Users&#x27; avatar disclosure by user ID in private GitLab instances&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-protocol-redirection-in-gitlab-pages&quot;&gt;Arbitrary Protocol Redirection in GitLab Pages&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-due-to-device-detector-parsing-user-agents&quot;&gt;ReDoS due to device-detector parsing user agents&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#regex-dos-in-the-submodule-url-parser&quot;&gt;Regex DOS in the Submodule Url Parser&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;race-condition-on-gitlabcom-enables-verified-email-forgery--third-party-account-hijacking&quot;&gt;Race condition on gitlab.com enables verified email forgery &amp;amp; third-party account hijacking&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;804 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth provider. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 6.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4037&quot;&gt;CVE-2022-4037&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to an anonymous researcher for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;dos-and-high-resource-consumption-of-prometheus-server-through-abuse-of-grafana-integration-proxy-endpoint&quot;&gt;DOS and high resource consumption of Prometheus server through abuse of Grafana integration proxy endpoint&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;805 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 5.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3613&quot;&gt;CVE-2022-3613&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-can-leak-sentry-token-by-changing-the-configured-url&quot;&gt;Maintainer can leak sentry token by changing the configured URL&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;813 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4365&quot;&gt;CVE-2022-4365&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-can-leak-masked-webhook-secrets-by-changing-target-url-of-the-webhook&quot;&gt;Maintainer can leak masked webhook secrets by changing target URL of the webhook&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;814 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak masked webhook secrets by changing target URL of the webhook. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4342&quot;&gt;CVE-2022-4342&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-wiki-changes-page-affecting-self-hosted-instances-running-without-strict-csp&quot;&gt;Cross-site scripting in wiki changes page affecting self-hosted instances running without strict CSP&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;803 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3573&quot;&gt;CVE-2022-3573&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryotak&quot;&gt;ryotak&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-access-tokens-continue-to-work-after-owner-loses-ability-to-revoke-them&quot;&gt;Group access tokens continue to work after owner loses ability to revoke them&lt;&#x2F;h2&gt;

&lt;p&gt;Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4167&quot;&gt;CVE-2022-4167&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was reported to us by a customer.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;users-avatar-disclosure-by-user-id-in-private-gitlab-instances&quot;&gt;Users&#x27; avatar disclosure by user ID in private GitLab instances&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;801 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim&#x27;s user ID, on private instances that restrict public level visibility. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3870&quot;&gt;CVE-2022-3870&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;nocasis&quot;&gt;nocasis&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-protocol-redirection-in-gitlab-pages&quot;&gt;Arbitrary Protocol Redirection in GitLab Pages&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;811 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2023-0042&quot;&gt;CVE-2023-0042&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by a GitLab team member, Joern Schneeweisz.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regex-dos-due-to-device-detector-parsing-user-agents&quot;&gt;Regex DoS due to device-detector parsing user agents&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;815 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in how the application parses user agents. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4131&quot;&gt;CVE-2022-4131&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;afewgoats&quot;&gt;afewgoats&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regex-dos-in-the-submodule-url-parser&quot;&gt;Regex DoS in the Submodule Url Parser&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3514&quot;&gt;CVE-2022-3514&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mokusou&quot;&gt;mokusou&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;p&gt;Mattermost has been updated to version 7.3.1 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus 15.4 and 15.5.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-python&quot;&gt;Update Python&lt;&#x2F;h2&gt;

&lt;p&gt;Python has been updated to version 3.8.16 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus 15.5, 15.6 and 15.7.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-logrotate&quot;&gt;Update Logrotate&lt;&#x2F;h2&gt;

&lt;p&gt;Logrotate has been updated to version 3.20.1 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus 15.5, 15.6 and 15.7.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-redis&quot;&gt;Update Redis&lt;&#x2F;h2&gt;

&lt;p&gt;Redis has been updated to version 6.2.8 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 15.6.1, 15.5.5 and 15.4.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/11/30/security-release-gitlab-15-6-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/11/30/security-release-gitlab-15-6-1-released/</id>
<published>2022-11-30T00:00:00+00:00</published>
<updated>2022-11-30T00:00:00+00:00</updated>
<author>
<name>Nikhil George</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.6.1, 15.5.5 and 15.4.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dast-api-scanner-exposes-authorization-headers-in-vulnerabilities&quot;&gt;DAST API scanner exposes Authorization headers in vulnerabilities&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-ip-allow-list-not-fully-respected-by-the-package-registry&quot;&gt;Group IP allow-list not fully respected by the Package Registry&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#deploy-keys-and-tokens-may-bypass-external-authorization-service-if-it-is-enabled&quot;&gt;Deploy keys and tokens may bypass External Authorization service if it is enabled&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#html-content-injection-in-readme-file&quot;&gt;HTML content injection in README file&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#repository-import-still-allows-to-import-40-hexadecimal-branches&quot;&gt;Repository import still allows to import 40 hexadecimal branches&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#webhook-secret-tokens-leaked-in-webhook-logs&quot;&gt;Webhook secret tokens leaked in webhook logs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-leak-webhook-secret-token-by-changing-the-webhook-url&quot;&gt;Maintainer can leak webhook secret token by changing the webhook URL&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cross-site-scripting-in-jira-integration-affecting-self-hosted-instances-without-strict-csp&quot;&gt;Cross-site scripting in Jira Integration affecting self-hosted instances without strict CSP&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#release-names-visible-in-public-projects-despite-release-set-as-project-members-only&quot;&gt;Release names visible in public projects despite release set as project members only&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#sidekiq-background-job-dos-by-uploading-malicious-nuget-packages&quot;&gt;Sidekiq background job DoS by uploading malicious NuGet packages&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#email-id-leaked-through-webhook-payloads&quot;&gt;Email ID leaked through Webhook payloads&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#blind-ssrf-in-repository-mirroring-using-dns-rebinding&quot;&gt;Blind SSRF in repository mirroring using DNS rebinding&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#SSRF%20in%20Web%20Terminal%20advertise_address&quot;&gt;SSRF in Web Terminal advertise_address&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;dast-api-scanner-exposes-authorization-headers-in-vulnerabilities&quot;&gt;DAST API scanner exposes Authorization headers in vulnerabilities&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;383083 --&gt;

&lt;p&gt;A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in the vulnerability report. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.0). It is now mitigated in the latest release of DAST API scanner and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4206&quot;&gt;CVE-2022-4206&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-ip-allow-list-not-fully-respected-by-the-package-registry&quot;&gt;Group IP allow-list not fully respected by the Package Registry&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;782 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3820&quot;&gt;CVE-2022-3820&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;deploy-keys-and-tokens-may-bypass-external-authorization-service-if-it-is-enabled&quot;&gt;Deploy keys and tokens may bypass External Authorization service if it is enabled&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;773 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3740&quot;&gt;CVE-2022-3740&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;repository-import-still-allows-to-import-40-hexadecimal-branches&quot;&gt;Repository import still allows to import 40 hexadecimal branches&lt;&#x2F;h2&gt;

&lt;p&gt;In GitLab EE&#x2F;CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:L&lt;&#x2F;code&gt;, 6.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4205&quot;&gt;CVE-2022-4205&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;html-content-injection-in-readme-file&quot;&gt;HTML content injection in README file&lt;&#x2F;h2&gt;
&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4092&quot;&gt;CVE-2022-4092&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;webhook-secret-tokens-leaked-in-webhook-logs&quot;&gt;Webhook secret tokens leaked in webhook logs&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;797 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3902&quot;&gt;CVE-2022-3902&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-can-leak-webhook-secret-token-by-changing-the-webhook-url&quot;&gt;Maintainer can leak webhook secret token by changing the webhook URL&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;795 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4054&quot;&gt;CVE-2022-4054&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-jira-integration-affecting-self-hosted-instances-without-strict-csp&quot;&gt;Cross-site scripting in Jira Integration affecting self-hosted instances without strict CSP&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;799 --&gt;

&lt;p&gt;A cross-site scripting issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3572&quot;&gt;CVE-2022-3572&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryotak&quot;&gt;ryotak&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;release-names-visible-in-public-projects-despite-release-set-as-project-members-only&quot;&gt;Release names visible in public projects despite release set as project members only&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;794 --&gt;

&lt;p&gt;An improper access control issue in GitLab CE&#x2F;EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases were set to be restricted to project members only. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3482&quot;&gt;CVE-2022-3482&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;email-id-leaked-through-webhook-payloads&quot;&gt;Email ID leaked through Webhook payloads&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;790 --&gt;

&lt;p&gt;An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4255&quot;&gt;CVE-2022-4255&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sidekiq-background-job-dos-by-uploading-malicious-nuget-packages&quot;&gt;Sidekiq background job DoS by uploading malicious NuGet packages&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;793 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible to trigger a DoS attack by uploading a malicious NuGet package. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3478&quot;&gt;CVE-2022-3478&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;luryus&quot;&gt;luryus&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;blind-ssrf-in-repository-mirroring-using-dns-rebinding&quot;&gt;Blind SSRF in repository mirroring using DNS rebinding&lt;&#x2F;h2&gt;

&lt;p&gt;A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4335&quot;&gt;CVE-2022-4335&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-in-web-terminal-advertise_address&quot;&gt;SSRF in Web Terminal advertise_address&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;785 --&gt;

&lt;p&gt;A blind SSRF in GitLab CE&#x2F;EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-4201&quot;&gt;CVE-2022-4201&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-xmlsoftlibxml2&quot;&gt;Update xmlsoft&#x2F;libxml2&lt;&#x2F;h2&gt;

&lt;p&gt;xmlsoft&#x2F;libxml2 has been updated to version 2.10.3 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus from 13.6.6.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-haxxcurl&quot;&gt;Update haxx&#x2F;curl&lt;&#x2F;h2&gt;

&lt;p&gt;haxx&#x2F;curl has been updated to version 7.86.0 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus 15.4 and 15.6.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-ruby&quot;&gt;Update ruby&lt;&#x2F;h2&gt;

&lt;p&gt;ruby has been updated to version 2.7.6 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus and GitLab Chart.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-ncurses&quot;&gt;Update ncurses&lt;&#x2F;h2&gt;

&lt;p&gt;ncurses has been updated to version 6.3-20220416 to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-zlib&quot;&gt;Update zlib&lt;&#x2F;h2&gt;

&lt;p&gt;zlib has been updated to version 1.2.13 to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus prior to 15.7.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-rsync&quot;&gt;Update rsync&lt;&#x2F;h2&gt;

&lt;p&gt;rsync has been updated to version 3.2.6 to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus 15.3, 15.4, and 15.5.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-postgresql&quot;&gt;Update PostgreSQL&lt;&#x2F;h2&gt;

&lt;p&gt;PostgreSQL has been updated to versions 12.12 and 13.8 to mitigate security issues. By default Omnibus &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;omnibus&#x2F;settings&#x2F;database.html#automatic-restart-when-the-postgresql-version-changes&quot;&gt;automatically restarts PostgreSQL&lt;&#x2F;a&gt; after the update. However, if automatic restart is disabled manual restarts would be required.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus 15.3, 15.4, and 15.5.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;backport-fix-for-gitaly-ntp-request-issue&quot;&gt;Backport fix for Gitaly NTP request issue&lt;&#x2F;h2&gt;

&lt;p&gt;A non-security issue in Gitaly is being backported to this release. Customers that rely on public NTP services such as &lt;code&gt;pool.ntp.org&lt;&#x2F;code&gt; are at risk of receiving rate limited responses due to increased NTP request volume. Every readiness check results in each Praefect node making a request to the configured NTP service. Failed NTP responses result in failed readiness check. If a NTP service is not specified &lt;code&gt;pool.ntp.org&lt;&#x2F;code&gt; is used as the default. Deployments that rely on healthy readiness checks can experience outages. Issue Link: &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;383440&quot;&gt;Gitaly 15.4.3 spams NTP requests&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;backport-fix-for-watchdog-rssmemorylimit-monitor&quot;&gt;Backport fix for Watchdog RssMemoryLimit monitor&lt;&#x2F;h2&gt;

&lt;p&gt;A non-security issue in Puma is being backported to this release. This affects self-managed instances that uses PumaWorkerKiller. PumaWorkerKiller is disabled by default on Gitlab.com and self-managed instances using helm charts. This means that gitlab.com is not affected. It is enabled by default for omnibus installations and installations from source. Issue Link: &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;383440&quot;&gt;Convert memory_limit to bytes for RssMemoryLimit&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.
To update DAST API scanner, self-managed customers that are using our built-in DAST CI template after 15.0 can get the latest release from registry.gitlab.com. If using the always pull policy the update will occur automatically. GitLab.com is already running the updated DAST scanner.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 15.5.2, 15.4.4, and 15.3.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/11/02/security-release-gitlab-15-5-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/11/02/security-release-gitlab-15-5-2-released/</id>
<published>2022-11-02T00:00:00+00:00</published>
<updated>2022-11-02T00:00:00+00:00</updated>
<author>
<name>Dominic Couture</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.5.2, 15.4.4, and 15.3.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dast-analyzer-sends-custom-request-headers-with-every-request&quot;&gt;DAST analyzer sends custom request headers with every request&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-with-csp-bypass-via-scoped-labels-color&quot;&gt;Stored-XSS with CSP-bypass via scoped labels&#x27; color&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-leak-datadog-api-key-by-changing-integration-url&quot;&gt;Maintainer can leak Datadog API key by changing integration URL&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#uncontrolled-resource-consumption-when-parsing-urls&quot;&gt;Uncontrolled resource consumption when parsing URLs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#issue-http-requests-when-users-view-an-openapi-document-and-click-buttons&quot;&gt;Issue HTTP requests when users view an OpenAPI document and click buttons&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#command-injection-in-ci-jobs-via-branch-name-in-ci-pipelines&quot;&gt;Command injection in CI jobs via branch name in CI pipelines&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#open-redirection&quot;&gt;Open redirection&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#prefill-variables-do-not-check-permission-of-the-project-in-external-ci-config&quot;&gt;Prefill variables do not check permission of the project in external CI config&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#disclosure-of-audit-events-to-insufficiently-permissioned-group-and-project-members&quot;&gt;Disclosure of audit events to insufficiently permissioned group and project members&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-gfm-references-rendered-in-jira-issue-description-leak-privateconfidential-resources&quot;&gt;Arbitrary GFM references rendered in Jira issue description leak private&#x2F;confidential resources&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#award-emojis-api-for-an-internal-note-is-accessible-to-users-without-access-to-the-note&quot;&gt;Award emojis API for an internal note is accessible to users without access to the note&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#open-redirect-in-pipeline-artifacts-when-generating-html-documents&quot;&gt;Open redirect in pipeline artifacts when generating HTML documents&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#retrying-a-job-in-a-downstream-pipeline-allows-the-retrying-user-to-take-ownership-of-the-retried-jobs-in-upstream-pipelines&quot;&gt;Retrying a job in a downstream pipeline allows the retrying user to take ownership of the retried jobs in upstream pipelines&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-level-secure-files-can-be-written-out-of-the-target-directory&quot;&gt;Project-level Secure Files can be written out of the target directory&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;dast-analyzer-sends-custom-request-headers-with-every-request&quot;&gt;DAST analyzer sends custom request headers with every request&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;377473 --&gt;

&lt;p&gt;Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 7.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3767&quot;&gt;CVE-2022-3767&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-with-csp-bypass-via-scoped-labels-color&quot;&gt;Stored-XSS with CSP-bypass via scoped labels&#x27; color&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;770 --&gt;

&lt;p&gt;A cross-site scripting issue has been discovered in GitLab CE&#x2F;EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels  colour feature  which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3265&quot;&gt;CVE-2022-3265&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-can-leak-datadog-api-key-by-changing-integration-url&quot;&gt;Maintainer can leak Datadog API key by changing integration URL&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;780 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versions starting from 15.5 before 15.5.2. A malicious maintainer could exfiltrate a Datadog integration&#x27;s access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3483&quot;&gt;CVE-2022-3483&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryotak&quot;&gt;ryotak&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;uncontrolled-resource-consumption-when-parsing-urls&quot;&gt;Uncontrolled resource consumption when parsing URLs&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;768 --&gt;

&lt;p&gt;An uncontrolled resource consumption issue when parsing URLs in GitLab CE&#x2F;EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to cause performance issues and potentially a denial of service on the GitLab instance. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3818&quot;&gt;CVE-2022-3818&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;issue-http-requests-when-users-view-an-openapi-document-and-click-buttons&quot;&gt;Issue HTTP requests when users view an OpenAPI document and click buttons&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;778 --&gt;

&lt;p&gt;Lack of sand-boxing of OpenAPI documents in GitLab CE&#x2F;EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick a user to click on the Swagger OpenAPI viewer and issue HTTP requests that affect the victim&#x27;s account. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 4.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3726&quot;&gt;CVE-2022-3726&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;command-injection-in-ci-jobs-via-branch-name-in-ci-pipelines&quot;&gt;Command injection in CI jobs via branch name in CI pipelines&lt;&#x2F;h2&gt;

&lt;p&gt;Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user who creates a branch with a specially crafted name and gets another user to trigger a pipeline to execute commands in the runner as that other user. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2251&quot;&gt;CVE-2022-2251&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;stanlyoncm&quot;&gt;stanlyoncm&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;open-redirection&quot;&gt;Open redirection&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;781 --&gt;

&lt;p&gt;An open redirect vulnerability in GitLab EE&#x2F;CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:C&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3486&quot;&gt;CVE-2022-3486&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryotak&quot;&gt;ryotak&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;prefill-variables-do-not-check-permission-of-the-project-in-external-ci-config&quot;&gt;Prefill variables do not check permission of the project in external CI config&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;761 --&gt;

&lt;p&gt;An improper authorization issue in GitLab CE&#x2F;EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI&#x2F;CD configuration file they don&#x27;t have access to. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3793&quot;&gt;CVE-2022-3793&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-audit-events-to-insufficiently-permissioned-group-and-project-members&quot;&gt;Disclosure of audit events to insufficiently permissioned group and project members&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;771 --&gt;

&lt;p&gt;Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project&#x27;s Audit Events and Developers or Maintainers to view the group&#x27;s Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3413&quot;&gt;CVE-2022-3413&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-gfm-references-rendered-in-jira-issue-description-leak-privateconfidential-resources&quot;&gt;Arbitrary GFM references rendered in Jira issue description leak private&#x2F;confidential resources&lt;&#x2F;h2&gt;

&lt;p&gt;An information disclosure issue in GitLab CE&#x2F;EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown (GFM) references in a Jira issue to disclose the names of resources they don&#x27;t have access to. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2761&quot;&gt;CVE-2022-2761&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;award-emojis-api-for-an-internal-note-is-accessible-to-users-without-access-to-the-note&quot;&gt;Award emojis API for an internal note is accessible to users without access to the note&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;783 --&gt;

&lt;p&gt;An improper authorization issue in GitLab CE&#x2F;EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malicious users to set emojis on internal notes they don&#x27;t have access to. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3819&quot;&gt;CVE-2022-3819&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;open-redirect-in-pipeline-artifacts-when-generating-html-documents&quot;&gt;Open redirect in pipeline artifacts when generating HTML documents&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;764 --&gt;

&lt;p&gt;An open redirect in GitLab CE&#x2F;EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3280&quot;&gt;CVE-2022-3280&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;retrying-a-job-in-a-downstream-pipeline-allows-the-retrying-user-to-take-ownership-of-the-retried-jobs-in-upstream-pipelines&quot;&gt;Retrying a job in a downstream pipeline allows the retrying user to take ownership of the retried jobs in upstream pipelines&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;779 --&gt;

&lt;p&gt;Improper authorization in GitLab CE&#x2F;EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying a job in a downstream pipeline to take ownership of the retried jobs in the upstream pipeline even if the user doesn&#x27;t have access to that project. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3706&quot;&gt;CVE-2022-3706&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-level-secure-files-can-be-written-out-of-the-target-directory&quot;&gt;Project-level Secure Files can be written out of the target directory&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;376218 --&gt;

&lt;p&gt;Secure Files named in a specific way could traverse outside of the target directory in the CI job. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.7). Only GitLab.com was affected as this feature is not yet enabled on self-managed instances and the patch has been deployed in production.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-openssl&quot;&gt;Update openssl&lt;&#x2F;h2&gt;

&lt;p&gt;The version of openssl has been updated to &lt;a href=&quot;https:&#x2F;&#x2F;launchpad.net&#x2F;ubuntu&#x2F;+source&#x2F;openssl&#x2F;3.0.2-0ubuntu1.7&quot;&gt;3.0.2-0ubuntu1.7&lt;&#x2F;a&gt; in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h1 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h1&gt;

&lt;p&gt;Affects all versions of GitLab Dynamic Application Security Testing (DAST) Analyzer prior to 3.0.32.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-curl&quot;&gt;Update curl&lt;&#x2F;h2&gt;

&lt;p&gt;The version of curl has been updated to 7.85.0 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h1 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h1&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-pcre2&quot;&gt;Update pcre2&lt;&#x2F;h2&gt;

&lt;p&gt;The version of pcre2 has been updated to 10.40 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h1 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h1&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-fixes&quot;&gt;Non-security fixes&lt;&#x2F;h2&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;7275&quot;&gt;15.5.0 upgrade on CentOS 8 Stream in FIPS mode fails&lt;&#x2F;a&gt;: Backported to 15.5.&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;7267&quot;&gt;Ohai fails to build trying to find unavailable version of the dependency chef-utils&lt;&#x2F;a&gt;: Backported to 15.4 and 15.3.&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;To update DAST scanner, self-managed customers that are using our built-in DAST CI template after 15.0 can get the latest release from &lt;code&gt;registry.gitlab.com&lt;&#x2F;code&gt;. If using the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;executors&#x2F;docker.html#using-the-always-pull-policy&quot;&gt;always pull policy&lt;&#x2F;a&gt; the update will occur automatically. GitLab.com is already running the updated DAST scanner.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 15.4.1, 15.3.4, and 15.2.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/09/29/security-release-gitlab-15-4-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/09/29/security-release-gitlab-15-4-1-released/</id>
<published>2022-09-29T00:00:00+00:00</published>
<updated>2022-09-29T00:00:00+00:00</updated>
<author>
<name>Nick Malcolm</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.4.1, 15.3.4, and 15.2.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-via-cloning-an-issue&quot;&gt;Denial of Service via cloning an issue&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-put-request-as-victim-user-through-sentry-error-list&quot;&gt;Arbitrary PUT request as victim user through Sentry error list&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#content-injection-via-external-status-checks&quot;&gt;Content injection via External Status Checks&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-maintainers-can-access-datadog-api-key-from-logs&quot;&gt;Project maintainers can access Datadog API Key from logs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unsafe-serialization-of-json-data-could-lead-to-sensitive-data-leakage&quot;&gt;Unsafe serialization of Json data could lead to sensitive data leakage&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#import-bug-allows-importing-of-private-local-git-repos&quot;&gt;Import bug allows importing of private local git repos&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-leak-github-access-tokens-by-changing-integration-url-even-after-1521-patch&quot;&gt;Maintainer can leak Github access tokens by changing integration URL (even after 15.2.1 patch)&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-users-able-to-create-issues-in-any-project&quot;&gt;Unauthorized users able to create issues in any project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypass-group-ip-restriction-on-dependency-proxy&quot;&gt;Bypass group IP restriction on Dependency Proxy&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#healthcheck-endpoint-allow-list-can-be-bypassed-when-accessed-over-http-in-an-https-enabled-system&quot;&gt;Healthcheck endpoint allow list can be bypassed when accessed over HTTP in an HTTPS enabled system&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#disclosure-of-todo-details-to-guest-users&quot;&gt;Disclosure of Todo details to guest users&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#a-users-primary-email-may-be-disclosed-through-group-member-events-webhooks&quot;&gt;A user&#x27;s primary email may be disclosed through group member events webhooks&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#content-manipulation-due-to-branchtag-name-confusion-with-the-default-branch-name&quot;&gt;Content manipulation due to branch&#x2F;tag name confusion with the default branch name&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#leakage-of-email-addresses-in-webhook-logs&quot;&gt;Leakage of email addresses in WebHook logs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#specially-crafted-output-makes-job-logs-inaccessible&quot;&gt;Specially crafted output makes job logs inaccessible&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;denial-of-service-via-cloning-an-issue&quot;&gt;Denial of Service via cloning an issue&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;766 --&gt;

&lt;p&gt;A potential DOS vulnerability was discovered in GitLab CE&#x2F;EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used to trigger high CPU usage. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt; 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3283&quot;&gt;CVE-2022-3283&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;legit-security&quot;&gt;legit-security&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-put-request-as-victim-user-through-sentry-error-list&quot;&gt;Arbitrary PUT request as victim user through Sentry error list&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;739 --&gt;

&lt;p&gt;Improper control of a resource identifier in Error Tracking in GitLab CE&#x2F;EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3060&quot;&gt;CVE-2022-3060&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;@joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;content-injection-via-external-status-checks&quot;&gt;Content injection via External Status Checks&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;736 --&gt;

&lt;p&gt;A cross-site scripting issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.2 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 It was possible to exploit a vulnerability in the external status checks feature  which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2904&quot;&gt;CVE-2022-2904&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-maintainers-can-access-datadog-api-key-from-logs&quot;&gt;Project maintainers can access Datadog API Key from logs&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;717 --&gt;

&lt;p&gt;An information disclosure vulnerability in GitLab CE&#x2F;EE affecting all versions starting from 9.3 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 allows a project maintainer to access the DataDog integration API key from webhook logs. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3018&quot;&gt;CVE-2022-3018&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unsafe-serialization-of-json-data-could-lead-to-sensitive-data-leakage&quot;&gt;Unsafe serialization of Json data could lead to sensitive data leakage&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;735 --&gt;

&lt;p&gt;Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitive information via cache. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3291&quot;&gt;CVE-2022-3291&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;import-bug-allows-importing-of-private-local-git-repos&quot;&gt;Import bug allows importing of private local git repos&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;758 --&gt;

&lt;p&gt;An issue has been discovered in the Import functionality of GitLab CE&#x2F;EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an authenticated user to read arbitrary projects&#x27; content given the project&#x27;s ID. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3067&quot;&gt;CVE-2022-3067&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-can-leak-github-access-tokens-by-changing-integration-url-even-after-1521-patch&quot;&gt;Maintainer can leak Github access tokens by changing integration URL (even after 15.2.1 patch)&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;762 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.6 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A malicious maintainer could exfiltrate a GitHub integration&#x27;s access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2882&quot;&gt;CVE-2022-2882&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-users-able-to-create-issues-in-any-project&quot;&gt;Unauthorized users able to create issues in any project&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;759 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an unauthorised user to create issues in a project. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3066&quot;&gt;CVE-2022-3066&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypass-group-ip-restriction-on-dependency-proxy&quot;&gt;Bypass group IP restriction on Dependency Proxy&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;740 --&gt;

&lt;p&gt;Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows a group member to bypass IP restrictions when using a deploy token. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3286&quot;&gt;CVE-2022-3286&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;healthcheck-endpoint-allow-list-can-be-bypassed-when-accessed-over-http-in-an-https-enabled-system&quot;&gt;Healthcheck endpoint allow list can be bypassed when accessed over HTTP in an HTTPS enabled system&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;64 --&gt;

&lt;p&gt;Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an unauthorized attacker to prevent access to GitLab. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3285&quot;&gt;CVE-2022-3285&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-todo-details-to-guest-users&quot;&gt;Disclosure of Todo details to guest users&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;726 --&gt;

&lt;p&gt;It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE&#x2F;EE affecting all versions from 15.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3330&quot;&gt;CVE-2022-3330&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;a-users-primary-email-may-be-disclosed-through-group-member-events-webhooks&quot;&gt;A user&#x27;s primary email may be disclosed through group member events webhooks&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;772 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A user&#x27;s primary email may be disclosed to an attacker through group member events webhooks. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3351&quot;&gt;CVE-2022-3351&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;@joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;content-manipulation-due-to-branchtag-name-confusion-with-the-default-branch-name&quot;&gt;Content manipulation due to branch&#x2F;tag name confusion with the default branch name&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;713 --&gt;

&lt;p&gt;A branch&#x2F;tag name confusion in GitLab CE&#x2F;EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3288&quot;&gt;CVE-2022-3288&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;leakage-of-email-addresses-in-webhook-logs&quot;&gt;Leakage of email addresses in WebHook logs&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;756 --&gt;

&lt;p&gt;Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3293&quot;&gt;CVE-2022-3293&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;specially-crafted-output-makes-job-logs-inaccessible&quot;&gt;Specially crafted output makes job logs inaccessible&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;767 --&gt;

&lt;p&gt;An unhandled exception in job log parsing in GitLab CE&#x2F;EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to prevent access to job logs. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 2.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3279&quot;&gt;CVE-2022-3279&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;exem_pt&quot;&gt;exem_pt&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;enforce-editing-approval-rules-on-project-level&quot;&gt;Enforce editing approval rules on project level&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;760 --&gt;

&lt;p&gt;Improper access control in the GitLab CE&#x2F;EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3325&quot;&gt;CVE-2022-3325&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-grafana&quot;&gt;Update Grafana&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;63 --&gt;

&lt;p&gt;Grafana has been patched in order to mitigate &quot;CVE-2022-31107 - Grafana account takeover via OAuth vulnerability&quot;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;p&gt;Mattermost has been updated to version 7.1.3 in order to mitigate security issues.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;backport-fix-for-geo-lfs-issue&quot;&gt;Backport fix for Geo LFS issue&lt;&#x2F;h2&gt;

&lt;p&gt;A non-security issue in Geo LFS is being backported to our &lt;code&gt;15.2.5&lt;&#x2F;code&gt; release: &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;371397&quot;&gt;&quot;Geo: invalid lfs object deletion on secondary when managed object replication is disabled&quot;&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 15.3.2, 15.2.4 and 15.1.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/08/30/critical-security-release-gitlab-15-3-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/08/30/critical-security-release-gitlab-15-3-2-released/</id>
<published>2022-08-30T00:00:00+00:00</published>
<updated>2022-08-30T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.3.2, 15.2.4 and 15.1.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). Please note, this critical release will also serve as our monthly security release for August.&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#remote-command-execution-via-github-import&quot;&gt;Remote Command Execution via GitHub import&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-via-labels-color&quot;&gt;Stored XSS via labels color&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#content-injection-via-incidents-timeline-description&quot;&gt;Content injection via Incidents Timeline description&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-via-issue-preview&quot;&gt;Denial of Service via Issue preview&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#lack-of-length-validation-in-snippets-leads-to-denial-of-service&quot;&gt;Lack of length validation in Snippets leads to Denial of Service&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-ip-allow-list-not-fully-respected-by-the-package-registry&quot;&gt;Group IP allow-list not fully respected by the Package Registry&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#abusing-gitalygettreeentries-calls-leads-to-denial-of-service&quot;&gt;Abusing Gitaly.GetTreeEntries calls leads to denial of service&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-http-requests-possible-in-ipynb-notebook-with-malicious-form-tags&quot;&gt;Arbitrary HTTP Requests Possible in .ipynb Notebook with Malicious Form Tags&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#read-repository-content-via-livepreview-feature&quot;&gt;Read repository content via LivePreview feature&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#regular-expression-denial-of-service-via-special-crafted-input&quot;&gt;Regular Expression Denial of Service via special crafted input&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#information-disclosure-via-arbitrary-gfm-references-rendered-in-incident-timeline-events&quot;&gt;Information Disclosure via Arbitrary GFM references rendered in Incident Timeline Events&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-via-the-create-branch-api&quot;&gt;Denial of Service via the Create branch API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#brute-force-attack-may-guess-a-password-even-when-2fa-is-enabled&quot;&gt;Brute force attack may guess a password even when 2FA is enabled&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#idor-in-zentao-integration-leaked-issue-details&quot;&gt;IDOR in Zentao integration leaked issue details&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;remote-command-execution-via-github-import&quot;&gt;Remote Command Execution via GitHub import&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;755 --&gt;

&lt;p&gt;A vulnerability in GitLab CE&#x2F;EE affecting all versions from 11.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint. This is a critical severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 9.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2992&quot;&gt;CVE-2022-2992&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-via-labels-color&quot;&gt;Stored XSS via labels color&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;749 --&gt;

&lt;p&gt;A cross-site scripting issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It was possible to exploit a vulnerability in setting the labels color feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2865&quot;&gt;CVE-2022-2865&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;content-injection-via-incidents-timeline-description&quot;&gt;Content injection via Incidents Timeline description&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;729 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2527&quot;&gt;CVE-2022-2527&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;lack-of-length-validation-in-snippets-leads-to-denial-of-service&quot;&gt;Lack of length validation in Snippets leads to Denial of Service&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;731 --&gt;

&lt;p&gt;A lack of length validation in Snippet descriptions in GitLab CE&#x2F;EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allows an authenticated attacker to create a maliciously large Snippet which when requested with or without authentication places excessive load on the server, potentially leading to Denial of Service. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2592&quot;&gt;CVE-2022-2592&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;cryptopone&quot;&gt;cryptopone&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-ip-allow-list-not-fully-respected-by-the-package-registry&quot;&gt;Group IP allow-list not fully respected by the Package Registry&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;706 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2533&quot;&gt;CVE-2022-2533&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;abusing-gitalygettreeentries-calls-leads-to-denial-of-service&quot;&gt;Abusing Gitaly.GetTreeEntries calls leads to denial of service&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;709 --&gt;

&lt;p&gt;A business logic issue in the handling of large repositories in all versions of GitLab CE&#x2F;EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allowed an authenticated and authorized user to exhaust server resources by importing a malicious project. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2455&quot;&gt;CVE-2022-2455&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;0xn3va&quot;&gt;0xn3va&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-http-requests-possible-in-ipynb-notebook-with-malicious-form-tags&quot;&gt;Arbitrary HTTP Requests Possible in .ipynb Notebook with Malicious Form Tags&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;748 --&gt;

&lt;p&gt;A crafted tag in the Jupyter Notebook viewer in GitLab EE&#x2F;CE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allows an attacker to issue arbitrary HTTP requests. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2428&quot;&gt;CVE-2022-2428&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;read-repository-content-via-livepreview-feature&quot;&gt;Read repository content via LivePreview feature&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;349388 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It was possible to read repository content by an unauthorised user if a project member used a crafted link. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2907&quot;&gt;CVE-2022-2907&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;niraeth&quot;&gt;niraeth&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regular-expression-denial-of-service-via-special-crafted-input&quot;&gt;Regular Expression Denial of Service via special crafted input&lt;&#x2F;h2&gt;

&lt;p&gt;A potential DoS vulnerability was discovered in Gitlab CE&#x2F;EE versions starting from 10.7 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit message field. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2908&quot;&gt;CVE-2022-2908&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryhmnlfj&quot;&gt;ryhmnlfj&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-via-arbitrary-gfm-references-rendered-in-incident-timeline-events&quot;&gt;Information Disclosure via Arbitrary GFM references rendered in Incident Timeline Events&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;745 --&gt;

&lt;p&gt;An improper access control issue in GitLab CE&#x2F;EE affecting all versions starting from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of confidential information via the Incident timeline events. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2630&quot;&gt;CVE-2022-2630&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-via-the-create-branch-api&quot;&gt;Denial of Service via the Create branch API&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;366876 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Improper data handling on branch creation could have been used to trigger high CPU usage. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3639&quot;&gt;CVE-2022-3639&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;elise&quot;&gt;elise&lt;&#x2F;a&gt; for reporting this vulnerability.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-via-issue-preview&quot;&gt;Denial of Service via Issue preview&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;361982 --&gt;

&lt;p&gt;A potential DOS vulnerability was discovered in GitLab CE&#x2F;EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Malformed content added to the issue description could have been used to trigger high CPU usage. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2931&quot;&gt;CVE-2022-2931&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;legit-security&quot;&gt;legit-security&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-in-zentao-integration-leaked-issue-details&quot;&gt;IDOR in Zentao integration leaked issue details&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;360372 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab&#x27;s Zentao integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak project issues. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3331&quot;&gt;CVE-2022-3331&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;brute-force-attack-may-guess-a-password-even-when-2fa-is-enabled&quot;&gt;Brute force attack may guess a password even when 2FA is enabled&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;340395 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user&#x27;s password by brute force by sending crafted requests to a specific endpoint, even if the victim user has 2FA enabled on their account.
 This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-3031&quot;&gt;CVE-2022-3031&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was reported to us by a customer.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 15.3.1, 15.2.3, 15.1.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/</id>
<published>2022-08-22T00:00:00+00:00</published>
<updated>2022-08-22T00:00:00+00:00</updated>
<author>
<name>Nick Malcolm</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.3.1, 15.2.3, 15.1.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#Remote%20Command%20Execution%20via%20Github%20import&quot;&gt;Remote Command Execution via Github import&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;remote-command-execution-via-github-import&quot;&gt;Remote Command Execution via Github import&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;371098 --&gt;

&lt;p&gt;A vulnerability in GitLab CE&#x2F;EE affecting all versions starting from 11.3.4 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint. This is a Critical severity issue (&lt;code&gt;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;,  9.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2884&quot;&gt;CVE-2022-2884&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;&#x2F;h3&gt;

&lt;p&gt;If you&#x27;re unable to upgrade right away, you can secure your GitLab
installation against this vulnerability using the workaround outlined
below until you have time to upgrade.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;disable-github-import&quot;&gt;Disable GitHub import&lt;&#x2F;h4&gt;

&lt;p&gt;Login using an administrator account to your GitLab installation and perform the
following:&lt;&#x2F;p&gt;

&lt;ol&gt;
  &lt;li&gt;Click &quot;Menu&quot; -&amp;gt; &quot;Admin&quot;.&lt;&#x2F;li&gt;
  &lt;li&gt;Click &quot;Settings&quot; -&amp;gt; &quot;General&quot;.&lt;&#x2F;li&gt;
  &lt;li&gt;Expand the &quot;Visibility and access controls&quot; tab.&lt;&#x2F;li&gt;
  &lt;li&gt;Under &quot;Import sources&quot; disable the &quot;GitHub&quot; option.&lt;&#x2F;li&gt;
  &lt;li&gt;Click &quot;Save changes&quot;.&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h3 id=&quot;verifying-the-workaround&quot;&gt;Verifying the workaround&lt;&#x2F;h3&gt;

&lt;ol&gt;
  &lt;li&gt;In a browser window, login as any user.&lt;&#x2F;li&gt;
  &lt;li&gt;Click &quot;+&quot; on the top bar.&lt;&#x2F;li&gt;
  &lt;li&gt;Click &quot;New project&#x2F;repository&quot;.&lt;&#x2F;li&gt;
  &lt;li&gt;Click &quot;Import project&quot;.&lt;&#x2F;li&gt;
  &lt;li&gt;Verify that &quot;GitHub&quot; does not appear as an import option.&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 15.2.1, 15.1.4, and 15.0.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/07/28/security-release-gitlab-15-2-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/07/28/security-release-gitlab-15-2-1-released/</id>
<published>2022-07-28T00:00:00+00:00</published>
<updated>2022-07-28T00:00:00+00:00</updated>
<author>
<name>Rohit Shambhuni</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.2.1, 15.1.4, and 15.0.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;breaking-change&quot;&gt;Breaking change&lt;&#x2F;h2&gt;

&lt;p&gt;In July 2019 we fixed a vulnerability related to very large CI&#x2F;CD configuration files and the &lt;code&gt;ci_yaml_limit_size&lt;&#x2F;code&gt; feature flag was introduced as a way to disable the patch, if needed. We are now removing that feature flag as well, to remove the possibility of disabling the patch.&lt;&#x2F;p&gt;

&lt;p&gt;You are not affected by this change if the feature flag was not manually disabled. You can refer to &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;feature_flags.html#check-if-a-feature-flag-is-enabled&quot;&gt;our documentation&lt;&#x2F;a&gt; for instructions on how to check the state of a feature flag.&lt;&#x2F;p&gt;

&lt;p&gt;If you&#x27;ve disabled this feature flag and like to maintain the existing behavior and avoid a breaking change, you can refer to our &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;instance_limits.html#maximum-size-and-depth-of-cicd-configuration-yaml-files&quot;&gt;documentation&lt;&#x2F;a&gt; for instructions on how to configure the size of your CI&#x2F;CD configuration file from the rails console.&lt;&#x2F;p&gt;
&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-leak-packagist-and-other-integration-access-tokens-by-changing-integration-url&quot;&gt;Maintainer can leak Packagist and other integration access tokens by changing integration URL&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#revoke-access-to-confidential-notes-todos&quot;&gt;Revoke access to confidential notes todos&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#pipeline-subscriptions-trigger-new-pipelines-with-the-wrong-author&quot;&gt;Pipeline subscriptions trigger new pipelines with the wrong author&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ability-to-gain-access-to-private-project-through-an-email-invite-by-using-other-users-email-address-as-an-unverified-secondary-email&quot;&gt;Ability to gain access to private project through an email invite by using other user&#x27;s email address as an unverified secondary email&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#import-via-git-protocol-allows-to-bypass-checks-on-repository&quot;&gt;Import via git protocol allows to bypass checks on repository&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthenticated-ip-allowlist-bypass-when-accessing-job-artifacts-through-gitlab-pages&quot;&gt;Unauthenticated IP allowlist bypass when accessing job artifacts through GitLab Pages&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthenticated-access-to-victims-grafana-datasources-through-path-traversal&quot;&gt;Unauthenticated access to victims Grafana datasources through path traversal&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-users-can-filter-issues-by-contact-and-organization&quot;&gt;Unauthorized users can filter issues by contact and organization&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#malicious-maintainer-may-change-the-visibility-of-project-or-a-group&quot;&gt;Malicious Maintainer may change the visibility of project or a group&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-job-error-messages&quot;&gt;Stored XSS in job error messages&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#enforced-group-mfa-can-be-bypassed-when-using-resource-owner-password-credentials-grant&quot;&gt;Enforced group MFA can be bypassed when using Resource Owner Password Credentials grant&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#non-project-members-can-view-public-projects-deploy-keys&quot;&gt;Non project members can view public project&#x27;s Deploy Keys&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#idor-in-project-with-jira-integration-leaks-project-owners-other-projects-jira-issues&quot;&gt;IDOR in project with Jira integration leaks project owner&#x27;s other projects Jira issues&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-bot-users-and-tokens-not-deleted-after-group-deletion&quot;&gt;Group Bot Users and Tokens not deleted after group deletion&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#email-invited-members-can-join-projects-even-after-the-member-lock-has-been-enabled&quot;&gt;Email invited members can join projects even after the member lock has been enabled&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#datadog-integration-returns-user-emails&quot;&gt;Datadog integration returns user emails&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;maintainer-can-leak-packagist-and-other-integration-access-tokens-by-changing-integration-url&quot;&gt;Maintainer can leak Packagist and other integration access tokens by changing integration URL&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;703 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious maintainer could exfiltrate an integration&#x27;s access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 8.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2497&quot;&gt;CVE-2022-2497&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;revoke-access-to-confidential-notes-todos&quot;&gt;Revoke access to confidential notes todos&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;705 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. Membership changes are not reflected in TODO for confidential notes, allowing a former project members to read updates via TODOs. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2512&quot;&gt;CVE-2022-2512&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;pipeline-subscriptions-trigger-new-pipelines-with-the-wrong-author&quot;&gt;Pipeline subscriptions trigger new pipelines with the wrong author&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;642 --&gt;

&lt;p&gt;An issue in pipeline subscriptions in GitLab EE affecting all versions starting from 12.8 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 triggered new pipelines with the person who created the tag as the pipeline creator instead of the subscription&#x27;s author. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2498&quot;&gt;CVE-2022-2498&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky&quot;&gt;vaib25vicky&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ability-to-gain-access-to-private-project-through-an-email-invite-by-using-other-users-email-address-as-an-unverified-secondary-email&quot;&gt;Ability to gain access to private project through an email invite by using other user&#x27;s email address as an unverified secondary email&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;685 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user&#x27;s email address as an unverified secondary email. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2326&quot;&gt;CVE-2022-2326&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky&quot;&gt;vaib25vicky&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;import-via-git-protocol-allows-to-bypass-checks-on-repository&quot;&gt;Import via git protocol allows to bypass checks on repository&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;715 --&gt;

&lt;p&gt;Insufficient validation in GitLab CE&#x2F;EE affecting all versions starting from 12.10 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.2). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2417&quot;&gt;CVE-2022-2417&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthenticated-ip-allowlist-bypass-when-accessing-job-artifacts-through-gitlab-pages&quot;&gt;Unauthenticated IP allowlist bypass when accessing job artifacts through GitLab Pages&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;722 --&gt;

&lt;p&gt;An improper access control issue in GitLab EE affecting all versions starting from 12.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows an attacker to bypass IP allow-listing and download artifacts. This attack only bypasses IP allow-listing, proper permissions are still required. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2501&quot;&gt;CVE-2022-2501&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthenticated-access-to-victims-grafana-datasources-through-path-traversal&quot;&gt;Unauthenticated access to victims Grafana datasources through path traversal&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;701 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was not performing correct authentication on Grafana API under specific conditions allowing unauthenticated users to perform queries through a path traversal vulnerability. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2531&quot;&gt;CVE-2022-2531&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-users-can-filter-issues-by-contact-and-organization&quot;&gt;Unauthorized users can filter issues by contact and organization&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;716 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 14.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1, allowed a project member to filter issues by contact and organization. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2539&quot;&gt;CVE-2022-2539&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;malicious-maintainer-may-change-the-visibility-of-project-or-a-group&quot;&gt;Malicious Maintainer may change the visibility of project or a group&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;708 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2456&quot;&gt;CVE-2022-2456&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;suruli&quot;&gt;suruli&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-job-error-messages&quot;&gt;Stored XSS in job error messages&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;720 --&gt;

&lt;p&gt;A cross-site scripting issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2500&quot;&gt;CVE-2022-2500&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;enforced-group-mfa-can-be-bypassed-when-using-resource-owner-password-credentials-grant&quot;&gt;Enforced group MFA can be bypassed when using Resource Owner Password Credentials grant&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;698 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Password Credentials grant to obtain an access token without using 2FA. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2303&quot;&gt;CVE-2022-2303&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;albatraoz&quot;&gt;albatraoz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-project-members-can-view-public-projects-deploy-keys&quot;&gt;Non project members can view public project&#x27;s Deploy Keys&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;724 --&gt;

&lt;p&gt;An improper access control check in GitLab CE&#x2F;EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project&#x27;s Deploy Key&#x27;s public fingerprint and name when that key has write permission. Note that GitLab never asks for nor stores the private key. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2095&quot;&gt;CVE-2022-2095&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jimeno&quot;&gt;jimeno&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-in-project-with-jira-integration-leaks-project-owners-other-projects-jira-issues&quot;&gt;IDOR in project with Jira integration leaks project owner&#x27;s other projects Jira issues&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;702 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab&#x27;s Jira integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Jira issues. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2499&quot;&gt;CVE-2022-2499&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-bot-users-and-tokens-not-deleted-after-group-deletion&quot;&gt;Group Bot Users and Tokens not deleted after group deletion&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;694 --&gt;

&lt;p&gt;A lack of cascading deletes in GitLab CE&#x2F;EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2307&quot;&gt;CVE-2022-2307&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered by the JiHu team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;email-invited-members-can-join-projects-even-after-the-member-lock-has-been-enabled&quot;&gt;Email invited members can join projects even after the member lock has been enabled&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;718 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to prevent members from being added to projects in a group, if the invite was sent before the setting was enabled. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2459&quot;&gt;CVE-2022-2459&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;justas_b&quot;&gt;justas_b&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;datadog-integration-returns-user-emails&quot;&gt;Datadog integration returns user emails&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;704 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 2.2). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2534&quot;&gt;CVE-2022-2534&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-bzip2&quot;&gt;Update bzip2&lt;&#x2F;h2&gt;

&lt;p&gt;The version of bzip2 has been updated to 1.0.8 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-exiftool&quot;&gt;Update exiftool&lt;&#x2F;h2&gt;

&lt;p&gt;The version of exiftool has been updated to 12.42 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 15.1.1, 15.0.4, and 14.10.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/06/30/critical-security-release-gitlab-15-1-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/06/30/critical-security-release-gitlab-15-1-1-released/</id>
<published>2022-06-30T00:00:00+00:00</published>
<updated>2022-06-30T00:00:00+00:00</updated>
<author>
<name>Nikhil George</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.1.1, 15.0.4, and 14.10.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). &lt;em&gt;Please note, this critical release will also serve as our monthly security release for June&lt;&#x2F;em&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#remote-command-execution-via-project-imports&quot;&gt;Remote Command Execution via Project Imports&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#xss-in-zentao-integration-affecting-self-hosted-instances-without-strict-csp&quot;&gt;XSS in ZenTao integration affecting self hosted instances without strict CSP&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#xss-in-project-settings-page&quot;&gt;XSS in project settings page&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unallowed-users-can-read-unprotected-ci-variables&quot;&gt;Unallowed users can read unprotected CI variables&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ip-allow-list-bypass-to-access-container-registries&quot;&gt;IP allow-list bypass to access Container Registries&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#2fa-status-is-disclosed-to-unauthenticated-users&quot;&gt;2FA status is disclosed to unauthenticated users&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#idor-in-sentry-issues&quot;&gt;IDOR in sentry issues&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#reporters-can-manage-issues-in-error-tracking&quot;&gt;Reporters can manage issues in error tracking&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ci-variables-provided-to-runners-outside-of-a-group&#x27;s-restricted-ip-range&quot;&gt;CI variables provided to runners outside of a group&#x27;s restricted IP range&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#regular-expression-denial-of-service-via-malicious-web-server-responses&quot;&gt;Regular Expression Denial of Service via malicious web server responses&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-read-for-conan-repository&quot;&gt;Unauthorized read for conan repository&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#open-redirect-vulnerability&quot;&gt;Open redirect vulnerability&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-labels-are-editable-through-subproject&quot;&gt;Group labels are editable through subproject&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#release-titles-visible-for-any-users-if-group-milestones-are-associated-with-any-project-releases&quot;&gt;Release titles visible for any users if group milestones are associated with any project releases&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#restrict-membership-by-email-domain-bypass&quot;&gt;Restrict membership by email domain bypass&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#job-information-is-leaked-to-users-who-previously-were-maintainers-via-the-runner-jobs-api-endpoint&quot;&gt;Job information is leaked to users who previously were maintainers via the Runner Jobs API endpoint&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;remote-command-execution-via-project-imports&quot;&gt;Remote Command Execution via Project Imports&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;695 --&gt;

&lt;p&gt;A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution. This is a critical severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 9.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2185&quot;&gt;CVE-2022-2185&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-in-zentao-integration-affecting-self-hosted-instances-without-strict-csp&quot;&gt;XSS in ZenTao integration affecting self hosted instances without strict CSP&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;676 --&gt;

&lt;p&gt;Insufficient sanitization in GitLab EE&#x27;s external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to perform cross-site scripting when a victim clicks on a maliciously crafted ZenTao link. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2235&quot;&gt;CVE-2022-2235&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-in-project-settings-page&quot;&gt;XSS in project settings page&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;684 --&gt;

&lt;p&gt;A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE&#x2F;EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to execute arbitrary JavaScript code in GitLab on a victim&#x27;s behalf. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2230&quot;&gt;CVE-2022-2230&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unallowed-users-can-read-unprotected-ci-variables&quot;&gt;Unallowed users can read unprotected CI variables&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;686 --&gt;

&lt;p&gt;An improper authorization issue in GitLab CE&#x2F;EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to extract the value of an unprotected variable they know the name of in public projects or private projects they&#x27;re a member of. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2229&quot;&gt;CVE-2022-2229&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shell3c&quot;&gt;shell3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ip-allow-list-bypass-to-access-container-registries&quot;&gt;IP allow-list bypass to access Container Registries&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;679 --&gt;

&lt;p&gt;Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key or a Deploy Token to misuse it from any location to access Container Registries even when IP address restrictions were configured. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1983&quot;&gt;CVE-2022-1983&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This issue was found internally by a member of the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;2fa-status-is-disclosed-to-unauthenticated-users&quot;&gt;2FA status is disclosed to unauthenticated users&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;675 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab reveals if a user has enabled two-factor authentication on their account in the HTML source, to unauthenticated users. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1963&quot;&gt;CVE-2022-1963&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;albatraoz&quot;&gt;albatraoz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ci-variables-provided-to-runners-outside-of-a-groups-restricted-ip-range&quot;&gt;CI variables provided to runners outside of a group&#x27;s restricted IP range&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;682 --&gt;

&lt;p&gt;Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI variables in a group with using IP-based access restrictions even if the GitLab Runner is calling from outside the allowed IP range. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2228&quot;&gt;CVE-2022-2228&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-in-sentry-issues&quot;&gt;IDOR in sentry issues&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;680 --&gt;

&lt;p&gt;An access control vulnerability in GitLab EE&#x2F;CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to enumerate issues in non-linked sentry projects. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2243&quot;&gt;CVE-2022-2243&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;reporters-can-manage-issues-in-error-tracking&quot;&gt;Reporters can manage issues in error tracking&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;680 --&gt;

&lt;p&gt;An improper authorization vulnerability in GitLab EE&#x2F;CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project&#x27;s error tracking feature. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2244&quot;&gt;CVE-2022-2244&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regular-expression-denial-of-service-via-malicious-web-server-responses&quot;&gt;Regular Expression Denial of Service via malicious web server responses&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;671 --&gt;

&lt;p&gt;A Regular Expression Denial of Service vulnerability in GitLab CE&#x2F;EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1954&quot;&gt;CVE-2022-1954&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;afewgoats&quot;&gt;afewgoats&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-read-for-conan-repository&quot;&gt;Unauthorized read for conan repository&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;670 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab was leaking Conan packages names due to incorrect permissions verification. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2270&quot;&gt;CVE-2022-2270&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fushbey&quot;&gt;fushbey&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;open-redirect-vulnerability&quot;&gt;Open redirect vulnerability&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;687 --&gt;

&lt;p&gt;An open redirect vulnerability in GitLab EE&#x2F;CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows redirect users to a malicious location. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:C&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2250&quot;&gt;CVE-2022-2250&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;stealthy&quot;&gt;stealthy&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-labels-are-editable-through-subproject&quot;&gt;Group labels are editable through subproject&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;683 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under certain conditions, using the REST API an unprivileged user was able to change labels description. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1999&quot;&gt;CVE-2022-1999&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;release-titles-visible-for-any-users-if-group-milestones-are-associated-with-any-project-releases&quot;&gt;Release titles visible for any users if group milestones are associated with any project releases&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;690 --&gt;

&lt;p&gt;An information disclosure vulnerability in GitLab EE affecting all versions from 12.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows disclosure of release titles if group milestones are associated with any project releases. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 2.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2281&quot;&gt;CVE-2022-2281&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;restrict-membership-by-email-domain-bypass&quot;&gt;Restrict membership by email domain bypass&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;668 --&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab, if a group enables the setting to restrict access to users belonging to specific domains, that allow-list may be bypassed if a Maintainer uses the &#x27;Invite a group&#x27; feature to invite a group that has members that don&#x27;t comply with domain allow-list. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1981&quot;&gt;CVE-2022-1981&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;muthu_prakash&quot;&gt;muthu_prakash&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;job-information-is-leaked-to-users-who-previously-were-maintainers-via-the-runner-jobs-api-endpoint&quot;&gt;Job information is leaked to users who previously were maintainers via the Runner Jobs API endpoint&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;667 --&gt;

&lt;p&gt;Improper access control in the runner jobs API in GitLab CE&#x2F;EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a previous maintainer of a project with a specific runner to access job and project meta data under certain conditions. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-2227&quot;&gt;CVE-2022-2227&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky&quot;&gt;vaib25vicky&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-rack&quot;&gt;Update rack&lt;&#x2F;h2&gt;

&lt;p&gt;The version of rack has been updated to 2.2.3.1 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 15.0.1, 14.10.4, and 14.9.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/</id>
<published>2022-06-01T00:00:00+00:00</published>
<updated>2022-06-01T00:00:00+00:00</updated>
<author>
<name>Nick Malcolm</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 15.0.1, 14.10.4, and 14.9.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). &lt;em&gt;Please note, this critical release will also serve as our monthly security release for May.&lt;&#x2F;em&gt;&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released approximately one week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#account-take-over-via-scim-email-change&quot;&gt;Account take over via SCIM email change&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-jira-integration&quot;&gt;Stored XSS in Jira integration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#quick-action-commands-susceptible-to-xss&quot;&gt;Quick action commands susceptible to XSS&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ip-allowlist-bypass-when-using-trigger-tokens&quot;&gt;IP allowlist bypass when using Trigger tokens&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ip-allowlist-bypass-when-using-project-deploy-tokens&quot;&gt;IP allowlist bypass when using Project Deploy Tokens&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-authorization-in-the-interactive-web-terminal&quot;&gt;Improper authorization in the Interactive Web Terminal&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#subgroup-member-can-list-members-of-parent-group&quot;&gt;Subgroup member can list members of parent group&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-member-lock-bypass&quot;&gt;Group member lock bypass&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;account-take-over-via-scim-email-change&quot;&gt;Account take over via SCIM email change&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;669 --&gt;

&lt;p&gt;An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change those users&#x27; email addresses via SCIM to an attacker controlled email address and thus - in the absence of 2FA - take over those accounts. It is also possible for the attacker to change the display name and username of the targeted account. This is a critical severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 9.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1680&quot;&gt;CVE-2022-1680&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by a member of the GitLab team.&lt;&#x2F;p&gt;

&lt;p&gt;Self-managed administrators can check whether &lt;code&gt;group_saml&lt;&#x2F;code&gt; is enabled by reviewing &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;saml.html#configuring-group-saml-on-a-self-managed-gitlab-instance&quot;&gt;&quot;Configuring Group SAML on a self-managed GitLab instance&quot;&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-jira-integration&quot;&gt;Stored XSS in Jira integration&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;674 --&gt;

&lt;p&gt;A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to execute arbitrary JavaScript code in GitLab on a victim&#x27;s behalf via specially crafted Jira Issues. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1940&quot;&gt;CVE-2022-1940&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;quick-action-commands-susceptible-to-xss&quot;&gt;Quick action commands susceptible to XSS&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;673 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of input used in quick actions allowed an attacker to exploit XSS by injecting HTML in contact details. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1948&quot;&gt;CVE-2022-1948&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;cryptopone&quot;&gt;cryptopone&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ip-allowlist-bypass-when-using-trigger-tokens&quot;&gt;IP allowlist bypass when using Trigger tokens&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;678 --&gt;

&lt;p&gt;Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Trigger Token to misuse it from any location even when IP address restrictions were configured. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1935&quot;&gt;CVE-2022-1935&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ip-allowlist-bypass-when-using-project-deploy-tokens&quot;&gt;IP allowlist bypass when using Project Deploy Tokens&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;677 --&gt;

&lt;p&gt;Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Deploy Token to misuse it from any location even when IP address restrictions were configured. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1936&quot;&gt;CVE-2022-1936&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This was reported by a customer through our Responsible Vulnerability Disclosure process.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-authorization-in-the-interactive-web-terminal&quot;&gt;Improper authorization in the Interactive Web Terminal&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;662 --&gt;

&lt;p&gt;When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE&#x2F;EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers&#x27; running jobs. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1944&quot;&gt;CVE-2022-1944&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;subgroup-member-can-list-members-of-parent-group&quot;&gt;Subgroup member can list members of parent group&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;672 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.8 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for a subgroup member to access the members list of their parent group. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1821&quot;&gt;CVE-2022-1821&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by a member of the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-member-lock-bypass&quot;&gt;Group member lock bypass&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;660 --&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for malicious group maintainers to add new members to a project within their group, through the REST API, even after their group owner enabled a setting to prevent members from being added to projects within that group. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1783&quot;&gt;CVE-2022-1783&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;salh4ckr&quot;&gt;salh4ckr&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Mattermost has been updated to 6.6.1 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus prior to 15.0.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 14.10.1, 14.9.4, and 14.8.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/05/02/security-release-gitlab-14-10-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/05/02/security-release-gitlab-14-10-1-released/</id>
<published>2022-05-02T00:00:00+00:00</published>
<updated>2022-05-02T00:00:00+00:00</updated>
<author>
<name>Michael Henriksen</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 14.10.1, 14.9.4, and 14.8.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-access-control-in-cicd-cache-mechanism&quot;&gt;Improper access control in CI&#x2F;CD cache mechanism&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-on-ci-editor-and-ci-pipeline-detail-pages&quot;&gt;ReDoS on CI Editor and CI Pipeline detail pages&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#user-with-developer-role-group-can-modify-protected-branches---allowed-to-merge-setting-on-imported-project&quot;&gt;User with developer role (group) can modify Protected branches -&amp;gt; Allowed to merge setting on imported project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#maintainer-can-execute-scheduled-ci-pipeline-as-another-user&quot;&gt;Maintainer can execute scheduled CI pipeline as another user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#missing-input-masking-on-sensitive-integration-properties&quot;&gt;Missing input masking on sensitive integration properties&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#api-discloses-issue-titles-of-limited-projects&quot;&gt;API discloses issue titles of limited projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#confidential-notes-disclosure&quot;&gt;Confidential notes disclosure&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-rack-attack-discriminator-for-authenticated_packages_api-with-a-deploy-token&quot;&gt;Improper rack-attack discriminator for &lt;code&gt;authenticated_packages_api&lt;&#x2F;code&gt; with a deploy token&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-access-control-in-project-members-only-wiki&quot;&gt;Improper access control in Project Members-only Wiki&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#guest-project-member-can-access-trace-log-of-jobs-when-it-is-enabled&quot;&gt;Guest project member can access trace log of jobs when it is enabled&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#html-and-css-injection-in-pipeline-error-messages&quot;&gt;HTML and CSS injection in pipeline error messages&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#forging-get-requests-through-and-denying-service-of-simple-pypi-api-endpoint&quot;&gt;Forging GET Requests through and Denying Service of Simple PyPi API Endpoint&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#missing-invalidation-of-markdown-cache-causes-potential-xss-payloads-to-persist&quot;&gt;Missing invalidation of Markdown cache causes potential XSS payloads to persist&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#conan-api-incorrectly-processes-jwt-encoded-personal-access-tokens&quot;&gt;Conan API incorrectly processes JWT-encoded Personal Access Tokens&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;improper-access-control-in-cicd-cache-mechanism&quot;&gt;Improper access control in CI&#x2F;CD cache mechanism&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;649 --&gt;

&lt;p&gt;Improper access control in the CI&#x2F;CD cache mechanism in GitLab CE&#x2F;EE affecting all versions from 1.0.2 before 14.8.6 allows a malicious actor with Developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 7.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1423&quot;&gt;CVE-2022-1423&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;wapiflapi&quot;&gt;wapiflapi&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;redos-on-ci-editor-and-ci-pipeline-detail-pages&quot;&gt;ReDoS on CI Editor and CI Pipeline detail pages&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;641 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor and CI Pipeline details page allowing the attacker to cause uncontrolled resource consumption. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1510&quot;&gt;CVE-2022-1510&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;stunninglemon&quot;&gt;stunninglemon&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-with-developer-role-group-can-modify-protected-branches---allowed-to-merge-setting-on-imported-project&quot;&gt;User with developer role (group) can modify Protected branches -&amp;gt; Allowed to merge setting on imported project&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;636 --&gt;

&lt;p&gt;Improper input validation in GitLab CE&#x2F;EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Developer to read protected Group or Project CI&#x2F;CD variables by importing a malicious project. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1406&quot;&gt;CVE-2022-1406&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;justas_b&quot;&gt;@justas_b&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;maintainer-can-execute-scheduled-ci-pipeline-as-another-user&quot;&gt;Maintainer can execute scheduled CI pipeline as another user&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;658 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a pipeline in the context of another user. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1460&quot;&gt;CVE-2022-1460&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;peterl&quot;&gt;peterl&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;missing-input-masking-on-sensitive-integration-properties&quot;&gt;Missing input masking on sensitive integration properties&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;646 --&gt;

&lt;p&gt;Missing input masking in GitLab CE&#x2F;EE affecting all versions starting from 1.0.2 before 14.8.6 causes potentially sensitive integration properties to be disclosed in the web interface. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1413&quot;&gt;CVE-2022-1413&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;api-discloses-issue-titles-of-limited-projects&quot;&gt;API discloses issue titles of limited projects&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;655 --&gt;

&lt;p&gt;Due to an insecure direct object reference vulnerability in Gitlab EE&#x2F;CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1352&quot;&gt;CVE-2022-1352&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shells3c&quot;&gt;shells3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;confidential-notes-disclosure&quot;&gt;Confidential notes disclosure&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;644 --&gt;

&lt;p&gt;It was possible to disclose details of confidential notes created via the API in Gitlab CE&#x2F;EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-rack-attack-discriminator-for-authenticated_packages_api-with-a-deploy-token&quot;&gt;Improper rack-attack discriminator for &lt;code&gt;authenticated_packages_api&lt;&#x2F;code&gt; with a deploy token&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;652 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being enforced. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1428&quot;&gt;CVE-2022-1428&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-control-in-project-members-only-wiki&quot;&gt;Improper access control in Project Members-only Wiki&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;647 --&gt;

&lt;p&gt;Improper access control in GitLab CE&#x2F;EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 8.13 before 14.9.4, and all versions starting from 8.14 before 14.10.1 allows non-project members to access contents of Project Members-only Wikis via malicious CI jobs. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1417&quot;&gt;CVE-2022-1417&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;shells3c&quot;&gt;shells3c&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;guest-project-member-can-access-trace-log-of-jobs-when-it-is-enabled&quot;&gt;Guest project member can access trace log of jobs when it is enabled&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;634 --&gt;

&lt;p&gt;An improper authorization issue has been discovered in GitLab CE&#x2F;EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to access trace log of jobs when it is enabled. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1124&quot;&gt;CVE-2022-1124&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jimeno&quot;&gt;jimeno&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;html-and-css-injection-in-pipeline-error-messages&quot;&gt;HTML and CSS injection in pipeline error messages&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;645 --&gt;

&lt;p&gt;Missing sanitization of data in Pipeline error messages in GitLab CE&#x2F;EE affecting all versions starting from 1.0.2 before 14.8.6 allows for rendering of attacker controlled HTML tags and CSS styling. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1416&quot;&gt;CVE-2022-1416&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;forging-get-requests-through-and-denying-service-of-simple-pypi-api-endpoint&quot;&gt;Forging GET Requests through and Denying Service of Simple PyPi API Endpoint&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;659 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious requests to the PyPi API endpoint allowing the attacker to cause uncontrolled resource consumption. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1431&quot;&gt;CVE-2022-1431&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;iwis&quot;&gt;iwis&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;missing-invalidation-of-markdown-cache-causes-potential-xss-payloads-to-persist&quot;&gt;Missing invalidation of Markdown cache causes potential XSS payloads to persist&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;654 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. Missing invalidation of Markdown caching causes potential payloads from a previously exploitable XSS vulnerability (CVE-2022-1175) to persist and execute. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 2.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1433&quot;&gt;CVE-2022-1433&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;stacksmashing&quot;&gt;stacksmashing&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;conan-api-incorrectly-processes-jwt-encoded-personal-access-tokens&quot;&gt;Conan API incorrectly processes JWT-encoded Personal Access Tokens&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;security&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;635 --&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1.  GitLab was not correctly authenticating a user that had some certain amount of information which allowed an user to authenticate without a personal access token. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 2.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1426&quot;&gt;CVE-2022-1426&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;firelizzard&quot;&gt;firelizzard&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-zlib&quot;&gt;Update Zlib&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Zlib has been updated to 1.2.12 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus prior to 14.8&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-ipynbdiff&quot;&gt;Update Ipynbdiff&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Ipynbdiff has been updated to 0.4.5 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE prior to 14.10&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 14.9.2, 14.8.5, and 14.7.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/</id>
<published>2022-03-31T00:00:00+00:00</published>
<updated>2022-03-31T00:00:00+00:00</updated>
<author>
<name>Dominic Couture</name>
</author>
<content type='html'>&lt;p&gt;&lt;strong&gt;Updated 14:50 UTC 2022-04-01&lt;&#x2F;strong&gt; We have updated this blog post with &lt;a href=&quot;#script-to-identify-users-potentially-impacted-by-cve-2022-1162&quot;&gt;a script to be used by self-managed instance admins to identify user accounts potentially impacted by CVE-2022-1162&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Today we are releasing versions 14.9.2, 14.8.5, and 14.7.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). &lt;em&gt;Please note, this critical release will also serve as our monthly security release for March.&lt;&#x2F;em&gt;&lt;&#x2F;p&gt;

&lt;h3 id=&quot;we-strongly-recommend-that-all-gitlab-installations-be-upgraded-to-one-of-these-versions-immediately&quot;&gt;We strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;h3&gt;

&lt;p&gt;These versions contain important security fixes. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#static-passwords-inadvertently-set-during-omniauth-based-registration&quot;&gt;Static passwords inadvertently set during OmniAuth-based registration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-notes&quot;&gt;Stored XSS in notes&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-on-multi-word-milestone-reference&quot;&gt;Stored XSS on Multi-word milestone reference&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-caused-by-a-specially-crafted-rdoc-file&quot;&gt;Denial of service caused by a specially crafted RDoc file&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#gitlab-pages-access-tokens-can-be-reused-on-multiple-domains&quot;&gt;GitLab Pages access tokens can be reused on multiple domains&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#gitlab-pages-uses-default-disabled-server-timeouts-and-a-weak-tcp-keep-alive-timeout&quot;&gt;GitLab Pages uses default (disabled) server Timeouts and a weak TCP Keep-Alive timeout&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#incorrect-include-in-pipeline-definition-exposes-masked-ci-variables-in-ui&quot;&gt;Incorrect include in pipeline definition exposes masked CI variables in UI&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#regular-expression-denial-of-service-in-release-asset-link&quot;&gt;Regular expression denial of service in release asset link&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#latest-commit-details-from-private-projects-leaked-to-guest-users-via-merge-requests&quot;&gt;Latest Commit details from private projects leaked to guest users via Merge Requests&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#cicd-analytics-are-available-even-when-public-pipelines-are-disabled&quot;&gt;CI&#x2F;CD analytics are available even when public pipelines are disabled&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#absence-of-limit-for-the-number-of-tags-that-can-be-added-to-a-runner-can-cause-performance-issues&quot;&gt;Absence of limit for the number of tags that can be added to a runner can cause performance issues&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#client-dos-through-rendering-crafted-comments&quot;&gt;Client DoS through rendering crafted comments&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#blind-ssrf-through-repository-mirroring&quot;&gt;Blind SSRF Through Repository Mirroring&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypass-of-branch-restriction-in-asana-integration&quot;&gt;Bypass of branch restriction in Asana integration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#readable-approval-rules-by-guest-user&quot;&gt;Readable approval rules by Guest user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redact-invalidurierror-error-messages&quot;&gt;Redact InvalidURIError error messages&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-import-maps-members-created_by_id-users-based-on-source-user-id&quot;&gt;Project import maps members&#x27; created_by_id users based on source user ID&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;static-passwords-inadvertently-set-during-omniauth-based-registration&quot;&gt;Static passwords inadvertently set during OmniAuth-based registration&lt;&#x2F;h2&gt;

&lt;p&gt;A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE&#x2F;EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts. This is a critical severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 9.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1162&quot;&gt;CVE-2022-1162&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;&lt;em&gt;Note:&lt;&#x2F;em&gt;&lt;&#x2F;strong&gt; We executed a reset of GitLab.com passwords for a selected set of users as of 15:38 UTC. Our investigation shows no indication that users or accounts have been compromised but we’re taking precautionary measures for our users’ security.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-notes&quot;&gt;Stored XSS in notes&lt;&#x2F;h2&gt;

&lt;p&gt;Improper neutralization of user input in GitLab CE&#x2F;EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1175&quot;&gt;CVE-2022-1175&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-on-multi-word-milestone-reference&quot;&gt;Stored XSS on Multi-word milestone reference&lt;&#x2F;h2&gt;

&lt;p&gt;Improper handling of user input in GitLab CE&#x2F;EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1190&quot;&gt;CVE-2022-1190&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryhmnlfj&quot;&gt;ryhmnlfj&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-caused-by-a-specially-crafted-rdoc-file&quot;&gt;Denial of service caused by a specially crafted RDoc file&lt;&#x2F;h2&gt;

&lt;p&gt;A denial of service vulnerability when rendering RDoc files in GitLab CE&#x2F;EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1185&quot;&gt;CVE-2022-1185&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-pages-access-tokens-can-be-reused-on-multiple-domains&quot;&gt;GitLab Pages access tokens can be reused on multiple domains&lt;&#x2F;h2&gt;

&lt;p&gt;Improper authorization in GitLab Pages included with GitLab CE&#x2F;EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to steal a user&#x27;s access token on an attacker-controlled private GitLab Pages website and reuse that token on the victim&#x27;s other private websites. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1148&quot;&gt;CVE-2022-1148&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ehhthing&quot;&gt;ehhthing&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-pages-uses-default-disabled-server-timeouts-and-a-weak-tcp-keep-alive-timeout&quot;&gt;GitLab Pages uses default (disabled) server Timeouts and a weak TCP Keep-Alive timeout&lt;&#x2F;h2&gt;

&lt;p&gt;A lack of appropriate timeouts in GitLab Pages included in GitLab CE&#x2F;EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to cause unlimited resource consumption. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1121&quot;&gt;CVE-2022-1121&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;feistel&quot;&gt;feistel&lt;&#x2F;a&gt; for reporting this vulnerability.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;incorrect-include-in-pipeline-definition-exposes-masked-ci-variables-in-ui&quot;&gt;Incorrect include in pipeline definition exposes masked CI variables in UI&lt;&#x2F;h2&gt;

&lt;p&gt;Missing filtering in an error message in GitLab CE&#x2F;EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI&#x2F;CD configuration. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1120&quot;&gt;CVE-2022-1120&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;bdrich&quot;&gt;bdrich&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regular-expression-denial-of-service-in-release-asset-link&quot;&gt;Regular expression denial of service in release asset link&lt;&#x2F;h2&gt;

&lt;p&gt;A potential DOS vulnerability was discovered in GitLab CE&#x2F;EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1100&quot;&gt;CVE-2022-1100&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;latest-commit-details-from-private-projects-leaked-to-guest-users-via-merge-requests&quot;&gt;Latest Commit details from private projects leaked to guest users via Merge Requests&lt;&#x2F;h2&gt;

&lt;p&gt;Improper access control in GitLab CE&#x2F;EE since version 10.7 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1193&quot;&gt;CVE-2022-1193&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;albatraoz&quot;&gt;albatraoz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cicd-analytics-are-available-even-when-public-pipelines-are-disabled&quot;&gt;CI&#x2F;CD analytics are available even when public pipelines are disabled&lt;&#x2F;h2&gt;

&lt;p&gt;An improper access control vulnerability in GitLab CE&#x2F;EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1105&quot;&gt;CVE-2022-1105&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;absence-of-limit-for-the-number-of-tags-that-can-be-added-to-a-runner-can-cause-performance-issues&quot;&gt;Absence of limit for the number of tags that can be added to a runner can cause performance issues&lt;&#x2F;h2&gt;

&lt;p&gt;Adding a very large number of tags to a runner in GitLab CE&#x2F;EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to impact the performance of GitLab. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1099&quot;&gt;CVE-2022-1099&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;client-dos-through-rendering-crafted-comments&quot;&gt;Client DoS through rendering crafted comments&lt;&#x2F;h2&gt;

&lt;p&gt;A potential DoS vulnerability was discovered in Gitlab CE&#x2F;EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2  allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests, Milestones, Snippets, Wiki pages, etc. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1174&quot;&gt;CVE-2022-1174&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;scaramouche31&quot;&gt;scaramouche31&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;blind-ssrf-through-repository-mirroring&quot;&gt;Blind SSRF Through Repository Mirroring&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1188&quot;&gt;CVE-2022-1188&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jimeno&quot;&gt;jimeno&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypass-of-branch-restriction-in-asana-integration&quot;&gt;Bypass of branch restriction in Asana integration&lt;&#x2F;h2&gt;

&lt;p&gt;Incorrect authorization in the Asana integration&#x27;s branch restriction feature in all versions of GitLab CE&#x2F;EE starting from version 7.8.0 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 makes it possible to close Asana tasks from unrestricted branches. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0740&quot;&gt;CVE-2022-0740&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ooooooo_q&quot;&gt;ooooooo_q&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;readable-approval-rules-by-guest-user&quot;&gt;Readable approval rules by Guest user&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 that allowed for an unauthorised user to read the approval rules of a private project. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1189&quot;&gt;CVE-2022-1189&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;redact-invalidurierror-error-messages&quot;&gt;Redact InvalidURIError error messages&lt;&#x2F;h2&gt;

&lt;p&gt;Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE&#x2F;EE causes potential sensitive values in invalid URLs to be logged. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 2.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1157&quot;&gt;CVE-2022-1157&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-import-maps-members-created_by_id-users-based-on-source-user-id&quot;&gt;Project import maps members&#x27; created_by_id users based on source user ID&lt;&#x2F;h2&gt;

&lt;p&gt;A business logic error in Project Import in GitLab CE&#x2F;EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions caused imported projects to show an incorrect user in the &#x27;Access Granted&#x27; column in the project membership pages. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-1111&quot;&gt;CVE-2022-1111&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-commonmarker&quot;&gt;Update commonmarker&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;355752 &#x2F;&#x2F;--&gt;

&lt;p&gt;The version of commonmarker has been updated to &lt;code&gt;0.23.4&lt;&#x2F;code&gt; in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-grafana&quot;&gt;Update Grafana&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;6729 &#x2F;&#x2F;--&gt;

&lt;p&gt;The version of Grafana has been updated to &lt;code&gt;7.5.15&lt;&#x2F;code&gt; in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;issues&#x2F;6714 &#x2F;&#x2F;--&gt;

&lt;p&gt;The version of Mattermost has been updated to &lt;code&gt;6.4.2&lt;&#x2F;code&gt;, &lt;code&gt;6.3.5&lt;&#x2F;code&gt;, and &lt;code&gt;6.2.5&lt;&#x2F;code&gt; in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-swagger&quot;&gt;Update Swagger&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;339696 &#x2F;&#x2F;--&gt;

&lt;p&gt;The version of Swagger has been updated to &lt;code&gt;4.0.0&lt;&#x2F;code&gt; in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-python&quot;&gt;Update Python&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;charts&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;3111 &#x2F;&#x2F;--&gt;

&lt;p&gt;The version of Python has been updated to &lt;code&gt;3.8.12&lt;&#x2F;code&gt; in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;charts&#x2F;gitlab&quot;&gt;GitLab Charts&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-go-proxyproto&quot;&gt;Update go-proxyproto&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-pages&#x2F;-&#x2F;issues&#x2F;699 &#x2F;&#x2F;--&gt;

&lt;p&gt;The version of go-proxyproto has been updated to &lt;code&gt;0.6.2&lt;&#x2F;code&gt; in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Pages&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-devise&quot;&gt;Update Devise&lt;&#x2F;h2&gt;

&lt;!-- https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;357102 &#x2F;&#x2F;--&gt;

&lt;p&gt;The version of devise-two-factor has been updated to &lt;code&gt;4.0.2&lt;&#x2F;code&gt; in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of Gitlab CE&#x2F;EE&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-security-updates&quot;&gt;Non-security updates&lt;&#x2F;h2&gt;

&lt;p&gt;14.7.7 and 14.8.5 include a non-security bug fix addressing Merge Request Approval Rules. The bug is not present in 14.9 releases.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;script-to-identify-users-potentially-impacted-by-cve-2022-1162&quot;&gt;Script to identify users potentially impacted by CVE-2022-1162&lt;&#x2F;h2&gt;

&lt;!-- Source: https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;gl-infra&#x2F;production&#x2F;-&#x2F;snippets&#x2F;2282996 &#x2F;&#x2F;--&gt;

&lt;p&gt;GitLab has prepared a script which can be used by self-managed instance admins to identify user accounts potentially impacted by CVE-2022-1162.&lt;&#x2F;p&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight ruby&quot;&gt;&lt;code&gt;&lt;span class=&quot;c1&quot;&gt;# This script identifies users who may have been impacted by &lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# CVE-2022-1162.&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# The list is not exhaustive and may not include attackers who have &lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# gained access and modified an account.&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;#&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# The START_DATE can be changed to the date a vulnerable version was&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# installed.&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;#&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# The result is a CSV printed to STDOUT containing potentially affected&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# users. The columns are:&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;#   - User ID (integer)&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;#   - Username (string)&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;#   - User&#x27;s email (string)&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;#   - Whether the user still has an automatically set password (boolean)&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;#&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# We strongly recommend that all GitLab installations be upgraded to&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# 14.9.2, 14.8.5, or 14.7.7 immediately.&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# See: https:&#x2F;&#x2F;about.gitlab.com&#x2F;releases&#x2F;2022&#x2F;03&#x2F;31&#x2F;critical-security-release-gitlab-14-9-2-released&#x2F;&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;#&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# To run the script, place this script into a file ie. &#x2F;tmp&#x2F;find-impacted-users.rb &lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;# on your GitLab instance and then run the following command to execute the script:&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;#&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;#     gitlab-rails runner &#x2F;tmp&#x2F;find-impacted-users.rb&lt;&#x2F;span&gt;
&lt;span class=&quot;c1&quot;&gt;#&lt;&#x2F;span&gt;
&lt;span class=&quot;no&quot;&gt;ActiveRecord&lt;&#x2F;span&gt;&lt;span class=&quot;o&quot;&gt;::&lt;&#x2F;span&gt;&lt;span class=&quot;no&quot;&gt;Base&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;connection&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;execute&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;s1&quot;&gt;&#x27;set statement_timeout to 600000&#x27;&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;)&lt;&#x2F;span&gt;

&lt;span class=&quot;no&quot;&gt;START_DATE&lt;&#x2F;span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;&#x2F;span&gt; &lt;span class=&quot;no&quot;&gt;Time&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;utc&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;mi&quot;&gt;2022&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;,&lt;&#x2F;span&gt; &lt;span class=&quot;mi&quot;&gt;1&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;,&lt;&#x2F;span&gt; &lt;span class=&quot;mi&quot;&gt;20&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;)&lt;&#x2F;span&gt;

&lt;span class=&quot;n&quot;&gt;user_id&lt;&#x2F;span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;&#x2F;span&gt; &lt;span class=&quot;mi&quot;&gt;0&lt;&#x2F;span&gt;

&lt;span class=&quot;n&quot;&gt;csv&lt;&#x2F;span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;&#x2F;span&gt; &lt;span class=&quot;no&quot;&gt;CSV&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;new&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;no&quot;&gt;STDOUT&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;)&lt;&#x2F;span&gt;
&lt;span class=&quot;k&quot;&gt;begin&lt;&#x2F;span&gt;
    &lt;span class=&quot;n&quot;&gt;users&lt;&#x2F;span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;&#x2F;span&gt; &lt;span class=&quot;no&quot;&gt;User&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;
        &lt;span class=&quot;nf&quot;&gt;joins&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;ss&quot;&gt;:identities&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;).&lt;&#x2F;span&gt;
        &lt;span class=&quot;nf&quot;&gt;where&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;s1&quot;&gt;&#x27;users.created_at &amp;gt;= ?&#x27;&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;,&lt;&#x2F;span&gt; &lt;span class=&quot;no&quot;&gt;START_DATE&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;).&lt;&#x2F;span&gt;
        &lt;span class=&quot;nf&quot;&gt;where&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;s1&quot;&gt;&#x27;identities.created_at &amp;gt;= ?&#x27;&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;,&lt;&#x2F;span&gt; &lt;span class=&quot;no&quot;&gt;START_DATE&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;).&lt;&#x2F;span&gt;
        &lt;span class=&quot;nf&quot;&gt;where&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;s1&quot;&gt;&#x27;users.id &amp;gt; ?&#x27;&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;,&lt;&#x2F;span&gt; &lt;span class=&quot;n&quot;&gt;user_id&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;)&lt;&#x2F;span&gt;
          
    &lt;span class=&quot;n&quot;&gt;users&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;in_batches&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;ss&quot;&gt;of: &lt;&#x2F;span&gt;&lt;span class=&quot;mi&quot;&gt;250&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;).&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;each_record&lt;&#x2F;span&gt; &lt;span class=&quot;k&quot;&gt;do&lt;&#x2F;span&gt; &lt;span class=&quot;o&quot;&gt;|&lt;&#x2F;span&gt;&lt;span class=&quot;n&quot;&gt;user&lt;&#x2F;span&gt;&lt;span class=&quot;o&quot;&gt;|&lt;&#x2F;span&gt;
      &lt;span class=&quot;n&quot;&gt;csv&lt;&#x2F;span&gt; &lt;span class=&quot;o&quot;&gt;&amp;lt;&amp;lt;&lt;&#x2F;span&gt; &lt;span class=&quot;p&quot;&gt;[&lt;&#x2F;span&gt;&lt;span class=&quot;n&quot;&gt;user&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;id&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;,&lt;&#x2F;span&gt; &lt;span class=&quot;n&quot;&gt;user&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;username&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;,&lt;&#x2F;span&gt; &lt;span class=&quot;n&quot;&gt;user&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;email&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;,&lt;&#x2F;span&gt; &lt;span class=&quot;n&quot;&gt;user&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;password_automatically_set?&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;]&lt;&#x2F;span&gt;
      &lt;span class=&quot;n&quot;&gt;user_id&lt;&#x2F;span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;&#x2F;span&gt; &lt;span class=&quot;n&quot;&gt;user&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;id&lt;&#x2F;span&gt;
    &lt;span class=&quot;k&quot;&gt;end&lt;&#x2F;span&gt;
&lt;span class=&quot;k&quot;&gt;rescue&lt;&#x2F;span&gt;
    &lt;span class=&quot;k&quot;&gt;retry&lt;&#x2F;span&gt;  
&lt;span class=&quot;k&quot;&gt;end&lt;&#x2F;span&gt;

&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;p&gt;A &lt;code&gt;false&lt;&#x2F;code&gt; value in the &lt;code&gt;user.password_automatically_set?&lt;&#x2F;code&gt; column means that the user had overwritten the random password that was originally set when creating the user via an Omniauth method (e.g. OAuth, LDAP, or SAML). Double-check these accounts to ensure that this change was intentional and not the result of exploitation.&lt;&#x2F;p&gt;

&lt;p&gt;Out of an abundance of caution it is recommended to reset the passwords for all users returned by the script. Users where &lt;code&gt;password_automatically_set?&lt;&#x2F;code&gt; is &lt;code&gt;true&lt;&#x2F;code&gt; will not notice that the password reset happened and can continue logging in using OAuth, LDAP, or SAML. Those where the value is &lt;code&gt;false&lt;&#x2F;code&gt; can also keep logging in using those authentication methods, however the password they had set themselves will not work anymore.&lt;&#x2F;p&gt;

&lt;p&gt;Users created before the installation of GitLab 14.7.0 or after the update to GitLab 14.9.2, 14.8.5, or 14.7.7 are not affected and no actions are required.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab has conducted limited testing to validate this script. As such 
this script is provided AS-IS and GitLab makes no warranties of any
kind. GITLAB HEREBY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING, WITHOUT LIMITATION, ALL IMPLIED WARRANTIES OF 
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND 
NON-INFRINGEMENT.&lt;&#x2F;p&gt;

&lt;p&gt;After identifying potentially affected user accounts, it is recommended to &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;security&#x2F;reset_user_password.html#reset-a-users-password&quot;&gt;reset a user&#x27;s password&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 14.8.2, 14.7.4, and 14.6.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/</id>
<published>2022-02-25T00:00:00+00:00</published>
<updated>2022-02-25T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;&lt;strong&gt;Updated 00:00 UTC 2022-04-11&lt;&#x2F;strong&gt;
We have clarified the &lt;a href=&quot;#hotpatch-for-runner-registration-token-disclosure-through-quick-actions&quot;&gt;hotpatch instructions for self-managed instances running select versions older than 14.6&lt;&#x2F;a&gt; related to the use of &lt;code&gt;token-prefix-patch&lt;&#x2F;code&gt;&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Updated 16:40 UTC 2022-03-04&lt;&#x2F;strong&gt;
If you are using Kubernetes runners, you will be required to manually update the Helm chart values with the new registration token. More information about updating the values can be found here: &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;kubernetes.html#store-registration-tokens-or-runner-tokens-in-secrets&quot;&gt;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;kubernetes.html#store-registration-tokens-or-runner-tokens-in-secrets&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Updated 00:00 UTC 2022-02-26&lt;&#x2F;strong&gt;
We have updated this blog post with &lt;a href=&quot;#hotpatch-for-runner-registration-token-disclosure-through-quick-actions&quot;&gt;hotpatch instructions for self-managed instances running select versions older than 14.6&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h3 id=&quot;we-strongly-recommend-that-all-gitlab-installations-be-upgraded-to-one-of-these-versions-immediately&quot;&gt;We strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;h3&gt;

&lt;p&gt;&lt;strong&gt;Note regarding Runner registration token disclosure:&lt;&#x2F;strong&gt; This update will reset runner registration tokens for your group and projects. If you use an automated process (scripts that encode the value of the registration token) to register runners, this update will break that process. However, it should have no affect on previously registered runners. If applicable to your processes, your administrator may choose to save a backup of your existing tokens which can later help identify potentially malicious registration tokens, or rogue runners. For example, if an unauthorized actor tries to register a runner using one of the revoked tokens, knowing that value will help admins monitor that type of activity.&lt;&#x2F;p&gt;

&lt;p&gt;Today we are releasing versions 14.8.2, 14.7.4, and 14.6.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). &lt;em&gt;Please note, this critical release will also serve as our monthly security release for February.&lt;&#x2F;em&gt;&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#runner-registration-token-disclosure-through-quick-actions&quot;&gt;Runner registration token disclosure through Quick Actions&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unprivileged-users-can-add-other-users-to-groups-through-an-api-endpoint&quot;&gt;Unprivileged users can add other users to groups through an API endpoint&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#inaccurate-display-of-snippet-contents-can-be-potentially-misleading-to-users&quot;&gt;Inaccurate display of Snippet contents can be potentially misleading to users&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#environment-variables-can-be-leaked-via-the-sendmail-delivery-method&quot;&gt;Environment variables can be leaked via the sendmail delivery method&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthenticated-user-enumeration-on-graphql-api&quot;&gt;Unauthenticated user enumeration on GraphQL API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#adding-a-mirror-with-ssh-credentials-can-leak-password&quot;&gt;Adding a mirror with SSH credentials can leak password&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-via-user-comments&quot;&gt;Denial of Service via user comments&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;runner-registration-token-disclosure-through-quick-actions&quot;&gt;Runner registration token disclosure through Quick Actions&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorized user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands. This is a critical severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 9.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0735&quot;&gt;CVE-2022-0735&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;0xn3va&quot;&gt;0xn3va&lt;&#x2F;a&gt; for the report on our HackerOne bug bounty program which sparked the internal investigation that uncovered this vulnerability.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unprivileged-users-can-add-other-users-to-groups-through-an-api-endpoint&quot;&gt;Unprivileged users can add other users to groups through an API endpoint&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab REST API may allow unprivileged users to add other users to groups even if that is not possible to do through the Web UI. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0549&quot;&gt;CVE-2022-0549&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was reported to us by a customer.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;inaccurate-display-of-snippet-contents-can-be-potentially-misleading-to-users&quot;&gt;Inaccurate display of Snippet contents can be potentially misleading to users&lt;&#x2F;h2&gt;

&lt;p&gt;Inaccurate display of Snippet files containing special characters in all versions of GitLab CE&#x2F;EE allows an unauthorized actor to create Snippets with misleading content, which could trick unsuspecting users into executing arbitrary commands. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0751&quot;&gt;CVE-2022-0751&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;st4nly0n&quot;&gt;st4nly0n&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;note&quot;&gt;Note&lt;&#x2F;h3&gt;

&lt;p&gt;This fix modifies our GraphQL API by adding the &lt;code&gt;hasUnretrievableBlobs&lt;&#x2F;code&gt; field to the &lt;code&gt;SnippetBlobConnection&lt;&#x2F;code&gt; type. It indicates if the snippet has unretrievable blobs. Please be aware of deploying this change if you use multi-version deployments. We encourage users to include this patch in all deployed server instances.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;environment-variables-can-be-leaked-via-the-sendmail-delivery-method&quot;&gt;Environment variables can be leaked via the sendmail delivery method&lt;&#x2F;h2&gt;

&lt;p&gt;Improper input validation in all versions of GitLab CE&#x2F;EE using sendmail to send emails allowed an unauthorized actor to steal environment variables via specially crafted email addresses. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0741&quot;&gt;CVE-2022-0741&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthenticated-user-enumeration-on-graphql-api&quot;&gt;Unauthenticated user enumeration on GraphQL API&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration by unauthenticated users through the GraphQL API. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-4191&quot;&gt;CVE-2021-4191&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mungsul&quot;&gt;mungsul&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;todb-r7&quot;&gt;todb-r7&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;adding-a-mirror-with-ssh-credentials-can-leak-password&quot;&gt;Adding a mirror with SSH credentials can leak password&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, and all versions starting from 14.8 before 14.8.2. GitLab was leaking user passwords when adding mirrors with SSH credentials under specific conditions. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.2). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0738&quot;&gt;CVE-2022-0738&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-via-user-comments&quot;&gt;Denial of Service via user comments&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting with 8.15. It was possible to trigger a DOS by using the math feature with a specific formula in issue comments. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0489&quot;&gt;CVE-2022-0489&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;cancerz&quot;&gt;cancerz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-grafana&quot;&gt;Update Grafana&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Grafana has been updated to 7.5.12 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Mattermost has been updated to 6.3.3 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus prior to 14.8.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;hotpatch-for-runner-registration-token-disclosure-through-quick-actions&quot;&gt;Hotpatch for Runner registration token disclosure through Quick Actions&lt;&#x2F;h2&gt;

&lt;p&gt;For self-managed instances not on versions 14.6 or greater, GitLab has &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;tree&#x2F;14.8.2-Security-Hotpatches&#x2F;config&#x2F;patches&#x2F;gitlab-rails&quot;&gt;published patches&lt;&#x2F;a&gt; which can be applied to
mitigate the &lt;a href=&quot;#runner-registration-token-disclosure-through-quick-actions&quot;&gt;Runner registration token disclosure through Quick Actions&lt;&#x2F;a&gt; vulnerability. These patches should be considered temporary. Any instances of GitLab should be upgraded to a patched version of 14.8.2, 14.7.4, or 14.6.5 as soon as possible.&lt;&#x2F;p&gt;

&lt;p&gt;Patches named &lt;code&gt;security-patch-$VERSION.patch&lt;&#x2F;code&gt; close the vulnerability which exposed runner registration tokens via quick action commands, and
patches named &lt;code&gt;token-prefix-patch-$VERSION.patch&lt;&#x2F;code&gt; can be applied to automate a one-time rotation of all project &amp;amp; group registration tokens.&lt;&#x2F;p&gt;

&lt;p&gt;Version-specific patches are available for GitLab releases 14.5.4, 14.4.5, 14.3.6, 14.2.7, 14.1.8, 14.0.12 and 13.12.15.&lt;&#x2F;p&gt;

&lt;p&gt;To apply the desired patch(es) on a GitLab omnibus instance, first retrieve the appropriate patchfile(s) based on the version of your instance,
and then follow the below commands (example here uses patches for 14.0.12):&lt;&#x2F;p&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight shell&quot;&gt;&lt;code&gt;&lt;span class=&quot;nb&quot;&gt;sudo &lt;&#x2F;span&gt;su
&lt;span class=&quot;nb&quot;&gt;cd&lt;&#x2F;span&gt; ~
curl &lt;span class=&quot;nt&quot;&gt;-JLO&lt;&#x2F;span&gt; https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;raw&#x2F;14.8.2-Security-Hotpatches&#x2F;config&#x2F;patches&#x2F;gitlab-rails&#x2F;security-patch-14.0.patch
curl &lt;span class=&quot;nt&quot;&gt;-JLO&lt;&#x2F;span&gt; https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;-&#x2F;raw&#x2F;14.8.2-Security-Hotpatches&#x2F;config&#x2F;patches&#x2F;gitlab-rails&#x2F;token-prefix-patch-14.0.patch
&lt;span class=&quot;nb&quot;&gt;cd&lt;&#x2F;span&gt; &#x2F;opt&#x2F;gitlab&#x2F;embedded&#x2F;service&#x2F;gitlab-rails&#x2F;
patch &lt;span class=&quot;nt&quot;&gt;-p1&lt;&#x2F;span&gt; &amp;lt;  ~&#x2F;security-patch-14.0.patch
patch &lt;span class=&quot;nt&quot;&gt;-p1&lt;&#x2F;span&gt; &amp;lt; ~&#x2F;token-prefix-patch-14.0.patch
gitlab-ctl restart
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;p&gt;After applying the &lt;code&gt;token-prefix-patch&lt;&#x2F;code&gt;, instances with a small number of groups and projects (under 10,000) can optionally use the following rails console commands to immediately reset all project &amp;amp; group runner registration tokens:&lt;&#x2F;p&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight ruby&quot;&gt;&lt;code&gt;&lt;span class=&quot;no&quot;&gt;Project&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;in_batches&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;ss&quot;&gt;of: &lt;&#x2F;span&gt;&lt;span class=&quot;mi&quot;&gt;100&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;).&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;update_all&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;ss&quot;&gt;runners_token_encrypted: &lt;&#x2F;span&gt;&lt;span class=&quot;kp&quot;&gt;nil&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;)&lt;&#x2F;span&gt;
&lt;span class=&quot;no&quot;&gt;Group&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;.&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;in_batches&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;ss&quot;&gt;of: &lt;&#x2F;span&gt;&lt;span class=&quot;mi&quot;&gt;100&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;).&lt;&#x2F;span&gt;&lt;span class=&quot;nf&quot;&gt;update_all&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;&#x2F;span&gt;&lt;span class=&quot;ss&quot;&gt;runners_token_encrypted: &lt;&#x2F;span&gt;&lt;span class=&quot;kp&quot;&gt;nil&lt;&#x2F;span&gt;&lt;span class=&quot;p&quot;&gt;)&lt;&#x2F;span&gt;
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;p&gt;GitLab has conducted limited testing to validate these patches. As such these patches are provided AS-IS and GitLab makes no warranties of any kind. GITLAB HEREBY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 14.7.1, 14.6.4, and 14.5.4</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/02/03/security-release-gitlab-14-7-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/02/03/security-release-gitlab-14-7-1-released/</id>
<published>2022-02-03T00:00:00+00:00</published>
<updated>2022-02-03T00:00:00+00:00</updated>
<author>
<name>Andrew Kelly</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 14.7.1, 14.6.4, and 14.5.4 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-post-requests-via-special-html-attributes-in-jupyter-notebooks&quot;&gt;Arbitrary POST requests via special HTML attributes in Jupyter Notebooks&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dns-rebinding-vulnerability-in-irker-irc-gateway-integration&quot;&gt;DNS Rebinding vulnerability in Irker IRC Gateway integration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#missing-certificate-validation-for-external-ci-services&quot;&gt;Missing certificate validation for external CI services&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#blind-ssrf-through-project-import&quot;&gt;Blind SSRF Through Project Import&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#open-redirect-vulnerability-in-jira-integration&quot;&gt;Open redirect vulnerability in Jira Integration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#issue-link-was-disclosing-the-linked-issue&quot;&gt;Issue link was disclosing the linked issue&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#service-desk-email-accessible-by-project-non-members&quot;&gt;Service Desk email accessible by project non-members&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#authenticated-users-can-search-other-users-by-their-private-email&quot;&gt;Authenticated users can search other users by their private email&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#external-status-checks-can-be-accepted-by-users-below-developer-access-if-the-user-is-either-author-or-assignee-of-the-target-merge-request&quot;&gt;&quot;External status checks&quot; can be accepted by users below developer access if the user is either author or assignee of the target merge request&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#deleting-packages-in-bulk-from-package-registries-may-cause-table-locks&quot;&gt;Deleting packages in bulk from package registries may cause table locks&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#autocomplete-enabled-on-specific-pages&quot;&gt;Autocomplete enabled on specific pages&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#possible-ssrf-due-to-not-blocking-shared-address-space&quot;&gt;Possible SSRF due to not blocking shared address space&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#system-notes-reveals-private-project-path-when-issue-is-moved-to-a-public-project&quot;&gt;System notes reveals private project path when Issue is moved to a public project&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#timeout-for-pages-using-markdown&quot;&gt;Timeout for pages using Markdown&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#certain-branch-names-could-not-be-protected&quot;&gt;Certain branch names could not be protected&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;arbitrary-post-requests-via-special-html-attributes-in-jupyter-notebooks&quot;&gt;Arbitrary POST requests via special HTML attributes in Jupyter Notebooks&lt;&#x2F;h2&gt;

&lt;p&gt;Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE&#x2F;EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user&#x27;s behalf leading to potential account takeover. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0427&quot;&gt;CVE-2022-0427&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;dns-rebinding-vulnerability-in-irker-irc-gateway-integration&quot;&gt;DNS Rebinding vulnerability in Irker IRC Gateway integration&lt;&#x2F;h2&gt;

&lt;p&gt;A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE&#x2F;EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0425&quot;&gt;CVE-2022-0425&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;missing-certificate-validation-for-external-ci-services&quot;&gt;Missing certificate validation for external CI services&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0123&quot;&gt;CVE-2022-0123&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;blind-ssrf-through-project-import&quot;&gt;Blind SSRF Through Project Import&lt;&#x2F;h2&gt;

&lt;p&gt;A vulnerability was discovered in GitLab starting with version 10.5. GitLab was vulnerable to a blind SSRF attack through the Project Import feature. . This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:L&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0136&quot;&gt;CVE-2022-0136&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;no1zy&quot;&gt;no1zy&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;open-redirect-vulnerability-in-jira-integration&quot;&gt;Open redirect vulnerability in Jira Integration&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLab integration with Jira that a could cause the web application to redirect the request to the attacker specified URL. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:C&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0283&quot;&gt;CVE-2022-0283&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;issue-link-was-disclosing-the-linked-issue&quot;&gt;Issue link was disclosing the linked issue&lt;&#x2F;h2&gt;

&lt;p&gt;Improper access control allowed for project non-members to retrieve issue details when it was linked to an item form the vulnerability dashboard in GitLab CE&#x2F;EE. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0390&quot;&gt;CVE-2022-0390&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;wi11&quot;&gt;wi11&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;service-desk-email-accessible-by-project-non-members&quot;&gt;Service Desk email accessible by project non-members&lt;&#x2F;h2&gt;

&lt;p&gt;Improper access control allows project non-members to retrieve the Service Desk email address in GitLab CE&#x2F;EE. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0373&quot;&gt;CVE-2022-0373&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;albatraoz&quot;&gt;albatraoz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;authenticated-users-can-search-other-users-by-their-private-email&quot;&gt;Authenticated users can search other users by their private email&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab search may allow authenticated users to search other users by their respective private emails even if a user set their email to private. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0371&quot;&gt;CVE-2022-0371&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Customers may continue to search GitLab through the following methods:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;Search via public email&lt;&#x2F;li&gt;
  &lt;li&gt;Search via username&lt;&#x2F;li&gt;
  &lt;li&gt;Query Users API for user id&lt;&#x2F;li&gt;
  &lt;li&gt;Use our new &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;api&#x2F;groups.html#list-provisioned-users&quot;&gt;Provisioned Users endpoint&lt;&#x2F;a&gt; (if you use Group SAML or SCIM)&lt;&#x2F;li&gt;
  &lt;li&gt;Use an Admin token to search for the users via the API (if you are on a GitLab self-managed instance)&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;This vulnerability was found internally by a member of the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;external-status-checks-can-be-accepted-by-users-below-developer-access-if-the-user-is-either-author-or-assignee-of-the-target-merge-request&quot;&gt;&quot;External status checks&quot; can be accepted by users below developer access if the user is either author or assignee of the target merge request&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39943&quot;&gt;CVE-2021-39943&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;deleting-packages-in-bulk-from-package-registries-may-cause-table-locks&quot;&gt;Deleting packages in bulk from package registries may cause table locks&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries which could result in a Denial of Service under specific conditions. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 4.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0477&quot;&gt;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was found internally by a member of the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;autocomplete-enabled-on-specific-pages&quot;&gt;Autocomplete enabled on specific pages&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the &lt;code&gt;Autocomplete&lt;&#x2F;code&gt; attribute of fields related to sensitive information making it possible to be retrieved under certain conditions. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0167&quot;&gt;CVE-2022-0167&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;possible-ssrf-due-to-not-blocking-shared-address-space&quot;&gt;Possible SSRF due to not blocking shared address space&lt;&#x2F;h2&gt;

&lt;p&gt;A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked. . This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0249&quot;&gt;CVE-2022-0249&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;no1zy&quot;&gt;no1zy&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;system-notes-reveals-private-project-path-when-issue-is-moved-to-a-public-project&quot;&gt;System notes reveals private project path when Issue is moved to a public project&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0344&quot;&gt;CVE-2022-0344&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;timeout-for-pages-using-markdown&quot;&gt;Timeout for pages using Markdown&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by using a specific amount of block-quotes. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0488&quot;&gt;CVE-2022-0488&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;certain-branch-names-could-not-be-protected&quot;&gt;Certain branch names could not be protected&lt;&#x2F;h2&gt;

&lt;p&gt;In some cases, branch names containing HTML tags were not properly being protected. This is a follow-up to &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39931&quot;&gt;CVE-2021-39931&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Mattermost has been updated to 6.1.1 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus prior to 14.7&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-go&quot;&gt;Update Go&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Go used in the GitLab Omnibus &lt;code&gt;.gitlab-ci.yml&lt;&#x2F;code&gt; file has been updated to 2.9.1 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus prior to 14.7&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-rouge&quot;&gt;Update Rouge&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Rouge has been updated to 3.27.0 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mermaid&quot;&gt;Update Mermaid&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Mermaid has been updated to 8.13.10 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 14.6.2, 14.5.3, and 14.4.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2022/01/11/security-release-gitlab-14-6-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2022/01/11/security-release-gitlab-14-6-2-released/</id>
<published>2022-01-11T00:00:00+00:00</published>
<updated>2022-01-11T00:00:00+00:00</updated>
<author>
<name>Vitor Meireles De Sousa</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 14.6.2, 14.5.3, and 14.4.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-file-read-via-group-import-feature&quot;&gt;Arbitrary file read via group import feature&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-notes&quot;&gt;Stored XSS in notes&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#lack-of-state-parameter-on-github-import-project-oauth&quot;&gt;Lack of state parameter on GitHub import project OAuth&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#vulnerability-related-fields-are-available-to-unauthorized-users-on-graphql-api&quot;&gt;Vulnerability related fields are available to unauthorized users on GraphQL API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#deleting-packages-may-cause-table-locks&quot;&gt;Deleting packages may cause table locks&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ip-restriction-bypass-via-graphql&quot;&gt;IP restriction bypass via GraphQL&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#repository-content-spoofing-using-git-replacement-references&quot;&gt;Repository content spoofing using Git replacement references&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#users-can-import-members-from-projects-that-they-are-not-a-maintainer-on-through-api&quot;&gt;Users can import members from projects that they are not a maintainer on through API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#possibility-to-direct-user-to-malicious-site-through-slack-integration&quot;&gt;Possibility to direct user to malicious site through Slack integration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypassing-file-size-limits-to-the-npm-package-repository&quot;&gt;Bypassing file size limits to the NPM package repository&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#user-with-expired-password-can-still-access-sensitive-informations&quot;&gt;User with expired password can still access sensitive information&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#incorrect-port-validation-allows-access-to-services-on-ports-80-and-443-if-gitlab-is-configured-to-run-on-another-port&quot;&gt;Incorrect port validation allows access to services on ports 80 and 443 if GitLab is configured to run on another port&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;arbitrary-file-read-via-group-import-feature&quot;&gt;Arbitrary file read via group import feature&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group due to incorrect file handling. This is a critical severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 8.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0244&quot;&gt;CVE-2022-0244&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-notes&quot;&gt;Stored XSS in notes&lt;&#x2F;h2&gt;

&lt;p&gt;Improper neutralization of user input in GitLab CE&#x2F;EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed an attacker to exploit XSS by abusing the generation of the HTML code related to emojis. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39946&quot;&gt;CVE-2021-39946&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jarij&quot;&gt;jarij&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;lack-of-state-parameter-on-github-import-project-oauth&quot;&gt;Lack of state parameter on GitHub import project OAuth&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, and all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0154&quot;&gt;CVE-2022-0154&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;aryan2808&quot;&gt;aryan2808&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;vulnerability-related-fields-are-available-to-unauthorized-users-on-graphql-api&quot;&gt;Vulnerability related fields are available to unauthorized users on GraphQL API&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, and all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to unauthorized access to some particular fields through the GraphQL API. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0152&quot;&gt;CVE-2022-0152&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;deleting-packages-may-cause-table-locks&quot;&gt;Deleting packages may cause table locks&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, and all versions starting from 14.6.0 before 14.6.2. GitLab was not correctly handling requests to delete existing packages which could result in a Denial of Service under specific conditions. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0151&quot;&gt;CVE-2022-0151&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ip-restriction-bypass-via-graphql&quot;&gt;IP restriction bypass via GraphQL&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge
requests and milestones. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0172&quot;&gt;CVE-2022-0172&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;repository-content-spoofing-using-git-replacement-references&quot;&gt;Repository content spoofing using Git replacement references&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way that it doesn&#x27;t ignore replacement references with &lt;code&gt;git&lt;&#x2F;code&gt; sub-commands, allowing a malicious user to spoof the contents of their commits in the UI. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0090&quot;&gt;CVE-2022-0090&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;star-labs&quot;&gt;star-labs&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;users-can-import-members-from-projects-that-they-are-not-a-maintainer-on-through-api&quot;&gt;Users can import members from projects that they are not a maintainer on through API&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, and all versions starting from 14.6.0 before 14.6.2. GitLab was not verifying that a maintainer of a project had the right access to import members from a target project. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0125&quot;&gt;CVE-2022-0125&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;possibility-to-direct-user-to-malicious-site-through-slack-integration&quot;&gt;Possibility to direct user to malicious site through Slack integration&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab&#x27;s Slack integration is incorrectly validating user input and allows crafting of malicious URLs that are sent to slack. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0124&quot;&gt;CVE-2022-0124&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rafaltrojniak&quot;&gt;rafaltrojniak&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypassing-file-size-limits-to-the-npm-package-repository&quot;&gt;Bypassing file size limits to the NPM package repository&lt;&#x2F;h2&gt;

&lt;p&gt;A denial of service vulnerability in GitLab CE&#x2F;EE affecting all versions starting from 12.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, and all versions starting from 14.5 before 14.5.2, allows low-privileged users to bypass file size limits in the NPM package repository to potentially cause denial of service. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39942&quot;&gt;CVE-2021-39942&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;0xn3va&quot;&gt;0xn3va&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-with-expired-password-can-still-access-sensitive-information&quot;&gt;User with expired password can still access sensitive information&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an expired password to access sensitive information through RSS feeds. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2022-0093&quot;&gt;CVE-2022-0093&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;incorrect-port-validation-allows-access-to-services-on-ports-80-and-443-if-gitlab-is-configured-to-run-on-another-port&quot;&gt;Incorrect port validation allows access to services on ports 80 and 443 if GitLab is configured to run on another port&lt;&#x2F;h2&gt;

&lt;p&gt;Server side request forgery protections in GitLab CE&#x2F;EE versions between 8.4 and 14.4.x, between 14.5.0 and 14.5.x, and between 14.6.0 and 14.6.x would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39927&quot;&gt;CVE-2021-39927&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-prometheus&quot;&gt;Update Prometheus&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Prometheus included in GitLab Omnibus has been updated to 2.25.2 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Runner Critical Security Release: 14.5.2, 14.4.2, and 14.3.4</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/12/10/security-release-gitlab-runner-14-5-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/12/10/security-release-gitlab-runner-14-5-2-released/</id>
<published>2021-12-10T00:00:00+00:00</published>
<updated>2021-12-10T00:00:00+00:00</updated>
<author>
<name>Vitor Meireles De Sousa</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 14.5.2, 14.4.2, and 14.3.4 for GitLab Runner.&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes and we strongly recommend that all GitLab Runner installations for both GitLab.com and self-managed instances be upgraded to one of them immediately. This critical security release is for two security vulnerabilities that have been assigned a CVSS with medium severity, but that have a critical impact on GitLab.com users.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab.com Shared Runners are already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;We estimate that the number of self-managed GitLab Runner installations vulnerable to these exploits to be small due to a very specific combination of settings required to take advantage of this vulnerability. Even so, again: we strongly recommend that all GitLab Runner installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;
&lt;p&gt;We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#Specially-crafted-docker-images-can-exhaust-resources-on-managers&quot;&gt;Specially crafted docker images can exhaust resources on managers&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#Golang-vulnerability-CVE-2021-44717-dont-close-fd-0-on-ForkExec-error&quot;&gt;Golang vulnerability CVE-2021-44717: don’t close fd 0 on ForkExec error&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;specially-crafted-docker-images-can-exhaust-resources-on-managers&quot;&gt;Specially crafted docker images can exhaust resources on managers&lt;&#x2F;h2&gt;

&lt;p&gt;An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.3.4, all versions starting from 14.4 before 14.4.2, all versions starting from 14.5 before 14.5.2, allows an attacker triggering a job with a specially crafted docker image to exhaust resources on a runner manager. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39939&quot;&gt;CVE-2021-39939&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;temporary-workaround&quot;&gt;Temporary workaround&lt;&#x2F;h3&gt;

&lt;p&gt;A temporary workaround, in cases when GitLab Runner can&#x27;t be updated immediately, would be to disable the &lt;code&gt;FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR&lt;&#x2F;code&gt; feature flag in Runner&#x27;s &lt;code&gt;config.toml&lt;&#x2F;code&gt; configuration file. This will turn off the vulnerable feature and make it impossible for users to turn it on from the job level.&lt;&#x2F;p&gt;

&lt;ol&gt;
  &lt;li&gt;
    &lt;p&gt;Open the &lt;code&gt;config.toml&lt;&#x2F;code&gt; file of the Runner that you want to update.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;In each &lt;code&gt;[[runners]]&lt;&#x2F;code&gt; section add:&lt;&#x2F;p&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight toml&quot;&gt;&lt;code&gt; &lt;span class=&quot;nn&quot;&gt;[runners.feature_flags]&lt;&#x2F;span&gt;
   &lt;span class=&quot;py&quot;&gt;FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR&lt;&#x2F;span&gt; &lt;span class=&quot;p&quot;&gt;=&lt;&#x2F;span&gt; &lt;span class=&quot;kc&quot;&gt;false&lt;&#x2F;span&gt;
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;Save the file and exit.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;p&gt;After that, the runner&#x27;s process should detect the change and start applying the configuration within a minute. For this configuration change, restarting the GitLab Runner process is not required.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;golang-vulnerability-cve-2021-44717-dont-close-fd-0-on-forkexec-error&quot;&gt;Golang vulnerability CVE-2021-44717: don’t close fd 0 on ForkExec error&lt;&#x2F;h2&gt;

&lt;p&gt;All previous versions of GitLab Runner were susceptible to &lt;a href=&quot;https:&#x2F;&#x2F;groups.google.com&#x2F;g&#x2F;golang-announce&#x2F;c&#x2F;hcmEScgc00k?pli=1&quot;&gt;Golang security issue CVE-2021-44717: don’t close fd 0 on ForkExec error&lt;&#x2F;a&gt;, which could result in misdirected I&#x2F;O such as writing network traffic intended for one connection to a different connection, or content intended for one file to a different one. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39947&quot;&gt;CVE-2021-39947&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;temporary-workaround-1&quot;&gt;Temporary workaround&lt;&#x2F;h3&gt;

&lt;p&gt;A temporary workaround, in cases when GitLab Runner can&#x27;t be updated immediately, would be to increase the file descriptor limit set for the runner process. However, this is dependent on how it&#x27;s specifically configured and deployed.&lt;&#x2F;p&gt;

&lt;p&gt;Please keep in mind that updating the file descriptors limit requires restarting the runner process. To do that without interrupting any running jobs one should send a &lt;code&gt;SIGQUIT&lt;&#x2F;code&gt; signal to the runner process. This will initiate a graceful shutdown, during which the runner will not accept any new jobs but will finish all the jobs that were already started before exiting.&lt;&#x2F;p&gt;

&lt;p&gt;The ability to determine the best value for the file descriptors limit will vary depending on the load that the runners are handling and their specific configuration. Setting the limit at 50 for each potential job that can run concurrently on the runner manager is a good starting point. However, to find the best value we highly recommend monitoring the runner process and the number of file descriptors that it uses and adjust as needed depending on the specific needs.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;&quot;&gt;find your installation method and steps for updating here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 14.5.2, 14.4.4, and 14.3.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/</id>
<published>2021-12-06T00:00:00+00:00</published>
<updated>2021-12-06T00:00:00+00:00</updated>
<author>
<name>Rohit Shambhuni</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 14.5.2, 14.4.4, and 14.3.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#group-members-with-developer-role-can-escalate-their-privilege-to-maintainer-on-projects-that-they-import&quot;&gt;Group members with developer role can escalate their privilege to maintainer on projects that they import&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#when-user-registration-is-limited-external-users-that-arent-developers-shouldnt-have-access-to-the-ci-lint-api&quot;&gt;When user registration is limited, external users that aren&#x27;t developers shouldn&#x27;t have access to the CI Lint API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#collision-in-access-memoization-leads-to-potential-elevated-privileges-on-groups-and-projects&quot;&gt;Collision in access memoization leads to potential elevated privileges on groups and projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-access-token-names-are-returned-for-unauthenticated-requesters&quot;&gt;Project access token names are returned for unauthenticated requesters&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#sensitive-info-disclosure-in-logs&quot;&gt;Sensitive info disclosure in logs&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#disclosure-of-a-users-custom-project-and-group-templates&quot;&gt;Disclosure of a user&#x27;s custom project and group templates&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#redos-in-maven-package-version&quot;&gt;ReDoS in Maven package version&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#potential-denial-of-service-via-the-diff-feature&quot;&gt;Potential denial of service via the Diff feature&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#regular-expression-denial-of-service-via-user-comments&quot;&gt;Regular Expression Denial of Service via user comments&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#service-desk-email-accessible-by-any-project-member&quot;&gt;Service Desk email accessible by any project member&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#regular-expression-denial-of-service-via-quick-actions&quot;&gt;Regular Expression Denial of Service via quick actions&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#idor-in-external-status-check-api-leaks-data-about-any-status-check-on-the-instance&quot;&gt;IDOR in &quot;external status check&quot; API leaks data about any status check on the instance&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#default-branch-name-visible-in-public-projects-restricting-access-to-the-source-code-repository&quot;&gt;Default branch name visible in public projects restricting access to the source code repository&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#deploy-token-allows-access-to-disabled-project-wiki&quot;&gt;Deploy token allows access to disabled project Wiki&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#regular-expression-denial-of-service-via-deploy-slash-commands&quot;&gt;Regular Expression Denial of Service via deploy Slash commands&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#users-can-reply-to-vulnerability-report-discussions-despite-only-project-members-settings&quot;&gt;Users can reply to Vulnerability Report discussions despite Only Project Members settings&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorised-deletion-of-protected-branches&quot;&gt;Unauthorised deletion of protected branches&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#author-can-approve-merge-request-after-having-access-revoked&quot;&gt;Author can approve Merge Request after having access revoked&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#html-injection-via-swagger-ui&quot;&gt;HTML Injection via Swagger UI&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;group-members-with-developer-role-can-escalate-their-privilege-to-maintainer-on-projects-that-they-import&quot;&gt;Group members with developer role can escalate their privilege to maintainer on projects that they import&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege to a maintainer on projects they import. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 7.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39944&quot;&gt;CVE-2021-39944&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @justas_b for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;when-user-registration-is-limited-external-users-that-arent-developers-shouldnt-have-access-to-the-ci-lint-api&quot;&gt;When user registration is limited, external users that aren&#x27;t developers shouldn&#x27;t have access to the CI Lint API&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39935&quot;&gt;CVE-2021-39935&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;minhli?type=user&quot;&gt;@minhli&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;collision-in-access-memoization-leads-to-potential-elevated-privileges-on-groups-and-projects&quot;&gt;Collision in access memoization leads to potential elevated privileges on groups and projects&lt;&#x2F;h2&gt;

&lt;p&gt;A collision in access memoization logic in all versions of GitLab CE&#x2F;EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39937&quot;&gt;CVE-2021-39937&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-access-token-names-are-returned-for-unauthenticated-requesters&quot;&gt;Project access token names are returned for unauthenticated requesters&lt;&#x2F;h2&gt;

&lt;p&gt;Improper access control in the GraphQL API in GitLab CE&#x2F;EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39915&quot;&gt;CVE-2021-39915&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar?type=user&quot;&gt;@joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sensitive-info-disclosure-in-logs&quot;&gt;Sensitive info disclosure in logs&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, the reset password token and new user email token are accidentally logged which may lead to information disclosure. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:L&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39919&quot;&gt;CVE-2021-39919&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by a member of the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-a-users-custom-project-and-group-templates&quot;&gt;Disclosure of a user&#x27;s custom project and group templates&lt;&#x2F;h2&gt;

&lt;p&gt;Missing authorization in GitLab EE versions starting from 12.4 before 14.3.6, starting from 14.4.0 before 14.4.4, and starting from 14.5.0 before 14.5.2 allowed an attacker to access a user&#x27;s custom project and group templates. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39930&quot;&gt;CVE-2021-39930&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog?type=user&quot;&gt;@ngalog&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;redos-in-maven-package-version&quot;&gt;ReDoS in Maven package version&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab Maven Package registry is vulnerable to a regular expression denial of service when a specifically crafted string is sent. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39940&quot;&gt;CVE-2021-39940&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;anyday?type=user&quot;&gt;@anyday&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;potential-denial-of-service-via-the-diff-feature&quot;&gt;Potential denial of service via the Diff feature&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing code changes. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39932&quot;&gt;CVE-2021-39932&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regular-expression-denial-of-service-via-user-comments&quot;&gt;Regular Expression Denial of Service via user comments&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input (notes, comments, etc) was susceptible to catastrophic backtracking that could cause a DOS attack. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39933&quot;&gt;CVE-2021-39933&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;hashkitten?type=user&quot;&gt;@hashkitten&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;service-desk-email-accessible-by-any-project-member&quot;&gt;Service Desk email accessible by any project member&lt;&#x2F;h2&gt;

&lt;p&gt;Improper access control allows any project member to retrieve the Service Desk email address in GitLab CE&#x2F;EE versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39934&quot;&gt;CVE-2021-39934&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;gratitude101?type=user&quot;&gt;@gratitude101&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regular-expression-denial-of-service-via-quick-actions&quot;&gt;Regular Expression Denial of Service via quick actions&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking that could cause a DOS attack. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39917&quot;&gt;CVE-2021-39917&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;hashkitten?type=user&quot;&gt;@hashkitten&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-in-external-status-check-api-leaks-data-about-any-status-check-on-the-instance&quot;&gt;IDOR in &quot;external status check&quot; API leaks data about any status check on the instance&lt;&#x2F;h2&gt;

&lt;p&gt;Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39916&quot;&gt;CVE-2021-39916&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar?type=user&quot;&gt;@joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;default-branch-name-visible-in-public-projects-restricting-access-to-the-source-code-repository&quot;&gt;Default branch name visible in public projects restricting access to the source code repository&lt;&#x2F;h2&gt;

&lt;p&gt;An information disclosure vulnerability in GitLab CE&#x2F;EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the default branch name for projects that restrict access to the repository to project members. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39941&quot;&gt;CVE-2021-39941&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar?type=user&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;deploy-token-allows-access-to-disabled-project-wiki&quot;&gt;Deploy token allows access to disabled project Wiki&lt;&#x2F;h2&gt;

&lt;p&gt;Improper access control in GitLab CE&#x2F;EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker in possession of a deploy token to access a project&#x27;s disabled wiki. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39936&quot;&gt;CVE-2021-39936&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky?type=user&quot;&gt;@vaib25vicky&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regular-expression-denial-of-service-via-deploy-slash-commands&quot;&gt;Regular Expression Denial of Service via deploy Slash commands&lt;&#x2F;h2&gt;

&lt;p&gt;A vulnerable regular expression pattern in GitLab CE&#x2F;EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted deploy Slash commands. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39938&quot;&gt;CVE-2021-39938&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;users-can-reply-to-vulnerability-report-discussions-despite-only-project-members-settings&quot;&gt;Users can reply to Vulnerability Report discussions despite Only Project Members settings&lt;&#x2F;h2&gt;

&lt;p&gt;Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows a user to add comments to a vulnerability which cannot be accessed. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39918&quot;&gt;CVE-2021-39918&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;wi11?type=user&quot;&gt;@wi11&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorised-deletion-of-protected-branches&quot;&gt;Unauthorised deletion of protected branches&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.11 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under specific condition an unauthorised project member was allowed to delete a protected branches due to a business logic error. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39931&quot;&gt;CVE-2021-39931&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar?type=user&quot;&gt;@joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;author-can-approve-merge-request-after-having-access-revoked&quot;&gt;Author can approve Merge Request after having access revoked&lt;&#x2F;h2&gt;

&lt;p&gt;Improper access control in the GitLab CE&#x2F;EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project access revoked. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39945&quot;&gt;CVE-2021-39945&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;muthu_prakash?type=user&quot;&gt;@muthu_prakash&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;html-injection-via-swagger-ui&quot;&gt;HTML Injection via Swagger UI&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39910&quot;&gt;CVE-2021-39910&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;muthu_prakash?type=user&quot;&gt;@kannthu&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-ruby&quot;&gt;Update Ruby&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Ruby included in GitLab Omnibus has been updated to 2.7.5 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-rails&quot;&gt;Update Rails&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Rails included in GitLab Omnibus has been updated to 6.1.4.1 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 12.8 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-ncurses&quot;&gt;Update ncurses&lt;&#x2F;h2&gt;

&lt;p&gt;The version of ncurses included in GitLab Omnibus has been updated to 6.3 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-libgcrypt&quot;&gt;Update libgcrypt&lt;&#x2F;h2&gt;

&lt;p&gt;The version of libgcrypt included in GitLab Omnibus has been updated to 1.9.4 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 10.3 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update mattermost&lt;&#x2F;h2&gt;

&lt;p&gt;The version of mattermost included in GitLab Omnibus versions 14.4.4 and 14.5.2 has been updated to 5.39.2 in order to mitigate security concerns. The version of mattermost included in GitLab Omnibus versions 14.3.6 has been updated to 5.38.4 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 14.1 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-graphql&quot;&gt;Update graphql&lt;&#x2F;h2&gt;

&lt;p&gt;The version of graphql included in GitLab Omnibus has been updated to 1.11.10 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 8.11 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mermaid&quot;&gt;Update mermaid&lt;&#x2F;h2&gt;

&lt;p&gt;The version of mermaid included in GitLab Omnibus has been updated to 8.13.4 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 14.4.1, 14.3.4, and 14.2.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/10/28/security-release-gitlab-14-4-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/10/28/security-release-gitlab-14-4-1-released/</id>
<published>2021-10-28T00:00:00+00:00</published>
<updated>2021-10-28T00:00:00+00:00</updated>
<author>
<name>Nikhil George</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 14.4.1, 14.3.4, and 14.2.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-via-ipynb-files&quot;&gt;Stored XSS via ipynb files&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unicode-characters-can-be-abused-to-commit-malicious-code-into-projects-without-notice&quot;&gt;Unicode characters can be abused to commit malicious code into projects without notice&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#pipeline-schedules-on-imported-projects-can-be-set-to-automatically-active-after-import&quot;&gt;Pipeline schedules on imported projects can be set to automatically active after import&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#potential-denial-of-service-via-workhorse&quot;&gt;Potential Denial of service via Workhorse&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-access-control-allows-merge-request-creator-to-bypass-locked-status&quot;&gt;Improper Access Control allows Merge Request creator to bypass locked status&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#projects-api-discloses-id-and-name-of-private-groups&quot;&gt;Projects API discloses ID and name of private groups&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#severity-of-an-incident-can-be-changed-by-a-guest-user&quot;&gt;Severity of an incident can be changed by a guest user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#system-root-password-accidentally-written-to-log-file&quot;&gt;System root password accidentally written to log file&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#potential-dos-via-a-malformed-tiff-image&quot;&gt;Potential DoS via a malformed TIFF image&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypass-of-codeowners-merge-request-approval-requirement&quot;&gt;Bypass of CODEOWNERS Merge Request approval requirement&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#change-project-visibility-to-a-restricted-option&quot;&gt;Change project visibility to a restricted option&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#project-exports-leak-external-webhook-token-value&quot;&gt;Project exports leak external webhook token value&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#invited-group-members-with-access-inherited-from-parent-group-continue-to-have-project-access-even-after-invited-subgroup-is-transfered&quot;&gt;Invited group members, with access inherited from parent group, continue to have project access even after invited subgroup is transfered&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#scim-token-is-visible-after-creation&quot;&gt;SCIM token is visible after creation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#regular-expression-denial-of-service-issue-when-cleaning-namespace-path&quot;&gt;Regular expression denial of service issue when cleaning namespace path&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#prevent-creation-of-scopeless-apps-using-applications-api&quot;&gt;Prevent creation of scopeless apps using applications API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#webhook-data-exposes-assignee&#x27;s-private-email-address&quot;&gt;Webhook data exposes assignee&#x27;s private email address&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;stored-xss-via-ipynb-files&quot;&gt;Stored XSS via ipynb files&lt;&#x2F;h2&gt;

&lt;p&gt;Improper validation of ipynb files in GitLab CE&#x2F;EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim&#x27;s behalf. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39906&quot;&gt;CVE-2021-39906&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @saleemrashid for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unicode-characters-can-be-abused-to-commit-malicious-code-into-projects-without-notice&quot;&gt;Unicode characters can be abused to commit malicious code into projects without notice&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE, certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code viewer UI. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39908&quot;&gt;CVE-2021-39908&lt;&#x2F;a&gt;. The general attack vector was also assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-42574&quot;&gt;CVE-2021-42574&lt;&#x2F;a&gt; by the original researchers and is known as a &quot;Trojan Source Attack&quot;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @nickboucher for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;pipeline-schedules-on-imported-projects-can-be-set-to-automatically-active-after-import&quot;&gt;Pipeline schedules on imported projects can be set to automatically active after import&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:L&lt;&#x2F;code&gt;, 6.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39895&quot;&gt;CVE-2021-39895&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @justas_b for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;potential-denial-of-service-via-workhorse&quot;&gt;Potential Denial of service via Workhorse&lt;&#x2F;h2&gt;

&lt;p&gt;A potential DOS vulnerability was discovered in GitLab CE&#x2F;EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU usage. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39907&quot;&gt;CVE-2021-39907&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @ajxchapman for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-control-allows-merge-request-creator-to-bypass-locked-status&quot;&gt;Improper Access Control allows Merge Request creator to bypass locked status&lt;&#x2F;h2&gt;

&lt;p&gt;An Improper Access Control vulnerability in the GraphQL API in GitLab CE&#x2F;EE since version 13.1 allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39904&quot;&gt;CVE-2021-39904&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @jimeno for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;projects-api-discloses-id-and-name-of-private-groups&quot;&gt;Projects API discloses ID and name of private groups&lt;&#x2F;h2&gt;

&lt;p&gt;An information disclosure vulnerability in the GitLab CE&#x2F;EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39905&quot;&gt;CVE-2021-39905&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @rafiem for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;severity-of-an-incident-can-be-changed-by-a-guest-user&quot;&gt;Severity of an incident can be changed by a guest user&lt;&#x2F;h2&gt;

&lt;p&gt;Incorrect Authorization in GitLab CE&#x2F;EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39902&quot;&gt;CVE-2021-39902&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @cradlr for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;system-root-password-accidentally-written-to-log-file&quot;&gt;System root password accidentally written to log file&lt;&#x2F;h2&gt;

&lt;p&gt;Accidental logging of system root password in the migration log in all versions of GitLab CE&#x2F;EE allows an attacker with local file system access to obtain system root-level privileges. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:L&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39913&quot;&gt;CVE-2021-39913&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;potential-dos-via-a-malformed-tiff-image&quot;&gt;Potential DoS via a malformed TIFF image&lt;&#x2F;h2&gt;

&lt;p&gt;A potential DoS vulnerability was discovered in GitLab CE&#x2F;EE starting with version 13.7. Using a malformed TIFF images was possible to trigger memory exhaustion. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39912&quot;&gt;CVE-2021-39912&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @haquaman for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypass-of-codeowners-merge-request-approval-requirement&quot;&gt;Bypass of CODEOWNERS Merge Request approval requirement&lt;&#x2F;h2&gt;

&lt;p&gt;Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE since version 11.3 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39909&quot;&gt;CVE-2021-39909&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @vaib25vicky for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;change-project-visibility-to-a-restricted-option&quot;&gt;Change project visibility to a restricted option&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 13.0, a low privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that visibility option as restricted in settings. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39903&quot;&gt;CVE-2021-39903&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @s4nderdevelopment for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-exports-leak-external-webhook-token-value&quot;&gt;Project exports leak external webhook token value&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39898&quot;&gt;CVE-2021-39898&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @xanbanx for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;invited-group-members-with-access-inherited-from-parent-group-continue-to-have-project-access-even-after-invited-subgroup-is-transfered&quot;&gt;Invited group members, with access inherited from parent group, continue to have project access even after invited subgroup is transfered&lt;&#x2F;h2&gt;

&lt;p&gt;Improper access control in GitLab CE&#x2F;EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferred. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39897&quot;&gt;CVE-2021-39897&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @joaxcar for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;scim-token-is-visible-after-creation&quot;&gt;SCIM token is visible after creation&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 2.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39901&quot;&gt;CVE-2021-39901&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @ngalog for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regular-expression-denial-of-service-issue-when-cleaning-namespace-path&quot;&gt;Regular expression denial of service issue when cleaning namespace path&lt;&#x2F;h2&gt;

&lt;p&gt;A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0
could cause excessive usage of resources when a specially crafted username was used when provisioning a new user. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39914&quot;&gt;CVE-2021-39914&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team&lt;&#x2F;p&gt;

&lt;h2 id=&quot;prevent-creation-of-scopeless-apps-using-applications-api&quot;&gt;Prevent creation of scopeless apps using applications API&lt;&#x2F;h2&gt;

&lt;p&gt;The application api in GitLab CE&#x2F;EE version 10.5 and above allowed creation of scopeless apps. This is a low severity issue and is now mitigated in latest release.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team&lt;&#x2F;p&gt;

&lt;h2 id=&quot;webhook-data-exposes-assignees-private-email-address&quot;&gt;Webhook data exposes assignee&#x27;s private email address&lt;&#x2F;h2&gt;

&lt;p&gt;An improper access control flaw in GitLab CE&#x2F;EE since version 13.9 exposes private email address of Issue and Merge Requests assignee to Webhook data consumers. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:P&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 1.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39914&quot;&gt;CVE-2021-39911&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-redis&quot;&gt;Update Redis&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Redis included in GitLab Omnibus has been updated to 6.0.16 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-openssl&quot;&gt;Update OpenSSL&lt;&#x2F;h2&gt;

&lt;p&gt;The version of OpenSSL included in GitLab Omnibus has been updated to 1.1.1l in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-curl&quot;&gt;Update Curl&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Curl included in GitLab Omnibus has been updated to 7.79.1 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 14.3.1, 14.2.5, and 14.1.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/09/30/security-release-gitlab-14-3-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/09/30/security-release-gitlab-14-3-1-released/</id>
<published>2021-09-30T00:00:00+00:00</published>
<updated>2021-09-30T00:00:00+00:00</updated>
<author>
<name>Michael Henriksen</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 14.3.1, 14.2.5, and 14.1.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-merge-request-creation-page&quot;&gt;Stored XSS in merge request creation page&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-attack-in-markdown-parser&quot;&gt;Denial-of-service attack in Markdown parser&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-cross-site-scripting-vulnerability-in-the-gitlab-flavored-markdown&quot;&gt;Stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dns-rebinding-vulnerability-in-gitea-importer&quot;&gt;DNS Rebinding vulnerability in Gitea importer&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#exposure-of-trigger-tokens-on-project-exports&quot;&gt;Exposure of trigger tokens on project exports&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-access-control-for-users-with-expired-password&quot;&gt;Improper access control for users with expired password&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#access-tokens-are-not-cleared-after-impersonation&quot;&gt;Access tokens are not cleared after impersonation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#reflected-cross-site-scripting-in-jira-integration&quot;&gt;Reflected Cross-Site Scripting in Jira Integration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#dns-rebinding-vulnerability-in-fogbugz-importer&quot;&gt;DNS Rebinding vulnerability in Fogbugz importer&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#access-tokens-persist-after-project-deletion&quot;&gt;Access tokens persist after project deletion&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#user-enumeration-vulnerability&quot;&gt;User enumeration vulnerability&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#potential-dos-via-api-requests&quot;&gt;Potential DOS via API requests&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#pending-invitations-of-public-groups-and-public-projects-are-visible-to-any-user&quot;&gt;Pending invitations of public groups and public projects are visible to any user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypass-disabled-repo-by-url-project-creation&quot;&gt;Bypass Disabled Repo by URL Project Creation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#low-privileged-users-can-see-names-of-the-private-groups-shared-in-projects&quot;&gt;Low privileged users can see names of the private groups shared in projects&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#api-discloses-sensitive-info-to-low-privileged-users&quot;&gt;API discloses sensitive info to low privileged users&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#epic-listing-do-not-honour-group-memberships&quot;&gt;Epic listing do not honour group memberships&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#insecure-direct-object-reference-vulnerability-may-lead-to-protected-branch-names-getting-disclosed&quot;&gt;Insecure Direct Object Reference vulnerability may lead to protected branch names getting disclosed&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#low-privileged-users-can-import-users-from-projects-that-they-they-are-not-a-maintainer-on&quot;&gt;Low privileged users can import users from projects that they they are not a maintainer on&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#potential-dos-via-dependencies-api&quot;&gt;Potential DOS via dependencies API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#create-a-project-with-unlimited-repository-size-through-malicious-project-import&quot;&gt;Create a project with unlimited repository size through malicious Project Import&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#bypass-disabled-bitbucket-server-import-source-project-creation&quot;&gt;Bypass disabled Bitbucket Server import source project creation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#requirement-to-enforce-2fa-is-not-honored-when-using-git-commands&quot;&gt;Requirement to enforce 2FA is not honored when using git commands&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#content-spoofing-vulnerability&quot;&gt;Content spoofing vulnerability&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-session-management-in-impersonation-feature&quot;&gt;Improper session management in impersonation feature&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#create-oauth-application-with-arbitrary-scopes-through-content-spoofing&quot;&gt;Create OAuth application with arbitrary scopes through content spoofing&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ldap-users-can-bypass-2fa-and-load-certain-pages-with-http-basic-auth&quot;&gt;LDAP users can bypass 2FA and load certain pages with HTTP Basic Auth&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#lack-of-account-lockout-on-change-password-functionality&quot;&gt;Lack of account lockout on change password functionality&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#epic-reference-was-not-updated-while-moved-between-groups&quot;&gt;Epic reference was not updated while moved between groups&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#missing-authentication-allows-disabling-of-two-factor-authentication&quot;&gt;Missing authentication allows disabling of two-factor authentication&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#information-disclosure-in-sendentry&quot;&gt;Information disclosure in SendEntry&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;stored-xss-in-merge-request-creation-page&quot;&gt;Stored XSS in merge request creation page&lt;&#x2F;h2&gt;

&lt;p&gt;A Stored XSS in merge request creation page in Gitlab EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim&#x27;s behalf via malicious approval rule names. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39885&quot;&gt;CVE-2021-39885&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-attack-in-markdown-parser&quot;&gt;Denial-of-service attack in Markdown parser&lt;&#x2F;h2&gt;

&lt;p&gt;A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted file. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39877&quot;&gt;CVE-2021-39877&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks phill for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-cross-site-scripting-vulnerability-in-the-gitlab-flavored-markdown&quot;&gt;Stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown&lt;&#x2F;h2&gt;

&lt;p&gt;A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE&#x2F;EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim&#x27;s behalf. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39887&quot;&gt;CVE-2021-39887&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks saleemrashid for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;dns-rebinding-vulnerability-in-gitea-importer&quot;&gt;DNS Rebinding vulnerability in Gitea importer&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39867&quot;&gt;CVE-2021-39867&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This issue was found internally by a member of the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;exposure-of-trigger-tokens-on-project-exports&quot;&gt;Exposure of trigger tokens on project exports&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 8.9, project exports may expose trigger tokens configured on that project. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39869&quot;&gt;CVE-2021-39869&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @mishre for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-control-for-users-with-expired-password&quot;&gt;Improper access control for users with expired password&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through git and API through access tokens acquired before password expiration. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39872&quot;&gt;CVE-2021-39872&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @joaxcar for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;access-tokens-are-not-cleared-after-impersonation&quot;&gt;Access tokens are not cleared after impersonation&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 8.0, access tokens created as part of admin&#x27;s impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 5.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39891&quot;&gt;CVE-2021-39891&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was found internally by a member of the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;reflected-cross-site-scripting-in-jira-integration&quot;&gt;Reflected Cross-Site Scripting in Jira Integration&lt;&#x2F;h2&gt;

&lt;p&gt;A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to execute arbitrary javascript code. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39878&quot;&gt;CVE-2021-39878&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks ooooooo_q for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;dns-rebinding-vulnerability-in-fogbugz-importer&quot;&gt;DNS Rebinding vulnerability in Fogbugz importer&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39894&quot;&gt;CVE-2021-39894&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;access-tokens-persist-after-project-deletion&quot;&gt;Access tokens persist after project deletion&lt;&#x2F;h2&gt;

&lt;p&gt;A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39866&quot;&gt;CVE-2021-39866&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-enumeration-vulnerability&quot;&gt;User enumeration vulnerability&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39882&quot;&gt;CVE-2021-39882&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This issue was found internally by a member of the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;potential-dos-via-api-requests&quot;&gt;Potential DOS via API requests&lt;&#x2F;h2&gt;

&lt;p&gt;A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39893&quot;&gt;CVE-2021-39893&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;pending-invitations-of-public-groups-and-public-projects-are-visible-to-any-user&quot;&gt;Pending invitations of public groups and public projects are visible to any user&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 13.6, it is possible to see pending invitations of any public group or public project by visiting an API endpoint. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39875&quot;&gt;CVE-2021-39875&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @ashish_r_padelkar for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypass-disabled-repo-by-url-project-creation&quot;&gt;Bypass Disabled Repo by URL Project Creation&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39870&quot;&gt;CVE-2021-39870&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @ngalog for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;low-privileged-users-can-see-names-of-the-private-groups-shared-in-projects&quot;&gt;Low privileged users can see names of the private groups shared in projects&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privileged users that are part of that project. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39884&quot;&gt;CVE-2021-39884&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @ashish_r_padelkar for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;api-discloses-sensitive-info-to-low-privileged-users&quot;&gt;API discloses sensitive info to low privileged users&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab EE since version 13.10, a specific API endpoint may reveal details about a private group and other sensitive info inside issue and merge request templates. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39888&quot;&gt;CVE-2021-39888&lt;&#x2F;a&gt;.
Thanks @0xn3va for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;epic-listing-do-not-honour-group-memberships&quot;&gt;Epic listing do not honour group memberships&lt;&#x2F;h2&gt;

&lt;p&gt;Improper authorization checks in GitLab EE &amp;gt; 13.11 allows subgroup members to see epics from all parent subgroups. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39883&quot;&gt;CVE-2021-39883&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insecure-direct-object-reference-vulnerability-may-lead-to-protected-branch-names-getting-disclosed&quot;&gt;Insecure Direct Object Reference vulnerability may lead to protected branch names getting disclosed&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branch. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39889&quot;&gt;CVE-2021-39889&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @ashish_r_padelkar for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;low-privileged-users-can-import-users-from-projects-that-they-they-are-not-a-maintainer-on&quot;&gt;Low privileged users can import users from projects that they they are not a maintainer on&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 12.0, a lower privileged user can import users from projects that they don&#x27;t have a maintainer role on and disclose email addresses of those users. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39892&quot;&gt;CVE-2021-39892&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @ashish_r_padelkar for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;potential-dos-via-dependencies-api&quot;&gt;Potential DOS via dependencies API&lt;&#x2F;h2&gt;

&lt;p&gt;A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22259&quot;&gt;CVE-2021-22259&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;create-a-project-with-unlimited-repository-size-through-malicious-project-import&quot;&gt;Create a project with unlimited repository size through malicious Project Import&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modifying values in a project export. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39868&quot;&gt;CVE-2021-39868&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @ngalog for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypass-disabled-bitbucket-server-import-source-project-creation&quot;&gt;Bypass disabled Bitbucket Server import source project creation&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39871&quot;&gt;CVE-2021-39871&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This issue was discovered internally by a member of the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;requirement-to-enforce-2fa-is-not-honored-when-using-git-commands&quot;&gt;Requirement to enforce 2FA is not honored when using git commands&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39874&quot;&gt;CVE-2021-39874&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @melar_dev for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;content-spoofing-vulnerability&quot;&gt;Content spoofing vulnerability&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visiting a malicious website by spoofing the content in an error response. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39873&quot;&gt;CVE-2021-39873&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @w00t1 for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-session-management-in-impersonation-feature&quot;&gt;Improper session management in impersonation feature&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the second user they impersonated, which may lead to repudiation issues. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39896&quot;&gt;CVE-2021-39896&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was reported to GitLab by a customer.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;create-oauth-application-with-arbitrary-scopes-through-content-spoofing&quot;&gt;Create OAuth application with arbitrary scopes through content spoofing&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and description. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39881&quot;&gt;CVE-2021-39881&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @executor for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ldap-users-can-bypass-2fa-and-load-certain-pages-with-http-basic-auth&quot;&gt;LDAP users can bypass 2FA and load certain pages with HTTP Basic Auth&lt;&#x2F;h2&gt;

&lt;p&gt;It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39890&quot;&gt;CVE-2021-39890&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;lack-of-account-lockout-on-change-password-functionality&quot;&gt;Lack of account lockout on change password functionality&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab CE&#x2F;EE, an attacker with access to a user’s session may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by splitting the attack over several IP addresses. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:P&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39899&quot;&gt;CVE-2021-39899&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;epic-reference-was-not-updated-while-moved-between-groups&quot;&gt;Epic reference was not updated while moved between groups&lt;&#x2F;h2&gt;

&lt;p&gt;Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 2.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39886&quot;&gt;CVE-2021-39886&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;missing-authentication-allows-disabling-of-two-factor-authentication&quot;&gt;Missing authentication allows disabling of two-factor authentication&lt;&#x2F;h2&gt;

&lt;p&gt;Missing authentication in all versions of GitLab CE&#x2F;EE since version 7.11.0 allows an attacker with access to a victim&#x27;s session to disable two-factor authentication. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:L&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.2). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39879&quot;&gt;CVE-2021-39879&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-in-sendentry&quot;&gt;Information disclosure in SendEntry&lt;&#x2F;h2&gt;

&lt;p&gt;Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 2.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-39900&quot;&gt;CVE-2021-39900&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 14.2.2, 14.1.4, and 14.0.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/08/31/security-release-gitlab-14-2-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/08/31/security-release-gitlab-14-2-2-released/</id>
<published>2021-08-31T00:00:00+00:00</published>
<updated>2021-08-31T00:00:00+00:00</updated>
<author>
<name>Andrew Kelly</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 14.2.2, 14.1.4, and 14.0.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-datadog-integration&quot;&gt;Stored XSS in DataDog Integration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#invited-group-members-continue-to-have-project-access-even-after-invited-group-is-deleted&quot;&gt;Invited group members continue to have project access even after invited group is deleted&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#specially-crafted-requests-to-apollo_upload_server-middleware-leads-to-denial-of-service&quot;&gt;Specially crafted requests to apollo_upload_server middleware leads to denial of service&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#privilege-escalation-of-an-external-user-through-project-token&quot;&gt;Privilege escalation of an external user through project token&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#missing-access-control-allows-non-admin-users-to-addremove-jira-connect-namespaces&quot;&gt;Missing access control allows non-admin users to add&#x2F;remove Jira Connect Namespaces&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#user-enumeration-on-private-instances&quot;&gt;User enumeration on private instances&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#member-e-mails-can-be-revealed-via-project-importexport-feature&quot;&gt;Member e-mails can be revealed via project import&#x2F;export feature&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-jira-integration&quot;&gt;Stored XSS in Jira integration&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-markdown-via-the-design-reference&quot;&gt;Stored XSS in markdown via the Design reference&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;stored-xss-in-datadog-integration&quot;&gt;Stored XSS in DataDog Integration&lt;&#x2F;h2&gt;

&lt;p&gt;A stored Cross-Site Scripting vulnerability in the DataDog integration in GitLab CE&#x2F;EE version 13.7 and above allows an attacker to execute arbitrary JavaScript code on the victim&#x27;s behalf. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.7). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks shells3c for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;invited-group-members-continue-to-have-project-access-even-after-invited-group-is-deleted&quot;&gt;Invited group members continue to have project access even after invited group is deleted&lt;&#x2F;h2&gt;

&lt;p&gt;Under specialized conditions, an invited group member may continue to have access to a project even after the invited group, which the member was part of, is deleted. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.8). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by the member of the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;specially-crafted-requests-to-apollo_upload_server-middleware-leads-to-denial-of-service&quot;&gt;Specially crafted requests to apollo_upload_server middleware leads to denial of service&lt;&#x2F;h2&gt;

&lt;p&gt;A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE&#x2F;EE version 11.11 and above allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks 0xn3va for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;privilege-escalation-of-an-external-user-through-project-token&quot;&gt;Privilege escalation of an external user through project token&lt;&#x2F;h2&gt;

&lt;p&gt;A user account with &#x27;external&#x27; status which is granted &#x27;Maintainer&#x27; role on any project on the GitLab instance where &#x27;project tokens&#x27; are allowed may elevate its privilege to &#x27;Internal&#x27; and access Internal projects. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.5). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @joaxcar for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;missing-access-control-allows-non-admin-users-to-addremove-jira-connect-namespaces&quot;&gt;Missing access control allows non-admin users to add&#x2F;remove Jira Connect Namespaces&lt;&#x2F;h2&gt;

&lt;p&gt;Missing access control in GitLab version 13.10 and above with Jira Cloud integration enabled allows Jira users without administrative privileges to add and remove Jira Connect Namespaces via the GitLab.com for Jira Cloud application configuration page. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 5.4). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks updatelap for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-enumeration-on-private-instances&quot;&gt;User enumeration on private instances&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. The route for &#x2F;user.keys is not restricted on instances with public visibility disabled. This allows user enumeration on such instances. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22257&quot;&gt;CVE-2021-22257&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab would like to thank a customer who reported this issue.&lt;&#x2F;p&gt;

&lt;p&gt;Upgrade note: Please be aware that the fix for this finding makes the &lt;code&gt;&#x2F;:username.keys&lt;&#x2F;code&gt; and &lt;code&gt;&#x2F;api&#x2F;v4&#x2F;users&#x2F;:id&#x2F;keys&lt;&#x2F;code&gt; endpoints behave the same. The result is that these endpoints will not be publicly accessible when the restricted public visibility setting is enabled by the instance admin. This could result in some workflows breaking. In this situation, the solution would be to create a Personal Access Token with the &lt;code&gt;read_user&lt;&#x2F;code&gt; scope.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;member-e-mails-can-be-revealed-via-project-importexport-feature&quot;&gt;Member e-mails can be revealed via project import&#x2F;export feature&lt;&#x2F;h2&gt;

&lt;p&gt;The project import&#x2F;export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22258&quot;&gt;CVE-2021-22258&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks ngalog for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-jira-integration&quot;&gt;Stored XSS in Jira integration&lt;&#x2F;h2&gt;

&lt;p&gt;A stored Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.7 and above allows an attacker to execute arbitrary JavaScript code on the victim&#x27;s behalf via malicious Jira API responses. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.0). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks thornguyen for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-markdown-via-the-design-reference&quot;&gt;Stored XSS in markdown via the Design reference&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22238&quot;&gt;CVE-2021-22238&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks vakzz for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-curl&quot;&gt;Update cURL&lt;&#x2F;h2&gt;

&lt;p&gt;The version of cURL included in GitLab Omnibus has been updated to 7.77.0 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-postgresql&quot;&gt;Update PostgreSQL&lt;&#x2F;h2&gt;

&lt;p&gt;The version of PostgreSQL that is bundled with GitLab Omnibus was updated to 12.7 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus&lt;&#x2F;p&gt;

&lt;h2 id=&quot;patch-nginx&quot;&gt;Patch nginx&lt;&#x2F;h2&gt;

&lt;p&gt;A patch was applied in GitLab Omnibus version 14.0.9 to mitigate a security concern related to nginx. Versions 14.1 and later already contain fixes for this security concern.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus 14.0 until 14.0.9&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 14.1.2, 14.0.7, and 13.12.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released/</id>
<published>2021-08-03T00:00:00+00:00</published>
<updated>2021-08-03T00:00:00+00:00</updated>
<author>
<name>Dominic Couture</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 14.1.2, 14.0.7, and 13.12.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;recommended-action&quot;&gt;Recommended Action&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version affected by the issues described below are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-mermaid-when-viewing-markdown-files&quot;&gt;Stored XSS in Mermaid when viewing Markdown files&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-default-branch-name&quot;&gt;Stored XSS in default branch name&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#perform-git-actions-with-an-impersonation-token-even-if-impersonation-is-disabled&quot;&gt;Perform Git actions with an impersonation token even if impersonation is disabled&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#tag-and-branch-name-confusion-allows-developer-to-access-protected-ci-variables&quot;&gt;Tag and branch name confusion allows Developer to access protected CI variables&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#new-subscriptions-generate-oauth-tokens-on-an-incorrect-oauth-client-application&quot;&gt;New subscriptions generate OAuth tokens on an incorrect OAuth client application&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#ability-to-list-and-delete-impersonation-tokens-for-your-own-user&quot;&gt;Ability to list and delete impersonation tokens for your own user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#pipelines-page-is-partially-visible-for-users-that-have-no-right-to-see-cicd&quot;&gt;Pipelines page is partially visible for users that have no right to see CI&#x2F;CD&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-email-validation-on-an-invite-url&quot;&gt;Improper email validation on an invite URL&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorised-user-was-able-to-add-meta-data-upon-issue-creation&quot;&gt;Unauthorised user was able to add meta data upon issue creation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-user-can-trigger-deployment-to-a-protected-environment&quot;&gt;Unauthorized user can trigger deployment to a protected environment&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#guest-in-private-project-can-see-cicd-analytics&quot;&gt;Guest in private project can see CI&#x2F;CD Analytics&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#guest-users-can-create-issues-for-sentry-errors-and-track-their-status&quot;&gt;Guest users can create issues for Sentry errors and track their status&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#private-user-email-disclosure-via-group-invitation&quot;&gt;Private user email disclosure via group invitation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#projects-are-allowed-to-add-members-with-email-address-domain-that-should-be-blocked-by-group-settings&quot;&gt;Projects are allowed to add members with email address domain that should be blocked by group settings&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#misleading-username-could-lead-to-impersonation-in-using-ssh-certificates&quot;&gt;Misleading username could lead to impersonation in using SSH Certificates&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthorized-user-is-able-to-access-and-view-project-vulnerability-reports&quot;&gt;Unauthorized user is able to access and view project vulnerability reports&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-in-repository-caused-by-malformed-commit-author&quot;&gt;Denial of service in repository caused by malformed commit author&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;stored-xss-in-mermaid-when-viewing-markdown-files&quot;&gt;Stored XSS in Mermaid when viewing Markdown files&lt;&#x2F;h2&gt;

&lt;p&gt;Insufficient input sanitization in Mermaid markdown in GitLab CE&#x2F;EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22242&quot;&gt;CVE-2021-22242&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @saleemrashid for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;note&quot;&gt;Note&lt;&#x2F;h3&gt;

&lt;p&gt;Users will no longer be able to configure &lt;code&gt;htmlLabels&lt;&#x2F;code&gt; setting in Mermaid charts.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-default-branch-name&quot;&gt;Stored XSS in default branch name&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22241&quot;&gt;CVE-2021-22241&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;perform-git-actions-with-an-impersonation-token-even-if-impersonation-is-disabled&quot;&gt;Perform Git actions with an impersonation token even if impersonation is disabled&lt;&#x2F;h2&gt;

&lt;p&gt;Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab CE&#x2F;EE versions before 13.12.9, 14.0.7, 14.1.2. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 6.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22237&quot;&gt;CVE-2021-22237&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab would like to thank a customer who reported this issue.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;tag-and-branch-name-confusion-allows-developer-to-access-protected-ci-variables&quot;&gt;Tag and branch name confusion allows Developer to access protected CI variables&lt;&#x2F;h2&gt;

&lt;p&gt;A confusion between tag and branch names in GitLab CE&#x2F;EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22252&quot;&gt;CVE-2021-22252&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @rodrigopetter for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;new-subscriptions-generate-oauth-tokens-on-an-incorrect-oauth-client-application&quot;&gt;New subscriptions generate OAuth tokens on an incorrect OAuth client application&lt;&#x2F;h2&gt;

&lt;p&gt;Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE&#x2F;EE since version 14.1. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:L&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22236&quot;&gt;CVE-2021-22236&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was found internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ability-to-list-and-delete-impersonation-tokens-for-your-own-user&quot;&gt;Ability to list and delete impersonation tokens for your own user&lt;&#x2F;h2&gt;

&lt;p&gt;Improper authorization in GitLab CE&#x2F;EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrations created for their account. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22250&quot;&gt;CVE-2021-22250&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @jimeno for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;pipelines-page-is-partially-visible-for-users-that-have-no-right-to-see-cicd&quot;&gt;Pipelines page is partially visible for users that have no right to see CI&#x2F;CD&lt;&#x2F;h2&gt;

&lt;p&gt;Improper authorization on the pipelines page in GitLab CE&#x2F;EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22248&quot;&gt;CVE-2021-22248&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-email-validation-on-an-invite-url&quot;&gt;Improper email validation on an invite URL&lt;&#x2F;h2&gt;

&lt;p&gt;Under specialized conditions, GitLab CE&#x2F;EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:L&lt;&#x2F;code&gt;, 5.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22243&quot;&gt;CVE-2021-22243&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was found internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorised-user-was-able-to-add-meta-data-upon-issue-creation&quot;&gt;Unauthorised user was able to add meta data upon issue creation&lt;&#x2F;h2&gt;

&lt;p&gt;An unauthorized user was able to insert metadata when creating new issue on GitLab CE&#x2F;EE 14.0 and later. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 5.0). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22239&quot;&gt;CVE-2021-22239&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-user-can-trigger-deployment-to-a-protected-environment&quot;&gt;Unauthorized user can trigger deployment to a protected environment&lt;&#x2F;h2&gt;

&lt;p&gt;Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:L&#x2F;A:L&lt;&#x2F;code&gt;, 4.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-CVE-2021-22253&quot;&gt;CVE-2021-22253&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @vaib25vicky for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;guest-in-private-project-can-see-cicd-analytics&quot;&gt;Guest in private project can see CI&#x2F;CD Analytics&lt;&#x2F;h2&gt;

&lt;p&gt;Improper authorization in GitLab CE&#x2F;EE affecting all versions since 13.0 allows guests in private projects to view CI&#x2F;CD analytics. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22247&quot;&gt;CVE-2021-22247&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @ashish_r_padelkar for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;guest-users-can-create-issues-for-sentry-errors-and-track-their-status&quot;&gt;Guest users can create issues for Sentry errors and track their status&lt;&#x2F;h2&gt;

&lt;p&gt;Improper authorization in GitLab CE&#x2F;EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22256&quot;&gt;CVE-2021-22256&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @maruthi12 for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-user-email-disclosure-via-group-invitation&quot;&gt;Private user email disclosure via group invitation&lt;&#x2F;h2&gt;

&lt;p&gt;A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22249&quot;&gt;CVE-2021-22249&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @jimeno for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;projects-are-allowed-to-add-members-with-email-address-domain-that-should-be-blocked-by-group-settings&quot;&gt;Projects are allowed to add members with email address domain that should be blocked by group settings&lt;&#x2F;h2&gt;

&lt;p&gt;Improper validation of invited users&#x27; email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22251&quot;&gt;CVE-2021-22251&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @ashish_r_padelkar for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;misleading-username-could-lead-to-impersonation-in-using-ssh-certificates&quot;&gt;Misleading username could lead to impersonation in using SSH Certificates&lt;&#x2F;h2&gt;

&lt;p&gt;Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE&#x2F;EE 13.1 and later through 14.1.2, 14.0.7 and 13.12.9. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22254&quot;&gt;CVE-2021-22254&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks ledz1996 for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-user-is-able-to-access-and-view-project-vulnerability-reports&quot;&gt;Unauthorized user is able to access and view project vulnerability reports&lt;&#x2F;h2&gt;

&lt;p&gt;Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22244&quot;&gt;CVE-2021-22244&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @vaib25vicky for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-in-repository-caused-by-malformed-commit-author&quot;&gt;Denial of service in repository caused by malformed commit author&lt;&#x2F;h2&gt;

&lt;p&gt;Improper validation of commit author in GitLab CE&#x2F;EE affecting all versions allowed an attacker to make several pages in a project impossible to view. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 2.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22245&quot;&gt;CVE-2021-22245&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @stanlyoncm for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;p&gt;Mattermost has been upgraded to 5.35.4 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus versions 13.10 and later&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-oauth-ruby-gem&quot;&gt;Update oauth ruby gem&lt;&#x2F;h2&gt;

&lt;p&gt;The oauth ruby gem has been upgraded to 0.5.6 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 10.6 and later&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-libgcrypt&quot;&gt;Update libgcrypt&lt;&#x2F;h2&gt;

&lt;p&gt;libgcrypt has been upgraded to 1.9.3 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous versions of GitLab Omnibus&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 14.0.4, 13.12.8, and 13.11.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/07/07/critical-security-release-gitlab-14-0-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/07/07/critical-security-release-gitlab-14-0-4-released/</id>
<published>2021-07-07T00:00:00+00:00</published>
<updated>2021-07-07T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 14.0.4, 13.12.8, and 13.11.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-file-read-via-design-feature&quot;&gt;Arbitrary file read via design feature&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;arbitrary-file-read-via-design-feature&quot;&gt;Arbitrary file read via design feature&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting with 13.11, 13.12 and 14.0. A specially crafted &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;project&#x2F;issues&#x2F;design_management.html&quot;&gt;design&lt;&#x2F;a&gt; allowed attackers to read arbitrary files on the server. This is a critical severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 9.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22234&quot;&gt;CVE-2021-22234&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 14.0.2, 13.12.6, and 13.11.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/07/01/security-release-gitlab-14-0-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/07/01/security-release-gitlab-14-0-2-released/</id>
<published>2021-07-01T00:00:00+00:00</published>
<updated>2021-07-01T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 14.0.2, 13.12.6, and 13.11.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#DoS-using-Webhook-connections&quot;&gt;DoS using Webhook connections &lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#csrf-on-graphql-api-allows-executing-mutations-through-get-requests&quot;&gt;CSRF on GraphQL API allows executing mutations through GET requests&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#private-projects-information-disclosure&quot;&gt;Private projects information disclosure&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#single-sign-on-users-not-getting-blocked&quot;&gt;Single sign-on users not getting blocked&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#some-users-can-push-to-protected-branch-with-deploy-keys&quot;&gt;Some users can push to Protected Branch with Deploy keys&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#a-deactivated-user-can-access-data-through-graphql&quot;&gt;A deactivated user can access data through GraphQL&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#reflected-xss-in-release-edit-page&quot;&gt;Reflected XSS in release edit page&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#clipboard-dom-based-xss&quot;&gt;Clipboard DOM-based XSS&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-on-audit-log&quot;&gt;Stored XSS on Audit Log&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#forks-of-public-projects-by-project-members-could-leak-codebase&quot;&gt;Forks of public projects by project members could leak codebase&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#improper-text-rendering&quot;&gt;Improper text rendering&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#html-injection-in-full-name-field&quot;&gt;HTML Injection in full name field&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-of-user-profile-page&quot;&gt;Denial of service of user profile page&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#update-nokogiri&quot;&gt;Update Nokogiri&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#update-redis&quot;&gt;Update Redis&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#update-rdoc&quot;&gt;Update Rdoc&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#update-libxml2&quot;&gt;Update libxml2&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#update-Rails-gem&quot;&gt;Update Rails gem&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;dos-using-webhook-connections&quot;&gt;DoS using Webhook connections&lt;&#x2F;h2&gt;

&lt;p&gt;A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.7). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;afewgoats&quot;&gt;afewgoats&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;csrf-on-graphql-api-allows-executing-mutations-through-get-requests&quot;&gt;CSRF on GraphQL API allows executing mutations through GET requests&lt;&#x2F;h2&gt;

&lt;p&gt;A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.1). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;az3z3l&quot;&gt;az3z3l&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-projects-information-disclosure&quot;&gt;Private projects information disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;An information disclosure vulnerability was found in GitLab EE versions 13.10 and later allowed a user to read project details. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;0xn3va&quot;&gt;0xn3va&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;single-sign-on-users-not-getting-blocked&quot;&gt;Single sign-on users not getting blocked&lt;&#x2F;h2&gt;

&lt;p&gt;Improper access control in GitLab EE before versions 13.11.6, 13.12.6, and 14.0.2 allowed users to be created via single sign on despite user cap being enabled. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.2). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;bingomzan&quot;&gt;bingomzan&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;some-users-can-push-to-protected-branch-with-deploy-keys&quot;&gt;Some users can push to Protected Branch with Deploy keys&lt;&#x2F;h2&gt;

&lt;p&gt;Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE&#x2F;EE since version 13.9. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;a-deactivated-user-can-access-data-through-graphql&quot;&gt;A deactivated user can access data through GraphQL&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions. Improper access control allows unauthorised users to access project details using Graphql. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;joaxcar&quot;&gt;joaxcar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;reflected-xss-in-release-edit-page&quot;&gt;Reflected XSS in release edit page&lt;&#x2F;h2&gt;

&lt;p&gt;A reflected cross-site scripting vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and trigger actions on their behalf if they clicked it. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 6.1). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;clipboard-dom-based-xss&quot;&gt;Clipboard DOM-based XSS&lt;&#x2F;h2&gt;

&lt;p&gt;Improper input sanitization in markdown in GitLab CE&#x2F;EE version 13.11 and up allowed an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted input. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.7). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vovohelo&quot;&gt;vovohelofor&lt;&#x2F;a&gt; reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-on-audit-log&quot;&gt;Stored XSS on Audit Log&lt;&#x2F;h2&gt;

&lt;p&gt;Client-Side code injection through Feature Flag name starting with GitLab CE&#x2F;EE 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 6.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22223&quot;&gt;CVE-2021-22223&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;forks-of-public-projects-by-project-members-could-leak-codebase&quot;&gt;Forks of public projects by project members could leak codebase&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting with 12.8. Under a special condition it was possible to access data of an internal repository through project fork done by a project member. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.9). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-text-rendering&quot;&gt;Improper text rendering&lt;&#x2F;h2&gt;

&lt;p&gt;Improper text rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE&#x2F;EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 4.9). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;html-injection-in-full-name-field&quot;&gt;HTML Injection in full name field&lt;&#x2F;h2&gt;

&lt;p&gt;HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;andor404&quot;&gt;andor404&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-of-user-profile-page&quot;&gt;Denial of service of user profile page&lt;&#x2F;h2&gt;

&lt;p&gt;A denial of service in user&#x27;s profile page is found starting with GitLab CE&#x2F;EE 8.0 that allows attacker to reject access to their profile page via using a specially crafted username. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:L&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 3.5). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;maruthi12&quot;&gt;maruthi12&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-nokogiri&quot;&gt;Update Nokogiri&lt;&#x2F;h2&gt;

&lt;p&gt;Nokogiri has been upgraded to 1.11.4 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost&quot;&gt;Update Mattermost&lt;&#x2F;h2&gt;

&lt;p&gt;Mattermost has been upgraded to 5.33.5 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 13.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-redis&quot;&gt;Update Redis&lt;&#x2F;h2&gt;

&lt;p&gt;Redis has been upgraded to 6.0.14 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 13.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-rdoc&quot;&gt;Update Rdoc&lt;&#x2F;h2&gt;

&lt;p&gt;Rdoc has been upgraded to 6.3.1 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-libxml2&quot;&gt;Update libxml2&lt;&#x2F;h2&gt;

&lt;p&gt;libxml2 has been upgraded to 2.9.11 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-rails-gem&quot;&gt;Update Rails gem&lt;&#x2F;h2&gt;

&lt;p&gt;The Rails gem has been upgraded to 6.0.3.7 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-18&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.12.2, 13.11.5, and 13.10.5</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/</id>
<published>2021-06-01T00:00:00+00:00</published>
<updated>2021-06-01T00:00:00+00:00</updated>
<author>
<name>Michael Henriksen</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.12.2, 13.11.5, and 13.10.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;additional-notes&quot;&gt;Additional notes&lt;&#x2F;h2&gt;

&lt;p&gt;In GitLab 13.10 the CI Lint API started requiring &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;api&#x2F;#authentication&quot;&gt;authentication&lt;&#x2F;a&gt; for GitLab instances where registration is disabled. Starting with this release, the CI Lint API endpoint will also require authentication when registration is limited (for example where an email domain allowlist is configured).&lt;&#x2F;p&gt;

&lt;p&gt;This version also includes a data migration to fix some records with incorrect data that causes 2FA to not be enforced for some users even if they are members of groups that require it. The root cause for the issue was already fixed but some records created before the fix need to be corrected. The migration is a background migration that will be scheduled in batches of 10,000 users at two minute intervals.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stealing-gitlab-oauth-access-tokens-using-xsleaks-in-safari&quot;&gt;Stealing GitLab OAuth access tokens using XSLeaks in Safari&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-through-recursive-triggered-pipelines&quot;&gt;Denial of service through recursive triggered pipelines&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#unauthenticated-ci-lint-api-may-lead-to-information-disclosure-and-ssrf&quot;&gt;Unauthenticated CI lint API may lead to information disclosure and SSRF&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#server-side-dos-through-rendering-crafted-markdown-documents&quot;&gt;Server-side DoS through rendering crafted Markdown documents&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#issue-and-merge-request-length-limit-is-not-being-enforced&quot;&gt;Issue and merge request length limit is not being enforced&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#insufficient-expired-password-validation&quot;&gt;Insufficient Expired Password Validation&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#xss-in-blob-viewer-of-notebooks&quot;&gt;XSS in blob viewer of notebooks&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#logging-of-sensitive-information&quot;&gt;Logging of Sensitive Information&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#on-call-rotation-information-exposed-when-removing-a-member&quot;&gt;On-call rotation information exposed when removing a member&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#spoofing-commit-author-for-signed-commits&quot;&gt;Spoofing commit author for signed commits&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;stealing-gitlab-oauth-access-tokens-using-xsleaks-in-safari&quot;&gt;Stealing GitLab OAuth access tokens using XSLeaks in Safari&lt;&#x2F;h2&gt;

&lt;p&gt;A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE&#x2F;EE since 7.10 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 8.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22213&quot;&gt;CVE-2021-22213&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks hubblebubble for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-through-recursive-triggered-pipelines&quot;&gt;Denial of service through recursive triggered pipelines&lt;&#x2F;h2&gt;

&lt;p&gt;A denial of service vulnerability in GitLab CE&#x2F;EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources. This is a high severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 7.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22181&quot;&gt;CVE-2021-22181&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthenticated-ci-lint-api-may-lead-to-information-disclosure-and-ssrf&quot;&gt;Unauthenticated CI lint API may lead to information disclosure and SSRF&lt;&#x2F;h2&gt;

&lt;p&gt;When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE&#x2F;EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22214&quot;&gt;CVE-2021-22214&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;myster?type=user&quot;&gt;@myster&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;server-side-dos-through-rendering-crafted-markdown-documents&quot;&gt;Server-side DoS through rendering crafted Markdown documents&lt;&#x2F;h2&gt;

&lt;p&gt;A denial of service vulnerability in all versions of GitLab CE&#x2F;EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22217&quot;&gt;CVE-2021-22217&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks phli for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;issue-and-merge-request-length-limit-is-not-being-enforced&quot;&gt;Issue and merge request length limit is not being enforced&lt;&#x2F;h2&gt;

&lt;p&gt;A denial of service vulnerability in all versions of GitLab CE&#x2F;EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a very long issue or merge request description. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:H&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22216&quot;&gt;CVE-2021-22216&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insufficient-expired-password-validation&quot;&gt;Insufficient Expired Password Validation&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versions starting from 13.12.0 before 13.12.2. Insufficient expired password validation in various operations allow user to maintain limited access after their password expired. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 6.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22221&quot;&gt;CVE-2021-22221&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-in-blob-viewer-of-notebooks&quot;&gt;XSS in blob viewer of notebooks&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 6.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22220&quot;&gt;CVE-2021-22220&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks (@yvvdwf)[https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf] for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;logging-of-sensitive-information&quot;&gt;Logging of Sensitive Information&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab CE&#x2F;EE since version 9.5 allows a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking. This is a medium severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.4). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22219&quot;&gt;CVE-2021-22219&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team https:&#x2F;&#x2F;gitlab.com&#x2F;dcouture.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;on-call-rotation-information-exposed-when-removing-a-member&quot;&gt;On-call rotation information exposed when removing a member&lt;&#x2F;h2&gt;

&lt;p&gt;An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members&#x27; on-call rotations in other projects. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 2.7). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22215&quot;&gt;CVE-2021-22215&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;spoofing-commit-author-for-signed-commits&quot;&gt;Spoofing commit author for signed commits&lt;&#x2F;h2&gt;

&lt;p&gt;All versions of GitLab CE&#x2F;EE starting with 12.8 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits. This is a low severity issue (&lt;code&gt;CVSS:3.0&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.6). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22218&quot;&gt;CVE-2021-22218&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks subbotin for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;enable-qsh-verification-for-atlassian-connect&quot;&gt;Enable qsh verification for Atlassian Connect&lt;&#x2F;h2&gt;

&lt;p&gt;qsh verification has been enabled for Atlassian Connect to address a breaking change in the Atlassian Connect API.&lt;&#x2F;p&gt;

&lt;p&gt;If you are using Jira Connect with a self-managed instance you need to update to these latest security releases before June 7th. If you are on GitLab.com, you do not need to do anything. For more details see &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;328267&quot;&gt;this GitLab issue&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-bindata-dependency&quot;&gt;Update bindata dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The dependency on bindata has been upgraded to 2.4.10 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-grafana-dependency&quot;&gt;Update grafana dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The dependency on Grafana has been upgraded to 7.5.4 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 13.11, 13.10 and 13.9.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive release notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;security release RSS feed&lt;&#x2F;a&gt; or our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;all-releases.xml&quot;&gt;RSS feed for all releases&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.11.2, 13.10.4, and 13.9.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-2-released/</id>
<published>2021-04-28T00:00:00+00:00</published>
<updated>2021-04-28T00:00:00+00:00</updated>
<author>
<name>Vitor Meireles De Sousa</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.11.2, 13.10.4, and 13.9.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#read_api-scoped-tokens-can-execute-mutations&quot;&gt;Read API scoped tokens can execute mutations&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#pull-mirror-credentials-are-exposed&quot;&gt;Pull mirror credentials are exposed&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#denial-of-service-when-querying-repository-branches-api&quot;&gt;Denial of Service when querying repository branches API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#non-owners-can-set-system_note_timestamp-when-creating--updating-issues&quot;&gt;Non-owners can set system_note_timestamp when creating &#x2F; updating issues&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#deploytoken-will-impersonate-a-user-with-the-same-id-when-using-dependency-proxy&quot;&gt;DeployToken will impersonate a User with the same ID when using Dependency Proxy&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#update-Python-dependency&quot;&gt;Update Python dependency&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Dependency Update - critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#update-Redis-dependency&quot;&gt;Update Redis dependency&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Dependency Update - high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#update-carrierwave-gem&quot;&gt;Update carrierwave gem&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Dependency Update - high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#update-Mermaid-npm-package&quot;&gt;Update Mermaid npm package&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Dependency Update - high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;read-api-scoped-tokens-can-execute-mutations&quot;&gt;Read API scoped tokens can execute mutations&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted in GraphQL mutation being executed. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22209&quot;&gt;CVE-2021-22209&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;pull-mirror-credentials-were-exposed&quot;&gt;Pull mirror credentials were exposed&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials were exposed and could allow other maintainers to view the credentials in plain-text. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.8). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22206&quot;&gt;CVE-2021-22206&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jlneel&quot;&gt;jlneel&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-when-querying-repository-branches-api&quot;&gt;Denial of Service when querying repository branches API&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring a query parameter and returning a considerable amount of results. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22210&quot;&gt;CVE-2021-22210&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;non-owners-can-set-system_note_timestamp-when-creating--updating-issues&quot;&gt;Non-owners can set system_note_timestamp when creating &#x2F; updating issues&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting versions prior to 13.5. Improper permission check could allow the change of timestamp for issue creation or update. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22208&quot;&gt;CVE-2021-22208&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;deploytoken-will-impersonate-a-user-with-the-same-id-when-using-dependency-proxy&quot;&gt;DeployToken will impersonate a User with the same ID when using Dependency Proxy&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a user resulting in possibly incorrect access handling. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 3.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22211&quot;&gt;CVE-2021-22211&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-python-dependency&quot;&gt;Update Python dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The dependency on Python has been upgraded to 3.7.10 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects Omnibus versions 12.0 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-redis-dependency&quot;&gt;Update Redis dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The dependency on Redis has been upgraded to 6.0.12 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 12.7 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-carrierwave-gem&quot;&gt;Update carrierwave gem&lt;&#x2F;h2&gt;

&lt;p&gt;The carrierwave gem has been upgraded to 1.3.2 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mermaid-npm-package&quot;&gt;Update Mermaid npm package&lt;&#x2F;h2&gt;

&lt;p&gt;The Mermaid npm package has been upgraded to 8.9.2 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 13.9 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 13.10.3, 13.9.6, and 13.8.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/</id>
<published>2021-04-14T00:00:00+00:00</published>
<updated>2021-04-14T00:00:00+00:00</updated>
<author>
<name>Dominic Couture</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.10.3, 13.9.6, and 13.8.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc secu
rity releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, t
he issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the
latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#Remote-code-execution-when-uploading-specially-crafted-image-files&quot;&gt;Remote code execution when uploading specially crafted image files&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#Update-Rexml&quot;&gt;Update Rexml&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Dependency update - critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;remote-code-execution-when-uploading-specially-crafted-image-files&quot;&gt;Remote code execution when uploading specially crafted image files&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 11.9. GitLab was not properly validating image files that is passed to a file parser which resulted in a remote command execution. This is a critical severity issue (&lt;code&gt;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 9.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22205&quot;&gt;CVE-2021-22205&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-rexml&quot;&gt;Update Rexml&lt;&#x2F;h2&gt;

&lt;p&gt;The Rexml ruby gem was upgraded to version 3.2.5 in order to mitigate &lt;a href=&quot;https:&#x2F;&#x2F;www.ruby-lang.org&#x2F;en&#x2F;news&#x2F;2021&#x2F;04&#x2F;05&#x2F;xml-round-trip-vulnerability-in-rexml-cve-2021-28965&#x2F;&quot;&gt;CVE-2021-28965&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 7.12 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.10.1, 13.9.5, and 13.8.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/03/31/security-release-gitlab-13-10-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/03/31/security-release-gitlab-13-10-1-released/</id>
<published>2021-03-31T00:00:00+00:00</published>
<updated>2021-03-31T00:00:00+00:00</updated>
<author>
<name>Vitor Meireles De Sousa</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.10.1, 13.9.5, and 13.8.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#arbitrary-file-read-during-project-import&quot;&gt;Arbitrary File Read During Project Import&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#kroki-arbitrary-file-readwrite&quot;&gt;Kroki Arbitrary File Read&#x2F;Write&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-cross-site-scripting-in-merge-requests&quot;&gt;Stored Cross-Site-Scripting in merge requests&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#access-data-of-an-internal-project-through-a-public-project-fork-as-an-anonymous-user&quot;&gt;Access data of an internal project through a public project fork as an anonymous user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#incident-metric-images-can-be-deleted-by-any-user&quot;&gt;Incident metric images can be deleted by any user&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#infinite-loop-when-a-user-access-a-merge-request&quot;&gt;Infinite Loop When a User Access a Merge Request&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#stored-xss-in-scoped-labels&quot;&gt;Stored XSS in scoped labels&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#admin-csrf-in-system-hooks-execution-through-api&quot;&gt;Admin CSRF in System Hooks Execution Through API&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;low&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#Update-OpenSSL-dependency&quot;&gt;Update OpenSSL dependency&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Dependency update - high&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#Update-PostgreSQL-dependency&quot;&gt;Update PostgreSQL dependency&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;Dependency update - medium&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;arbitrary-file-read-during-project-import&quot;&gt;Arbitrary File Read During Project Import&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server. This is a critical severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 9.6). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22201&quot;&gt;CVE-2021-22201&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;saltyyolk&quot;&gt;saltyyolk&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;kroki-arbitrary-file-readwrite&quot;&gt;Kroki Arbitrary File Read&#x2F;Write&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting with 13.7.9. A specially crafted Wiki page allowed attackers to read arbitrary files on the server. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 7.5). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22203&quot;&gt;CVE-2021-22203&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ledz1996&quot;&gt;@ledz1996&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-cross-site-scripting-in-merge-requests&quot;&gt;Stored Cross-Site-Scripting in merge requests&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 6.3). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22196&quot;&gt;CVE-2021-22196&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;@yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;access-data-of-an-internal-project-through-a-public-project-fork-as-an-anonymous-user&quot;&gt;Access data of an internal project through a public project fork as an anonymous user&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal repository through a public project fork as an anonymous user. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.9). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22200&quot;&gt;CVE-2021-22200&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;incident-metric-images-can-be-deleted-by-any-user&quot;&gt;Incident metric images can be deleted by any user&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of public projects. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22198&quot;&gt;CVE-2021-22198&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;infinite-loop-when-a-user-access-a-merge-request&quot;&gt;Infinite Loop When a User Access a Merge Request&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 3.5). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22197&quot;&gt;CVE-2021-22197&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-scoped-labels&quot;&gt;Stored XSS in scoped labels&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.5). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22199&quot;&gt;CVE-2021-22199&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mike12&quot;&gt;mike12&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;admin-csrf-in-system-hooks-execution-through-api&quot;&gt;Admin CSRF in System Hooks Execution Through API&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:H&#x2F;UI:R&#x2F;S:U&#x2F;C:N&#x2F;I:L&#x2F;A:N&lt;&#x2F;code&gt;, 2.4). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22202&quot;&gt;CVE-2021-22202&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mishre&quot;&gt;@mishre&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-openssl-dependency&quot;&gt;Update OpenSSL dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The dependency on OpenSSL has been upgraded to 1.1.1j in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 13.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-postgresql-dependency&quot;&gt;Update PostgreSQL dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The dependency on PostgreSQL 11 and 12 has been upgraded to 11.11 and 12.6 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 13.9.4, 13.8.6, and 13.7.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/</id>
<published>2021-03-17T00:00:00+00:00</published>
<updated>2021-03-17T00:00:00+00:00</updated>
<author>
<name>Dominic Couture</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.9.4, 13.8.6, and 13.7.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;table-of-fixes&quot;&gt;Table of Fixes&lt;&#x2F;h2&gt;

&lt;table&gt;
  &lt;thead&gt;
    &lt;tr&gt;
      &lt;th&gt;Title&lt;&#x2F;th&gt;
      &lt;th&gt;Severity&lt;&#x2F;th&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;thead&gt;
  &lt;tbody&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;a href=&quot;#remote-code-execution-via-unsafe-user-controlled-markdown-rendering-options&quot;&gt;Remote code execution via unsafe user-controlled markdown rendering options&lt;&#x2F;a&gt;&lt;&#x2F;td&gt;
      &lt;td&gt;critical&lt;&#x2F;td&gt;
    &lt;&#x2F;tr&gt;
  &lt;&#x2F;tbody&gt;
&lt;&#x2F;table&gt;

&lt;h2 id=&quot;remote-code-execution-via-unsafe-user-controlled-markdown-rendering-options&quot;&gt;Remote code execution via unsafe user-controlled markdown rendering options&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.2 allowing unauthorised authenticated users to execute arbitrary code on the server. This is a critical severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:C&#x2F;C:H&#x2F;I:H&#x2F;A:H&lt;&#x2F;code&gt;, 9.9). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22192&quot;&gt;CVE-2021-22192&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.9.2, 13.8.5 and 13.7.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/03/04/security-release-gitlab-13-9-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/03/04/security-release-gitlab-13-9-2-released/</id>
<published>2021-03-04T00:00:00+00:00</published>
<updated>2021-03-04T00:00:00+00:00</updated>
<author>
<name>Andrew Kelly</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.9.2, 13.8.5 and 13.7.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;jwt-token-leak-via-workhorse&quot;&gt;JWT token leak via Workhorse&lt;&#x2F;h2&gt;

&lt;p&gt;A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22190&quot;&gt;CVE-2021-22190&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ledz1996?type=user&quot;&gt;@ledz1996&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-wiki-pages&quot;&gt;Stored XSS in wiki pages&lt;&#x2F;h2&gt;

&lt;p&gt;Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted commit to a wiki. It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22185&quot;&gt;CVE-2021-22185&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf?type=user&quot;&gt;@yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-maintainers-are-able-to-use-the-group-cicd-variables-api&quot;&gt;Group Maintainers are able to use the Group CI&#x2F;CD Variables API&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue in GitLab CE&#x2F;EE version 9.4 and up allowed a group maintainer to modify group CI&#x2F;CD variables which should be restricted to group owners. It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22186&quot;&gt;CVE-2021-22186&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to a customer for reporting this vulnerability to the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insecure-storage-of-gitlab-session-keys&quot;&gt;Insecure storage of GitLab session keys&lt;&#x2F;h2&gt;

&lt;p&gt;In all versions of GitLab, marshalled session keys were being stored in Redis. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22194&quot;&gt;CVE-2021-22194&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to a customer for reporting this vulnerability to the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-thrift-gem&quot;&gt;Update thrift gem&lt;&#x2F;h2&gt;

&lt;p&gt;The thrift gem has been upgraded to 0.14.0 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 11.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-swagger-ui-dist-dependency&quot;&gt;Update swagger-ui-dist dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The dependency on swagger-ui-dist has been upgraded to 3.43.0 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;kannthu?type=user&quot;&gt;@kannthu&lt;&#x2F;a&gt; for reporting this through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects versions 13.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.8.4, 13.7.7 and 13.6.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/02/11/security-release-gitlab-13-8-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/02/11/security-release-gitlab-13-8-4-released/</id>
<published>2021-02-11T00:00:00+00:00</published>
<updated>2021-02-11T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.8.4, 13.7.7 and 13.6.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-certificate-validation-for-fortinet-otp&quot;&gt;Improper Certificate Validation for Fortinet OTP&lt;&#x2F;h2&gt;

&lt;p&gt;Starting with version 13.7 the Gitlab CE&#x2F;EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22189&quot;&gt;CVE-2021-22189&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-attack-on-gitlab-shell&quot;&gt;Denial of Service Attack on gitlab-shell&lt;&#x2F;h2&gt;

&lt;p&gt;Potential DoS was identified in gitlab-shell in GitLab CE&#x2F;EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22177&quot;&gt;CVE-2021-22177&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;resource-exhaustion-due-to-pending-jobs&quot;&gt;Resource exhaustion due to pending jobs&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions of Gitlab EE&#x2F;CE before 12.6.7. A potential resource exhaustion issue that allowed running or pending jobs to continue even after project was deleted. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22187&quot;&gt;CVE-2021-22187&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;confidential-issue-titles-were-exposed&quot;&gt;Confidential issue titles were exposed&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via branch logs. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22188&quot;&gt;CVE-2021-22188&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;aemirercin?type=user&quot;&gt;@aemirercin&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-control-allowed-demoted-project-members-to-access-authored-merge-requests&quot;&gt;Improper access control allowed demoted project members to access authored merge requests&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22176&quot;&gt;CVE-2021-22176&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;muthu_prakash?type=user&quot;&gt;@muthu_prakash&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-control-allowed-unauthorized-users-to-access-analytic-pages&quot;&gt;Improper access control allowed unauthorized users to access analytic pages&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting with 13.4. Improper access control allows unauthorized users to access details on analytic pages. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22180&quot;&gt;CVE-2021-22180&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar?type=user&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthenticated-ci-lint-api-may-lead-to-information-disclosure-and-ssrf&quot;&gt;Unauthenticated CI lint API may lead to information disclosure and SSRF&lt;&#x2F;h2&gt;

&lt;p&gt;When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22175&quot;&gt;CVE-2021-22175&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;myster?type=user&quot;&gt;@myster&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;prometheus-integration-in-gitlab-may-lead-to-ssrf&quot;&gt;Prometheus integration in Gitlab may lead to SSRF&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to server-side request forgery vulnerability attack due when Prometheus was used. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22178&quot;&gt;CVE-2021-22178&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf?type=user&quot;&gt;@yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.8.2, 13.7.6 and 13.6.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/02/01/security-release-gitlab-13-8-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/02/01/security-release-gitlab-13-8-2-released/</id>
<published>2021-02-01T00:00:00+00:00</published>
<updated>2021-02-01T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.8.2, 13.7.6 and 13.6.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-merge-request&quot;&gt;Stored XSS in merge request&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge requests. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22182&quot;&gt;CVE-2021-22182&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-epics-pages&quot;&gt;Stored XSS in epic&#x27;s pages&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22183&quot;&gt;CVE-2021-22183&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mike12&quot;&gt;mike12&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sensitive-graphql-variables-exposed-in-structured-log&quot;&gt;Sensitive GraphQL variables exposed in structured log&lt;&#x2F;h2&gt;

&lt;p&gt;An information disclosure issue in GitLab 12.0+ allowed a user with access to the server logs to see sensitive information that wasn&#x27;t properly redacted. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:L&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 6.2). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22184&quot;&gt;CVE-2021-22184&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;guest-user-can-see-tag-names-in-private-projects&quot;&gt;Guest user can see tag names in private projects&lt;&#x2F;h2&gt;

&lt;p&gt;Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22172&quot;&gt;CVE-2021-22172&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;izzsec?type=user&quot;&gt;@izzsec&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-via-error-message&quot;&gt;Information disclosure via error message&lt;&#x2F;h2&gt;

&lt;p&gt;An issue was identified in GitLab EE 13.4 or later which could disclose internal IP address via error messages. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22169&quot;&gt;CVE-2021-22169&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;dns-rebinding-protection-bypass&quot;&gt;DNS rebinding protection bypass&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting with 12.2. GitLab was vulnerable to a DNS rebinding protection bypass. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22179&quot;&gt;CVE-2021-22179&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;validate-existence-of-private-project&quot;&gt;Validate existence of private project&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions. Validate the use of a specific name for private project in a group was posible. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22193&quot;&gt;CVE-2021-22193&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;milindpurswani&quot;&gt;milindpurswani&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 13.7.4, 13.6.5 and 13.5.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/01/14/critical-security-release-gitlab-13-7-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/01/14/critical-security-release-gitlab-13-7-4-released/</id>
<published>2021-01-14T00:00:00+00:00</published>
<updated>2021-01-14T00:00:00+00:00</updated>
<author>
<name>Dominic Couture</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.7.4, 13.6.5 and 13.5.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security&#x2F;faq&#x2F;&quot;&gt;security FAQ&lt;&#x2F;a&gt;. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ability-to-steal-a-users-api-access-token-through-gitlab-pages&quot;&gt;Ability to steal a user&#x27;s API access token through GitLab Pages&lt;&#x2F;h2&gt;

&lt;p&gt;A way to bypass the fix released in the &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;releases&#x2F;2021&#x2F;01&#x2F;07&#x2F;security-release-gitlab-13-7-2-released&#x2F;#ability-to-steal-a-users-api-access-token-through-gitlab-pages&quot;&gt;previous security release&lt;&#x2F;a&gt; was discovered internally by the GitLab team. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 7.3). We have requested a CVE ID and will update this blog post when it is assigned.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.7.2, 13.6.4, and 13.5.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2-released/</id>
<published>2021-01-07T00:00:00+00:00</published>
<updated>2021-01-07T00:00:00+00:00</updated>
<author>
<name>Dominic Couture</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.7.2, 13.6.4, and 13.5.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-note&quot;&gt;Upgrade Note&lt;&#x2F;h2&gt;

&lt;p&gt;This release applies a database migration to configure as &lt;code&gt;Confidential&lt;&#x2F;code&gt; all instance-wide OAuth applications that are configured as &lt;code&gt;Trusted&lt;&#x2F;code&gt;. This will require the applications to send the &lt;code&gt;client_secret&lt;&#x2F;code&gt; as part of the OAuth flow, which is a best practice. The change is required to correct one of the issues in this security release. If you have any custom instance-wide applications that are having issues following this migration, it means that you have clients that aren&#x27;t sending the &lt;code&gt;client_secret&lt;&#x2F;code&gt; or are using the implicit flow during the OAuth authentication process. Here is how to solve the problem:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;The preferred way is to make the client send the &lt;code&gt;client_secret&lt;&#x2F;code&gt; using the Authorization Code flow.&lt;&#x2F;li&gt;
  &lt;li&gt;If impossible, or if there&#x27;s no way to keep the &lt;code&gt;client_secret&lt;&#x2F;code&gt; secret, then you can switch the application back to non-confidential. However, we suggest making the application non-trusted as well so that users are required to explicitly authorize the application when it requests access tokens on their behalf without the &lt;code&gt;client_secret&lt;&#x2F;code&gt;.&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;ability-to-steal-a-users-api-access-token-through-gitlab-pages&quot;&gt;Ability to steal a user&#x27;s API access token through GitLab Pages&lt;&#x2F;h2&gt;

&lt;p&gt;Insufficient validation of authentication parameters in GitLab Page for GitLab 11.5+. This is a high severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:H&#x2F;I:H&#x2F;A:N&lt;&#x2F;code&gt;, 8.1). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22171&quot;&gt;CVE-2021-22171&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;prometheus-denial-of-service-via-http-request-with-custom-method&quot;&gt;Prometheus denial of service via HTTP request with custom method&lt;&#x2F;h2&gt;

&lt;p&gt;An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22166&quot;&gt;CVE-2021-22166&lt;&#x2F;a&gt;.
.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-user-is-able-to-access-private-repository-information-under-specific-conditions&quot;&gt;Unauthorized user is able to access private repository information under specific conditions&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers within a specific project page allows attacker to have temporary read access to a public repository with project features restricted to only members. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:N&#x2F;UI:R&#x2F;S:U&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22167&quot;&gt;CVE-2021-22167&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @anshraj_srivastava for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regular-expression-denial-of-service-in-nuget-api&quot;&gt;Regular expression denial of service in NuGet API&lt;&#x2F;h2&gt;

&lt;p&gt;A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22168&quot;&gt;CVE-2021-22168&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regular-expression-denial-of-service-in-package-uploads&quot;&gt;Regular expression denial of service in package uploads&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-26414&quot;&gt;CVE-2020-26414&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-curl-dependency&quot;&gt;Update curl dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The curl dependency has been upgraded to 7.74.0 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all GitLab Omnibus versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cve-2019-3881-mitigation&quot;&gt;CVE-2019-3881 mitigation&lt;&#x2F;h2&gt;

&lt;p&gt;A patch has been applied to mitigate CVE-2019-3881 in the bundler dependency.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all GitLab Omnibus versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are &lt;strong&gt;upgraded to the latest version as soon as possible&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.6.2, 13.5.5, and 13.4.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/12/07/security-release-gitlab-13-6-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/12/07/security-release-gitlab-13-6-2-released/</id>
<published>2020-12-07T00:00:00+00:00</published>
<updated>2020-12-07T00:00:00+00:00</updated>
<author>
<name>Andrew Kelly</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.6.2, 13.5.5, and 13.4.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-in-zoom-meeting-url&quot;&gt;XSS in Zoom Meeting URL&lt;&#x2F;h2&gt;

&lt;p&gt;A XSS vulnerability exists in Gitlab CE&#x2F;EE starting with 12.4 that allows an attacker to perform cross-site scripting to other users via importing a malicious project. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:R&#x2F;S:C&#x2F;C:L&#x2F;I:L&#x2F;A:L&lt;&#x2F;code&gt;, 5.5). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-26407&quot;&gt;CVE-2020-26407&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;limited-information-disclosure-in-private-profile&quot;&gt;Limited Information Disclosure in Private Profile&lt;&#x2F;h2&gt;

&lt;p&gt;A limited information disclosure vulnerability exists in Gitlab CE&#x2F;EE  starting with 12.2 that allows an attacker to view limited information in user&#x27;s private profile. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-26408&quot;&gt;CVE-2020-26408&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;maruthi12&quot;&gt;@maruthi12&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-email-exposed-via-graphql-endpoint&quot;&gt;User email exposed via GraphQL endpoint&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL starting in GitLab 13.4 results in user email being unexpectedly visible. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22413&quot;&gt;CVE-2021-22413&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky&quot;&gt;vaib25vicky&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-and-project-membership-potentially-exposed-via-graphql&quot;&gt;Group and project membership potentially exposed via GraphQL&lt;&#x2F;h2&gt;

&lt;p&gt;Information disclosure via GraphQL in GitLab CE&#x2F;EE 13.1 and later exposes private group and project membership. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:N&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.3). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22417&quot;&gt;CVE-2021-22417&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;search-terms-logged-in-search-parameter-in-rails-logs&quot;&gt;Search terms logged in &lt;code&gt;search&lt;&#x2F;code&gt; parameter in rails logs&lt;&#x2F;h2&gt;

&lt;p&gt;Information disclosure in Advanced Search component of GitLab EE starting in 8.4 results in exposure of search terms via Rails logs. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:L&#x2F;AC:H&#x2F;PR:H&#x2F;UI:R&#x2F;S:C&#x2F;C:H&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 5.0). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22416&quot;&gt;CVE-2021-22416&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;un-authorised-access-to-feature-flag-user-list&quot;&gt;Un-authorised access to feature flag user list&lt;&#x2F;h2&gt;

&lt;p&gt;An issue was discovered in Gitlab CE&#x2F;EE versions starting from 13.1 to 13.5 which allowed an un-authorised user to access the user list corresponding to a feature flag in a project. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13357&quot;&gt;CVE-2020-13357&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;a-specific-query-on-the-explore-page-causes-statement-timeouts&quot;&gt;A specific query on the explore page causes statement timeouts&lt;&#x2F;h2&gt;

&lt;p&gt;A potential DOS vulnerability was discovered in all versions of GitLab. Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-26411&quot;&gt;CVE-2020-26411&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;exposure-of-starred-projects-on-private-user-profiles&quot;&gt;Exposure of starred projects on private user profiles&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab affecting all versions starting from 12.2 before 13.6.2, all versions starting from 12.2 before 13.5.5, all versions starting from 12.2 before 13.4.7. Information about the starred projects for private user profiles was exposed via the GraphQL API starting in 13.4 and via the REST API starting in 12.2. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 4.3). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22415&quot;&gt;CVE-2021-22415&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;uncontrolled-resource-consumption-in-any-markdown-field-using-mermaid&quot;&gt;Uncontrolled Resource Consumption in any Markdown field using Mermaid&lt;&#x2F;h2&gt;

&lt;p&gt;A DOS vulnerability exists in Gitlab CE&#x2F;EE starting with 10.3 that allows an attacker to trigger uncontrolled resource by bypassing input validation in markdown fields. This is a medium severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:L&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:N&#x2F;I:N&#x2F;A:L&lt;&#x2F;code&gt;, 4.3). It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-26409&quot;&gt;CVE-2020-26409&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;misha98857&quot;&gt;misha98857&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;former-group-members-able-to-view-updates-to-confidential-epics&quot;&gt;Former group members able to view updates to confidential epics&lt;&#x2F;h2&gt;

&lt;p&gt;Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2. This is a low severity issue (&lt;code&gt;CVSS:3.1&#x2F;AV:N&#x2F;AC:H&#x2F;PR:L&#x2F;UI:N&#x2F;S:U&#x2F;C:L&#x2F;I:N&#x2F;A:N&lt;&#x2F;code&gt;, 3.1). This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2021-22412&quot;&gt;CVE-2021-22412&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-graphicsmagick-dependency&quot;&gt;Update GraphicsMagick dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The GraphicsMagick dependency has been upgraded to 1.3.35 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus 11.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-gnupg-dependency&quot;&gt;Update GnuPG dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The GnuPG dependency has been upgraded to 2.2.23 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus 13.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-libxml-dependency&quot;&gt;Update libxml dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The libxml dependency has been upgraded to 2.9.10 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.5.2, 13.4.5, and 13.3.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/11/02/security-release-gitlab-13-5-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/11/02/security-release-gitlab-13-5-2-released/</id>
<published>2020-11-02T00:00:00+00:00</published>
<updated>2020-11-02T00:00:00+00:00</updated>
<author>
<name>Dominic Couture</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.5.2, 13.4.5, and 13.3.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;path-traversal-in-lfs-upload&quot;&gt;Path Traversal in LFS Upload&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13355&quot;&gt;CVE-2020-13355&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;saltyyolk&quot;&gt;saltyyolk&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;path-traversal-allows-saving-packages-in-arbitrary-location&quot;&gt;Path traversal allows saving packages in arbitrary location&lt;&#x2F;h2&gt;

&lt;p&gt;Path traversal vulnerability in package upload functionality in GitLab CE&#x2F;EE starting from 12.8 allows an attacker to save packages in arbitrary locations. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-26405&quot;&gt;CVE-2020-26405&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;kubernetes-agent-api-leaks-private-repos&quot;&gt;Kubernetes agent API leaks private repos&lt;&#x2F;h2&gt;

&lt;p&gt;A vulnerability in the internal Kubernetes agent api in GitLab CE&#x2F;EE version 13.3 and above allows unauthorised access to private projects. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13358&quot;&gt;CVE-2020-13358&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;terraform-state-deletion-api-exposes-object-storage-url&quot;&gt;Terraform state deletion API exposes object storage URL&lt;&#x2F;h2&gt;

&lt;p&gt;The Terraform API in GitLab CE&#x2F;EE 12.10 and above exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13359&quot;&gt;CVE-2020-13359&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-error-message-of-build-dependencies&quot;&gt;Stored-XSS in error message of build-dependencies&lt;&#x2F;h2&gt;

&lt;p&gt;A stored XSS in CI Job Log has been discovered in GitLab CE&#x2F;EE 12.4 and above. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13340&quot;&gt;CVE-2020-13340&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;yvvdwf&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;git-credentials-persisted-on-disk&quot;&gt;Git credentials persisted on disk&lt;&#x2F;h2&gt;

&lt;p&gt;When importing repos via URL, one time use git credentials were persisted beyond the expected time windows in Gitaly 1.79.0 or above. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13353&quot;&gt;CVE-2020-13353&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;potential-denial-of-service-via-container-registry&quot;&gt;Potential Denial of service via container registry&lt;&#x2F;h2&gt;

&lt;p&gt;A potential DOS vulnerability was discovered in GitLab CE&#x2F;EE starting with version 12.6 and above. The container registry name check could cause exponential number of backtracks for certain user supplied values resulting in high CPU usage. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13354&quot;&gt;CVE-2020-13354&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;anyday&quot;&gt;@anyday&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;info-leak-when-group-is-transferred-from-private-to-public-group&quot;&gt;Info leak when group is transferred from private to public group.&lt;&#x2F;h2&gt;

&lt;p&gt;Private group info is leaked leaked in GitLab CE&#x2F;EE version 10.2 and above, when the project is moved from private to public group. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13352&quot;&gt;CVE-2020-13352&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;limited-file-disclosure-via-multipart-bypass&quot;&gt;Limited File Disclosure Via Multipart Bypass&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab CE&#x2F;EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read files in certain specific paths on the server. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13356&quot;&gt;CVE-2020-13356&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ledz1996&quot;&gt;ledz1996&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-user-is-able-to-access-scheduled-pipeline-variables-and-values&quot;&gt;Unauthorized user is able to access scheduled pipeline variables and values&lt;&#x2F;h2&gt;

&lt;p&gt;Insufficient permission checks in scheduled pipeline API in GitLab CE&#x2F;EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13351&quot;&gt;CVE-2020-13351&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky&quot;&gt;@vaib25vicky&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;csrf-in-runner-administration-page-allows-an-attacker-to-pauseresume-runners&quot;&gt;CSRF in runner administration page allows an attacker to pause&#x2F;resume runners&lt;&#x2F;h2&gt;

&lt;p&gt;CSRF in runner administration page in all versions of GitLab CE&#x2F;EE allows an attacker who&#x27;s able to target GitLab instance administrators to pause&#x2F;resume runners. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13350&quot;&gt;CVE-2020-13350&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;regex-backtracking-attack-in-path-parsing-of-advanced-search-result&quot;&gt;Regex backtracking attack in path parsing of Advanced Search result&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 9.2. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13349&quot;&gt;CVE-2020-13349&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypass-of-required-codeowners-approval&quot;&gt;Bypass of required CODEOWNERS approval&lt;&#x2F;h2&gt;

&lt;p&gt;An issue has been discovered in GitLab EE affecting all versions starting from 11.9. Required CODEOWNERS approval could be bypassed by targeting a branch without the CODEOWNERS file. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13348&quot;&gt;CVE-2020-13348&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sast-ciconfiguration-information-visible-without-permissions&quot;&gt;SAST CiConfiguration information visible without permissions&lt;&#x2F;h2&gt;

&lt;p&gt;Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-26406&quot;&gt;CVE-2020-26406&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for reporting this vulnerability through our HackerOne bug bounty program.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.4.2, 13.3.7 and 13.2.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/10/01/security-release-13-4-2-release/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/10/01/security-release-13-4-2-release/</id>
<published>2020-10-01T00:00:00+00:00</published>
<updated>2020-10-01T00:00:00+00:00</updated>
<author>
<name>Ron Chan</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.4.2, 13.3.7 and 13.2.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;potential-denial-of-service-via-update-release-links-api&quot;&gt;Potential Denial Of Service Via Update Release Links API&lt;&#x2F;h2&gt;

&lt;p&gt;A potential DoS vulnerability was discovered in release api, certain user supplied values could rise the CPU usage. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13333&quot;&gt;CVE-2020-13333&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;anyday&quot;&gt;@anyday&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 13.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insecure-storage-of-session-key-in-redis&quot;&gt;Insecure Storage of Session Key In Redis&lt;&#x2F;h2&gt;

&lt;p&gt;Under certain condition an unauthorised user could read the Redis keys and use to obtain a valid session. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13344&quot;&gt;CVE-2020-13344&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;rabbitfang&quot;&gt;@rabbitfang&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-expiration-date-validation&quot;&gt;Improper Access Expiration Date Validation&lt;&#x2F;h2&gt;

&lt;p&gt;It was possible for users to access projects with an expired access date. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13332&quot;&gt;CVE-2020-13332&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;henonoah&quot;&gt;@henonoah&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 8.11.0-rc6+ and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-multiple-pages&quot;&gt;Cross-Site Scripting in Multiple Pages&lt;&#x2F;h2&gt;

&lt;p&gt;A reflected cross-site scripting was discovred in different pages. This issue is now mitigated in the latest release and  is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13345&quot;&gt;CVE-2020-13345&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-users-can-view-custom-project-template&quot;&gt;Unauthorized Users Can View Custom Project Template&lt;&#x2F;h2&gt;

&lt;p&gt;An unauthorised user was able to view private custom project template. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13343&quot;&gt;CVE-2020-13343&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 11.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-svg-image-preview&quot;&gt;Cross-Site Scripting in SVG Image Preview&lt;&#x2F;h2&gt;

&lt;p&gt;A stored cross-site scripting was found in SVG image preview. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13339&quot;&gt;CVE-2020-13339&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;aryan2808&quot;&gt;@aryan2808&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 12.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;incomplete-handling-in-account-deletion&quot;&gt;Incomplete Handling in Account Deletion&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that there was insufficient check before account deletion which allowed an account to be deleted while being the owner of a group. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13335&quot;&gt;CVE-2020-13335&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;brdoors3&quot;&gt;@brdoors3&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 7.12 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insufficient-rate-limiting-at-re-sending-confirmation-email&quot;&gt;Insufficient Rate Limiting at Re-Sending Confirmation Email&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that there was insufficient rate-limiting at re-sending confirmatil email. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13342&quot;&gt;CVE-2020-13341&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;yuanchenlu&quot;&gt;@yuanchenlu&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 10.1.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-type-check-in-graphql&quot;&gt;Improper Type Check in GraphQL&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that due to an improper type check in GraphQL users with developer role were able to perform unauthorised actions. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13341&quot;&gt;CVE-2020-13341&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;ledz1996&quot;&gt;@ledz1996&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 13.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;to-dos-are-not-redacted-when-membership-changes&quot;&gt;To-dos Are Not Redacted When Membership Changes&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that after membership changes were applied, the to-do list was not redacted properly. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13346&quot;&gt;CVE-2020-13346&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;vaib25vicky&quot;&gt;@vaib25vicky&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 11.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;guest-users-can-modify-confidentiality-attribute&quot;&gt;Guest users can modify confidentiality attribute&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that improper authorization checks allows a non-member of a project&#x2F;group to change the confidentiality attribute of issue via mutation GraphQL query. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13334&quot;&gt;CVE-2020-13334&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;0xwintermute&quot;&gt;@0xwintermute&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 8.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;command-injection-on-runner-host&quot;&gt;Command injection on runner host&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that improper validation of authorization configuration allowed arbitary command execution on windows runner host. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13347&quot;&gt;CVE-2020-13347&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ajxchapman&quot;&gt;@ajxchapman&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab Runner 12.0.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insecure-runner-configuration-in-kubernetes-environments&quot;&gt;Insecure Runner Configuration in Kubernetes Environments&lt;&#x2F;h2&gt;

&lt;p&gt;An internal investigation revealed a security issue in GitLab Runner configuration used with Kubernetes environments that could be used to perform a MitM(Man in the Middle) attack. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13327&quot;&gt;CVE-2020-13327&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab Runner 13.2, 13.3, 13.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;hr &#x2F;&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.3.4, 13.2.8, and 13.1.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/09/02/security-release-gitlab-13-3-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/09/02/security-release-gitlab-13-3-3-released/</id>
<published>2020-09-02T00:00:00+00:00</published>
<updated>2020-09-02T00:00:00+00:00</updated>
<author>
<name>Vitor Meireles De Sousa</name>
</author>
<content type='html'>&lt;h2 id=&quot;attention&quot;&gt;Attention&lt;&#x2F;h2&gt;

&lt;p&gt;Versions 13.3.3, 13.2.7, and 13.1.9 were improperly packaged and did not contain
the security fixes outlined below. We&#x27;ve released 13.3.4, 13.2.8, and 13.1.10 to
correct the packaging error. See &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;gl-infra&#x2F;delivery&#x2F;-&#x2F;issues&#x2F;1176&quot;&gt;#1176&lt;&#x2F;a&gt; for
details and corrective actions on the packaging error.&lt;&#x2F;p&gt;

&lt;hr &#x2F;&gt;

&lt;p&gt;Today we are releasing versions 13.3.4, 13.2.8 and 13.1.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;vendor-cross-account-assume-role-attack&quot;&gt;Vendor Cross-Account Assume-Role Attack&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab EKS integration was vulnerable to a cross-account assume role attack which could allow privileged access and possibly AWS account takeover. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13318&quot;&gt;CVE-2020-13318&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 8.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-on-the-vulnerability-page&quot;&gt;Stored XSS on the Vulnerability Page&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab was vulnerable to a stored XSS on the standalone vulnerability page. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13301&quot;&gt;CVE-2020-13301&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 13.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;outdated-job-token-can-be-reused-to-access-unauthorized-resources&quot;&gt;Outdated Job Token Can Be Reused to Access Unauthorized Resources&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab was not validating that job tokens were associated with running jobs. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13284&quot;&gt;CVE-2020-13284&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;file-disclosure-via-workhorse-file-upload-bypass&quot;&gt;File Disclosure Via Workhorse File Upload Bypass&lt;&#x2F;h2&gt;
&lt;p&gt;Conan package upload functionality was not properly validating the supplied parameters, which resulted the limited files disclosure. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13298&quot;&gt;CVE-2020-13298&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ledz1996&quot;&gt;ledz1996&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 13.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-maintainer-can-edit-group-badge&quot;&gt;Unauthorized Maintainer Can Edit Group Badge&lt;&#x2F;h2&gt;
&lt;p&gt;An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13313&quot;&gt;CVE-2020-13313&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-within-wiki-functionality&quot;&gt;Denial of Service Within Wiki Functionality&lt;&#x2F;h2&gt;
&lt;p&gt;An internal investigation revealed that GitLab&#x27;s Wiki was vulnerable to a parser attack that prohibits anyone from accessing the Wiki functionality through the user interface. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13311&quot;&gt;CVE-2020-13311&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all GitLab versions prior 13.0.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sign-in-vulnerable-to-brute-force-attacks&quot;&gt;Sign-in Vulnerable to Brute-force Attacks&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab was vulnerable to brute-force attacks due to an improper handling of sign-in parameters. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13289&quot;&gt;CVE-2020-13289&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 8.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;invalidated-session-allows-account-access-with-an-old-password&quot;&gt;Invalidated Session Allows Account Access With an Old Password&lt;&#x2F;h2&gt;
&lt;p&gt;Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13302&quot;&gt;CVE-2020-13302&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rogov&quot;&gt;rogov&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 7.11 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-omniauth-endpoint-renders-user-controlled-messages&quot;&gt;GitLab Omniauth Endpoint Renders User Controlled Messages&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the user within error messages. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13314&quot;&gt;CVE-2020-13314&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;h33t&quot;&gt;h33t&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 7.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;blind-ssrf-through-repository-mirroring&quot;&gt;Blind SSRF Through Repository Mirroring&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13309&quot;&gt;CVE-2020-13309&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sky003&quot;&gt;sky003&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-through-incorrect-group-permission-verifications&quot;&gt;Information Disclosure Through Incorrect Group Permission Verifications&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab was vulnerable to information disclosure by not performing proper verification on permissions for confidential epics. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13287&quot;&gt;CVE-2020-13287&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 13.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;no-rate-limit-on-gitlab-webhook-feature&quot;&gt;No Rate Limit on GitLab Webhook Feature&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13306&quot;&gt;CVE-2020-13306&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;noddyn12&quot;&gt;noddyn12&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-session-revocation-feature-does-not-invalidate-all-sessions&quot;&gt;GitLab Session Revocation Feature Does Not Invalidate All Sessions&lt;&#x2F;h2&gt;
&lt;p&gt;The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13299&quot;&gt;CVE-2020-13299&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky&quot;&gt;vaib25vicky&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;oauth-authorization-scope-for-an-external-application-can-be-changed-without-user-consent&quot;&gt;OAuth Authorization Scope for an External Application Can Be Changed Without User Consent&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13300&quot;&gt;CVE-2020-13300&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks fushbey for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 13.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-maintainer-can-delete-repository&quot;&gt;Unauthorized Maintainer Can Delete Repository&lt;&#x2F;h2&gt;
&lt;p&gt;A project Maintainer was able to delete a repository through GraphQL due to insufficient verification of permissions. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13317&quot;&gt;CVE-2020-13317&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ledz1996&quot;&gt;ledz1996&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 12.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-verification-of-deploy-key-leads-to-access-restricted-repository&quot;&gt;Improper Verification of Deploy-Key Leads to Access Restricted Repository&lt;&#x2F;h2&gt;
&lt;p&gt;Due to improper verification of permissions, an unauthorized user can access a private repository within a public project. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13303&quot;&gt;CVE-2020-13303&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ledz1996&quot;&gt;ledz1996&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disabled-repository-still-accessible-with-a-deploy-token&quot;&gt;Disabled Repository Still Accessible With a Deploy-Token&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13316&quot;&gt;CVE-2020-13316&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky&quot;&gt;vaib25vicky&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;duplicated-secret-code-generated-by-2-factor-authentication-mechanism&quot;&gt;Duplicated Secret Code Generated by 2 Factor Authentication Mechanism&lt;&#x2F;h2&gt;
&lt;p&gt;Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13304&quot;&gt;CVE-2020-13304&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rgupt&quot;&gt;rgupt&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;lack-of-validation-within-project-invitation-flow&quot;&gt;Lack of Validation Within Project Invitation Flow&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab was not invalidating project invitation link upon removing a user from a project. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13305&quot;&gt;CVE-2020-13305&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rgupt&quot;&gt;rgupt&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-18&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-18&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;current-sessions-not-invalidated-upon-enabling-2-factor-authentication&quot;&gt;Current Sessions Not Invalidated Upon Enabling 2 Factor Authentication&lt;&#x2F;h2&gt;
&lt;p&gt;GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13307&quot;&gt;CVE-2020-13307&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-19&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-19&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;users-without-2-factor-authentication-can-be-blocked-accessing-gitlab&quot;&gt;Users Without 2 Factor Authentication Can Be Blocked Accessing GitLab&lt;&#x2F;h2&gt;
&lt;p&gt;A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13308&quot;&gt;CVE-2020-13308&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks marshall0705 for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-20&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-20&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;lack-of-upper-bound-check-leading-to-possible-denial-of-service&quot;&gt;Lack of Upper Bound Check Leading to Possible Denial of Service&lt;&#x2F;h2&gt;
&lt;p&gt;The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13315&quot;&gt;CVE-2020-13315&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;brandonnnn&quot;&gt;brandonnnn&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-21&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 11.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-21&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;2-factor-authentication-for-groups-was-not-enforced-within-api-endpoint&quot;&gt;2 Factor Authentication for Groups Was Not Enforced Within API Endpoint&lt;&#x2F;h2&gt;
&lt;p&gt;When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13297&quot;&gt;CVE-2020-13297&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-22&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-22&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-runner-denial-of-service-via-ci-jobs&quot;&gt;GitLab Runner Denial of Service via CI Jobs&lt;&#x2F;h2&gt;
&lt;p&gt;It was possible to make the gitlab-runner process crash by sending malformed queries, resulting in a denial of service. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13310&quot;&gt;CVE-2020-13310&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-23&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous versions of GitLab Runner.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-23&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-websocket-extensions-gem&quot;&gt;Update websocket-extensions Gem&lt;&#x2F;h2&gt;
&lt;p&gt;The websocket-extensions gem has been upgraded to 0.1.5. This upgrade includes a security fix for &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2020-7663&quot;&gt;CVE-2020-7663&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-jquery-dependency&quot;&gt;Update jQuery Dependency&lt;&#x2F;h2&gt;
&lt;p&gt;The jQuery dependency has been upgraded to 3.5 . This upgrade includes a security fix for &lt;a href=&quot;https:&#x2F;&#x2F;github.com&#x2F;jquery&#x2F;jquery&#x2F;security&#x2F;advisories&#x2F;GHSA-gxr4-xjj5-5px2&quot;&gt;CVE-2020-11022&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 13.2.6, 13.1.8, 13.0.14</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/08/18/critical-security-release-gitlab-13-2-6-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/08/18/critical-security-release-gitlab-13-2-6-released/</id>
<published>2020-08-18T00:00:00+00:00</published>
<updated>2020-08-18T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;Note: due to a packaging problem, our previous release (&lt;a href=&quot;&#x2F;releases&#x2F;2020&#x2F;08&#x2F;18&#x2F;critical-security-release-gitlab-13-2-5-released&#x2F;&quot;&gt;published and communicated earlier today&#x2F;Aug 18&lt;&#x2F;a&gt;) did not include the security fixes mentioned in the accompanying blog post for the GitLab Community Edition package. The new, just released versions of GitLab Enterprise Edition and GitLab Community Edition now contain all the necessary fixes for all versions. Please update all packages immediately.
***&lt;&#x2F;p&gt;

&lt;p&gt;Today we are releasing versions 13.2.6, 13.1.8, 13.0.14 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;deploy-token-access-control&quot;&gt;Deploy Token Access Control&lt;&#x2F;h3&gt;
&lt;p&gt;An authorization issue discovered in the deploy token handling allowed read access to public projects with restricted repositories. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13296&quot;&gt;CVE-2020-13296&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ledz1996&quot;&gt;@ledz1996&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 10.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 13.2.5, 13.1.7, 13.0.13</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/08/18/critical-security-release-gitlab-13-2-5-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/08/18/critical-security-release-gitlab-13-2-5-released/</id>
<published>2020-08-18T00:00:00+00:00</published>
<updated>2020-08-18T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;h3 id=&quot;update-as-of-1700-utc-august-18-2020-both-our-gitlab-enterprise-edition-and-gitlab-community-edition-versions-contain-all-of-the-fixes-listed-below--the-related-blog-post-with-new-version-numbers-is-here&quot;&gt;Update: As of 17:00 UTC, August 18, 2020 both our GitLab Enterprise Edition and GitLab Community Edition versions contain all of the fixes listed below.  The related blog post with new version numbers is &lt;a href=&quot;&#x2F;releases&#x2F;2020&#x2F;08&#x2F;18&#x2F;critical-security-release-gitlab-13-2-6-released&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;h3&gt;

&lt;p&gt;&lt;del&gt;&lt;strong&gt;Due to a packaging problem, the GitLab Community Edition packages do not include the security fixes mentioned in this blog post. We are currently working on releasing new versions of both our GitLab Enterprise Edition and GitLab Community Edition, to ensure both contain all the necessary fixes. We will publish a separate blog post when these packages have been published.&lt;&#x2F;strong&gt;&lt;&#x2F;del&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Today we are releasing versions 13.2.5, 13.1.7, 13.0.13 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;deploy-token-access-control&quot;&gt;Deploy Token Access Control&lt;&#x2F;h3&gt;
&lt;p&gt;An authorization issue discovered in the deploy token handling allowed read access to public projects with restricted repositories. This issue is now mitigated in the latest release and is waiting for a CVE ID to be assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ledz1996&quot;&gt;@ledz1996&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 10.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.2.3, 13.1.6 and 13.0.12</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/</id>
<published>2020-08-05T00:00:00+00:00</published>
<updated>2020-08-05T00:00:00+00:00</updated>
<author>
<name>Andrew Kelly</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.2.3, 13.1.6 and 13.0.12 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;previously-fixed-in-1291-arbitrary-file-read-when-moving-an-issue&quot;&gt;Previously fixed (in 12.9.1): Arbitrary File Read when Moving an Issue&lt;&#x2F;h2&gt;
&lt;p&gt;Recently, a GitLab user posted a blog about the exploitation of a known vulnerability which has been previously disclosed and assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10977&quot;&gt;CVE-2020-10977&lt;&#x2F;a&gt;. GitLab EE&#x2F;CE 8.5 to 12.9 is vulnerable to a path traversal when moving an issue between projects.&lt;&#x2F;p&gt;

&lt;p&gt;This issue was remediated and patched in the &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;releases&#x2F;2020&#x2F;03&#x2F;26&#x2F;security-release-12-dot-9-dot-1-released&#x2F;&quot;&gt;12.9.1 release&lt;&#x2F;a&gt; in March 2020.&lt;&#x2F;p&gt;

&lt;p&gt;We strongly recommend that all users confirm they are running the latest version of GitLab to ensure they are up-to-date with current security releases. Users should update immediately if possible. If upgrading immediately is not possible for some reason, public registration should be disabled.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;memory-exhaustion-via-excessive-logging-of-invite-email-error&quot;&gt;Memory Exhaustion via Excessive Logging of Invite Email Error&lt;&#x2F;h2&gt;
&lt;p&gt;Excessive error logging related to an invitation email being sent to members of a deleted group could potentially cause memory exhaustion on lower resource machines. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13280&quot;&gt;CVE-2020-13280&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-through-project-import-feature&quot;&gt;Denial of Service Through Project Import Feature&lt;&#x2F;h2&gt;
&lt;p&gt;The project import feature did not perform size checks before decompressing data, potentially resulting in a denial of service. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13281&quot;&gt;CVE-2020-13281&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;u3mur4&quot;&gt;@u3mur4&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 8.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-controlled-git-configuration-settings-resulting-in-ssrf&quot;&gt;User Controlled Git Configuration Settings Resulting in SSRF&lt;&#x2F;h2&gt;
&lt;p&gt;When importing a repository via URL, the git &lt;code&gt;http.&amp;lt;url&amp;gt;.proxy&lt;&#x2F;code&gt; setting could be changed and lead to server-side request forgery. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13286&quot;&gt;CVE-2020-13286&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 12.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-issue-reference-number-tooltip&quot;&gt;Stored XSS in Issue Reference Number Tooltip&lt;&#x2F;h2&gt;
&lt;p&gt;For some browsers, the tooltip for issue reference numbers could result in stored XSS on mouseover. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13285&quot;&gt;CVE-2020-13285&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;@yvvdwf&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-issues-list-via-milestone-title&quot;&gt;Stored XSS in Issues List via Milestone Title&lt;&#x2F;h2&gt;
&lt;p&gt;The milestone title field can lead to stored XSS when viewed under certain conditions on the issue list. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13283&quot;&gt;CVE-2020-13283&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mike12&quot;&gt;@mike12&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-control-after-group-transfer&quot;&gt;Improper Access Control After Group Transfer&lt;&#x2F;h2&gt;
&lt;p&gt;Members of a parent group silently and unexpectedly maintained their access levels when a subgroup is transferred. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13282&quot;&gt;CVE-2020-13282&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;kryword&quot;&gt;@kryword&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypass-email-verification-required-for-oauth-flow&quot;&gt;Bypass Email Verification Required for OAuth Flow&lt;&#x2F;h2&gt;
&lt;p&gt;The required email verification for the OAuth authorization code flow could be bypassed, which potentially could affect third party applications that use GitLab as an identity provider. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13292&quot;&gt;CVE-2020-13292&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;cache-money&quot;&gt;@cache-money&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;confusion-when-using-hexadecimal-branch-names&quot;&gt;Confusion When Using Hexadecimal Branch Names&lt;&#x2F;h2&gt;
&lt;p&gt;Using a branch with a hexadecimal name could override an existing hash. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13293&quot;&gt;CVE-2020-13293&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;retroplasma&quot;&gt;@retroplasma&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insufficient-oauth-revocation&quot;&gt;Insufficient OAuth Revocation&lt;&#x2F;h2&gt;
&lt;p&gt;Access grants were not revoked when a user revoked access to an application. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13294&quot;&gt;CVE-2020-13294&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;benaubin&quot;&gt;@benaubin&lt;&#x2F;a&gt;, &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;whitehattushu&quot;&gt;@whitehattushu&lt;&#x2F;a&gt;, and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;lauritz&quot;&gt;@lauritz&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 7.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-control-for-project-sharing&quot;&gt;Improper Access Control for Project Sharing&lt;&#x2F;h2&gt;
&lt;p&gt;Project sharing could temporarily allow too permissive access. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13291&quot;&gt;CVE-2020-13291&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 13.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-jobs-page&quot;&gt;Stored XSS in Jobs Page&lt;&#x2F;h2&gt;
&lt;p&gt;A stored XSS was identified in the CI&#x2F;CD Jobs page. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13288&quot;&gt;CVE-2020-13288&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mike12&quot;&gt;@mike12&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 13.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-control-of-applications-page&quot;&gt;Improper Access Control of Applications Page&lt;&#x2F;h2&gt;
&lt;p&gt;Users without two-factor authentication set up can still access the &lt;code&gt;&#x2F;profile&#x2F;applications&lt;&#x2F;code&gt; page even when two-factor authentication is required. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13290&quot;&gt;CVE-2020-13290&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;brdoors3&quot;&gt;@brdoors3&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;melar_dev&quot;&gt;@melar_dev&lt;&#x2F;a&gt; for providing additional important details.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 8.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-into-shared-runner&quot;&gt;SSRF into Shared Runner&lt;&#x2F;h2&gt;
&lt;p&gt;By replacing dockerd with a malicious server, a SSRF was possible into the Shared Runner. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13295&quot;&gt;CVE-2020-13295&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;lucash-dev&quot;&gt;@lucash-dev&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all versions of GitLab Runner.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations of &lt;strong&gt;GitLab Runner&lt;&#x2F;strong&gt; are &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;upgraded&lt;&#x2F;a&gt; to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-kramdown-gem&quot;&gt;Update Kramdown Gem&lt;&#x2F;h2&gt;
&lt;p&gt;The kramdown gem has been upgraded to 2.3.0. This upgrade include a security fix for &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-14001&quot;&gt;CVE-2020-14001&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 13.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.
To update Gitlab Runner, see the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;runner&#x2F;install&#x2F;linux-repository.html#updating-the-runner&quot;&gt;Updating the Runner page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 13.1.3, 13.0.9 and 12.10.14</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/07/06/critical-security-release-gitlab-13-1-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/07/06/critical-security-release-gitlab-13-1-3-released/</id>
<published>2020-07-06T00:00:00+00:00</published>
<updated>2020-07-06T00:00:00+00:00</updated>
<author>
<name>Andrew Kelly</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.1.3, 13.0.9 and 12.10.14 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;workhorse-bypass-allows-files-in-tmp-to-be-read-via-maven-repository-apis&quot;&gt;Workhorse bypass allows files in &#x2F;tmp to be read via Maven Repository APIs&lt;&#x2F;h2&gt;
&lt;p&gt;The Maven package upload endpoint could be used to override restrictions and result in the GitLab Workhorse disclosing the existence and contents of files in the &lt;code&gt;&#x2F;tmp&lt;&#x2F;code&gt; directory. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-15525&quot;&gt;CVE-2020-15525&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ledz1996&quot;&gt;@ledz1996&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;maven-package-upload-broken-in-121014&quot;&gt;Maven package upload broken in 12.10.14&lt;&#x2F;h3&gt;
&lt;p&gt;The fix for this security issue caused a regression in the 12.10 code base. Uploading Maven packages no longer works, generating the error &lt;code&gt;400 Bad Request&lt;&#x2F;code&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For more information, see &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;229482&quot;&gt;the issue&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;The GitLab Maven Repository is a Premium feature in GitLab 12.10. Premium and Ultimate customers running GitLab 12.10 who use the Maven Repository feature should upgrade to 13.0.9 or higher.&lt;&#x2F;p&gt;

&lt;p&gt;Our documented upgrade path from 12.10 to 13.x specifies that the last 12.10 patch release should be one of the steps. This is to ensure that any code updates required for upgrading are installed. Customers using the Maven Repository would be advised to use 12.10.13 as the last 12.10 patch release, and upgrade to a 13.0.9 or higher as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.1.2, 13.0.8 and 12.10.13</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/</id>
<published>2020-07-01T00:00:00+00:00</published>
<updated>2020-07-01T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.1.2, 13.0.8 and 12.10.13 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;missing-permission-check-on-time-tracking&quot;&gt;Missing Permission Check on Time Tracking&lt;&#x2F;h2&gt;
&lt;p&gt;It was possible to add time spent on a issue without being a project member. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13319&quot;&gt;CVE-2020-13319&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-pypi-files-api&quot;&gt;Cross-Site Scripting in PyPi Files API&lt;&#x2F;h2&gt;
&lt;p&gt;Under certain conditions, requests involving the PyPi files API could result in an XSS vulnerability. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13328&quot;&gt;CVE-2020-13328&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 13.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insecure-authorization-check-on-private-project-security-dashboard&quot;&gt;Insecure Authorization Check on Private Project Security Dashboard&lt;&#x2F;h2&gt;
&lt;p&gt;Under certain conditions, a project member with Guest permissions was allowed to view the project security dashboard.This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13320&quot;&gt;CVE-2020-13320&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vaib25vicky&quot;&gt;@vaib25vicky&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.8 to 13.1.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-references&quot;&gt;Cross-Site Scripting in References&lt;&#x2F;h2&gt;
&lt;p&gt;A stored cross-site scripting vulnerability was discovered when editing references. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13338&quot;&gt;CVE-2020-13338&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 8.10.0 to 13.1.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-group-names&quot;&gt;Cross-Site Scripting in Group Names&lt;&#x2F;h2&gt;
&lt;p&gt;An internal investigation revealed that Group Names could be used to store XSS payloads. TThis issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13337&quot;&gt;CVE-2020-13327&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-blob-viewer&quot;&gt;Cross-Site Scripting in Blob Viewer&lt;&#x2F;h2&gt;
&lt;p&gt;A stored XSS vulnerability was discovered in the blob viewer feature. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13329&quot;&gt;CVE-2020-13329&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;@yvvdwf&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-error-tracking&quot;&gt;Cross-Site Scripting in Error Tracking&lt;&#x2F;h2&gt;
&lt;p&gt;A stored cross-site scripting payload could be injected in the Error Tracking page. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13336&quot;&gt;CVE-2020-13336&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mike12&quot;&gt;@mike12&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insecure-authorisation-check-on-creation-and-deletion-of-deploy-tokens&quot;&gt;Insecure Authorisation Check on Creation and Deletion of Deploy Tokens&lt;&#x2F;h2&gt;
&lt;p&gt;An insecure authorization check allowed project members with Maintainer role to create and delete deploy tokens. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13322&quot;&gt;CVE-2020-13322&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-name-format-restiction-bypass&quot;&gt;User Name Format Restiction Bypass&lt;&#x2F;h2&gt;
&lt;p&gt;Username format restrictions could be bypassed allowing for html tags to be added. TThis issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13321&quot;&gt;CVE-2020-13321&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;zseano&quot;&gt;@zseano&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all versions of GitLab.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-in-issue-comments&quot;&gt;Denial of Service in Issue Comments&lt;&#x2F;h2&gt;
&lt;p&gt;A denial of service vulnerability involving the comments on an issue was discovered. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13325&quot;&gt;CVE-2020-13325&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks @tiradorngpilipinas for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-wiki-pages&quot;&gt;Cross-Site Scripting in Wiki Pages&lt;&#x2F;h2&gt;
&lt;p&gt;A stored cross-site scripting vulnerability was discovered in the Wiki upload feature. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13331&quot;&gt;CVE-2020-13331&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;semsem123&quot;&gt;@semsem123&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.10 and older.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-merge-request-updates-leaked-via-todos&quot;&gt;Private Merge Request Updates Leaked via Todos&lt;&#x2F;h2&gt;
&lt;p&gt;An internal investigation revealed that updates to private merge requests could be disclosed to removed project members. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13323&quot;&gt;CVE-2020-13323&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all versions of GitLab.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-user-activity-leaked-via-api&quot;&gt;Private User Activity Leaked via API&lt;&#x2F;h2&gt;
&lt;p&gt;Under certain conditions the private activty of an user could be exposed via the API. TThis issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13324&quot;&gt;CVE-2020-13324&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 9.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-bitbucket-import-feature&quot;&gt;Cross-Site Scripting in Bitbucket Import Feature&lt;&#x2F;h2&gt;
&lt;p&gt;A stored XSS vulnerability could be exploited using the Bitbucket project import feature. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13330&quot;&gt;CVE-2020-13330&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;saltyyolk&quot;&gt;@saltyyolk of Chaitin Tech&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab  11.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;github-project-restriction-bypass&quot;&gt;Github Project Restriction Bypass&lt;&#x2F;h2&gt;
&lt;p&gt;It was possible to bypass the restriction of importing projects from Github via the API. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13326&quot;&gt;CVE-2020-13326&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab  11.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-pcre-dependency&quot;&gt;Update PCRE Dependency&lt;&#x2F;h2&gt;
&lt;p&gt;The lippcre in PCRE has been upgraded from 8.42  to 8.44. This upgrade includes a security fix for CVE-2020-14155.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-kaminari-gem&quot;&gt;Update Kaminari Gem&lt;&#x2F;h2&gt;
&lt;p&gt;Using Kaminari before 1.2.1, an attacker could inject arbitrary code into pages with pagination links. This upgrade includes a security fix for CVE-2020-11082.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-xtermjs&quot;&gt;Update Xterm.js&lt;&#x2F;h2&gt;
&lt;p&gt;A remote code execution exists in xterm.js before 3.9.2. This upgrade includes a security fix for CVE-2019-0542.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab  Critical Security Release: 13.0.6, 12.10.11, 12.9.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/06/10/critical-security-release-13-0-6-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/06/10/critical-security-release-13-0-6-released/</id>
<published>2020-06-10T00:00:00+00:00</published>
<updated>2020-06-10T00:00:00+00:00</updated>
<author>
<name>Jeremy Matos</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.0.6, 12.10.11, 12.9.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards.  As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ci-token-access-control&quot;&gt;CI Token Access Control&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue discovered in the mirroring logic allowed read access to private repositories. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13277&quot;&gt;CVE-2020-13277&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;u3mur4&quot;&gt;@u3mur4&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab  Critical Security Release: 13.0.4, 12.10.9, 12.9.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/06/03/critical-security-release-13-0-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/06/03/critical-security-release-13-0-4-released/</id>
<published>2020-06-03T00:00:00+00:00</published>
<updated>2020-06-03T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.0.4, 12.10.9, 12.9.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards.  As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to  the latest security release for their supported version. You can read more &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ci-token-access-control&quot;&gt;CI Token Access Control&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue discovered in the CI jobs token handling allowed read access to public projects with restricted repositories. This issue is now mitigated in the latest release and is waiting for a CVE ID to be assigned.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;u3mur4&quot;&gt;@u3mur4&lt;&#x2F;a&gt; and @enumzero for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.6+ and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 13.0.1, 12.10.7, 12.9.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/05/27/security-release-13-0-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/05/27/security-release-13-0-1-released/</id>
<published>2020-05-27T00:00:00+00:00</published>
<updated>2020-05-27T00:00:00+00:00</updated>
<author>
<name>Juan Broullon</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 13.0.1, 12.10.7, 12.9.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;GitLab releases patches for vulnerabilities in dedicated security releases. There are &lt;a href=&quot;&#x2F;security&#x2F;#gitlab-security-releases&quot;&gt;two types of security releases&lt;&#x2F;a&gt;: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. You can see all of our regular and security release blog posts &lt;a href=&quot;&#x2F;releases&#x2F;categories&#x2F;releases&#x2F;&quot;&gt;here&lt;&#x2F;a&gt;. In addition, the issues detailing each vulnerability are made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; 30 days after the release in which they were patched.&lt;&#x2F;p&gt;

&lt;p&gt;We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards.  As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to at least the latest security release for their supported version. You can read more &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;gitlab-instance-security-best-practices&#x2F;&quot;&gt;best practices in securing your GitLab instance&lt;&#x2F;a&gt; in our blog post.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-email-verification-bypass&quot;&gt;User Email Verification Bypass&lt;&#x2F;h2&gt;
&lt;p&gt;A security issue allowed users to bypass the email verification process. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13265&quot;&gt;CVE-2020-13265&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;zapprising&quot;&gt;@zapprising&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 12.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;oauth-flow-missing-email-verification-checks&quot;&gt;OAuth Flow Missing Email Verification Checks&lt;&#x2F;h2&gt;
&lt;p&gt;A vulnerability allowed unverified users to use OAuth authorization code flow, which could potentially affect third party applications that use GitLab as an identity provider. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13272&quot;&gt;CVE-2020-13272&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;peet86&quot;&gt;@peet86&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 12.3+ and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;notification-email-verification-bypass&quot;&gt;Notification Email Verification Bypass&lt;&#x2F;h2&gt;
&lt;p&gt;A vulnerability was identified that allowed users to set an unverified email address as notification email. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13276&quot;&gt;CVE-2020-13276&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rgupt&quot;&gt;@rgupt&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;server-side-request-forgery-in-grafana&quot;&gt;Server-Side Request Forgery in Grafana&lt;&#x2F;h2&gt;
&lt;p&gt;A vulnerability in Grafana allowed unauthenticated users to send HTTP requests to internal network resources and read their responses. Further details are available  &lt;a href=&quot;https:&#x2F;&#x2F;grafana.com&#x2F;blog&#x2F;grafana-6.7.4-and-7.0.2-released-with-important-security-fix&#x2F;&quot;&gt;on the Grafana blog&lt;&#x2F;a&gt;. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13379&quot;&gt;CVE-2020-13379&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rhynorater&quot;&gt;@rhynorater&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;nnwakelam&quot;&gt;@nnwakelam&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 11.9 and later&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-sign-up-restriction-bypass&quot;&gt;Group Sign-Up Restriction Bypass&lt;&#x2F;h2&gt;
&lt;p&gt;A user with an unverified address within the restricted domain could request access to domain restricted groups. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13275&quot;&gt;CVE-2020-13275&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;izzsec&quot;&gt;@izzsec&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 12.2 and later&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;mirror-project-owner-impersonation&quot;&gt;Mirror Project Owner Impersonation&lt;&#x2F;h2&gt;
&lt;p&gt;A security issue related to mirror project deletions could lead to the impersonation of its owner. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13263&quot;&gt;CVE-2020-13263&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Please note that the edit project API endpoint has been restricted and only admin users have the ability to set the &lt;code&gt;mirror_user_id&lt;&#x2F;code&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sky003&quot;&gt;@sky003&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 9.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;missing-permission-check-on-fork-relation-creation&quot;&gt;Missing Permission Check on Fork Relation Creation&lt;&#x2F;h2&gt;
&lt;p&gt;A missing security check allowed guest users to create a fork relation on restricted public projects. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13270&quot;&gt;CVE-2020-13270&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-in-repository-files-api&quot;&gt;Cross-Site Scripting in Repository Files API&lt;&#x2F;h2&gt;
&lt;p&gt;Under certain conditions, requests involving the repository files API could result in an XSS vulnerability. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13271&quot;&gt;CVE-2020-13271&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;kubernetes-cluster-token-disclosure&quot;&gt;Kubernetes Cluster Token Disclosure&lt;&#x2F;h2&gt;
&lt;p&gt;A security issue made the Kubernetes cluster token visible to other group maintainers. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13264&quot;&gt;CVE-2020-13264&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE between 10.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;object-storage-file-enumeration&quot;&gt;Object Storage File Enumeration&lt;&#x2F;h2&gt;
&lt;p&gt;A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13268&quot;&gt;CVE-2020-13268&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ledz1996&quot;&gt;@ledz1996&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 12.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insecure-authorization-check-on-project-deploy-keys&quot;&gt;Insecure Authorization Check on Project Deploy Keys&lt;&#x2F;h2&gt;
&lt;p&gt;An insecure authorization check allowed updating permissions of other users&#x27; deploy keys under certain conditions. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13266&quot;&gt;CVE-2020-13266&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab Security Team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 12.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-on-metrics-dashboard&quot;&gt;Cross-Site Scripting on Metrics Dashboard&lt;&#x2F;h2&gt;
&lt;p&gt;A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13267&quot;&gt;CVE-2020-13267&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 12.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-on-custom-dashboards&quot;&gt;Denial of Service on Custom Dashboards&lt;&#x2F;h2&gt;
&lt;p&gt;A security issue enabled denial of service attacks via memory exhaustion. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13273&quot;&gt;CVE-2020-13273&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability was discovered internally by the GitLab team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;client-side-code-injection-through-mermaid-markup&quot;&gt;Client-Side Code Injection through Mermaid Markup&lt;&#x2F;h2&gt;
&lt;p&gt;A specially crafted Mermaid payload allowed performing PUT requests on behalf of other users when clicking on a link. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13262&quot;&gt;CVE-2020-13262&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yvvdwf&quot;&gt;@yvvdwf&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 12.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-on-static-site-editor&quot;&gt;Cross-Site Scripting on Static Site Editor&lt;&#x2F;h2&gt;
&lt;p&gt;A Reflected Cross-Site Scripting has been discovered on the Static Site Editor. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13269&quot;&gt;CVE-2020-13269&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;bull&quot;&gt;@bull&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 12.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-amazon-eks-credentials&quot;&gt;Disclosure of Amazon EKS Credentials&lt;&#x2F;h2&gt;
&lt;p&gt;Amazon EKS Credentials were disclosed to other administrators of an instance through HTML source code. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13261&quot;&gt;CVE-2020-13261&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 12.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-on-workhorse&quot;&gt;Denial of Service on Workhorse&lt;&#x2F;h2&gt;
&lt;p&gt;A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-13274&quot;&gt;CVE-2020-13274&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability has been discovered internally by the GitLab Team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-ruby&quot;&gt;Update Ruby&lt;&#x2F;h2&gt;
&lt;p&gt;Ruby upgrades to version 2.6.6 have been backported to previous versions of GitLab. This upgrade includes security fixes for &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-8130&quot;&gt;CVE-2020-8130&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 12.10.2, 12.9.5, 12.8.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/</id>
<published>2020-04-30T00:00:00+00:00</published>
<updated>2020-04-30T00:00:00+00:00</updated>
<author>
<name>Dominic Couture</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.10.2, 12.9.5, 12.8.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;path-traversal-in-nuget-package-registry&quot;&gt;Path Traversal in NuGet Package Registry&lt;&#x2F;h2&gt;
&lt;p&gt;It was possible to use a malicious NuGet package to read any &lt;code&gt;*.nupkg&lt;&#x2F;code&gt; file on the system. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12448&quot;&gt;CVE-2020-12448&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;saltyyolk&quot;&gt;@saltyyolk of Chaitin Tech&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;workhorse-bypass-leads-to-file-disclosure&quot;&gt;Workhorse Bypass Leads to File Disclosure&lt;&#x2F;h2&gt;
&lt;p&gt;A specially crafted request could bypass the GitLab Workhorse and read files in certain specific paths on the server. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12448&quot;&gt;CVE-2020-12448&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 11.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;oauth-application-client-secrets-revealed&quot;&gt;OAuth Application Client Secrets Revealed&lt;&#x2F;h2&gt;
&lt;p&gt;A vulnerability allowed any user to retrieve OAuth application client secrets after authorizing. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10187&quot;&gt;CVE-2020-10187&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;stefansundin&quot;&gt;@stefansundin&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 12.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible. Additionally, the OAuth client secrets should be rotated if your HTTP logs show that the &lt;code&gt;&#x2F;oauth&#x2F;authorized_applications.json&lt;&#x2F;code&gt; path has been accessed.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;code-owners-approval-rules-are-not-updated-for-existing-merge-requests-when-source-branch-changes&quot;&gt;Code Owners Approval Rules Are Not Updated for Existing Merge Requests When Source Branch Changes&lt;&#x2F;h2&gt;
&lt;p&gt;It was possible to bypass code owners approval by committing changes in a specific order. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12449&quot;&gt;CVE-2020-12449&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;nathanielwyliet&quot;&gt;@nathanielwyliet&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;code-owners-protection-not-enforced-from-web-ui&quot;&gt;Code Owners Protection Not Enforced from Web UI&lt;&#x2F;h2&gt;
&lt;p&gt;It was possible to bypass code owners approval by committing changes through the web interface. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12451&quot;&gt;CVE-2020-12451&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;zane.wright&quot;&gt;@zane.wright&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;repository-mirror-passwords-exposed-to-maintainers&quot;&gt;Repository Mirror Passwords Exposed To Maintainers&lt;&#x2F;h2&gt;
&lt;p&gt;When a maintainer deleted a repository mirror, the HTTP response contained the passwords set for the other mirrors on the same repository. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12450&quot;&gt;CVE-2020-12450&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 11.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;admin-audit-log-page-denial-of-service&quot;&gt;Admin Audit Log Page Denial of Service&lt;&#x2F;h2&gt;
&lt;p&gt;A specific API call could make the admin audit log page inaccessible. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12452&quot;&gt;CVE-2020-12452&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 12.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-project-id-revealed-through-group-api&quot;&gt;Private Project ID Revealed Through Group API&lt;&#x2F;h2&gt;
&lt;p&gt;If a public group contained a private project that was used as a template, its ID was revealed in the group API. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12453&quot;&gt;CVE-2020-12453&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 11.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;elasticsearch-credentials-logged-to-elk&quot;&gt;Elasticsearch Credentials Logged to ELK&lt;&#x2F;h2&gt;
&lt;p&gt;The data logged in ELK after modifying the Elasticsearch integration through the admin setting page contained credentials. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12454&quot;&gt;CVE-2020-12454&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 8.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;github-personal-access-token-exposed-on-integrations-page&quot;&gt;GitHub Personal Access Token Exposed on Integrations Page&lt;&#x2F;h2&gt;
&lt;p&gt;The GitHub Personal Access Token field was not masked on the integration settings page. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12455&quot;&gt;CVE-2020-12455&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;kylifornication&quot;&gt;@kylifornication&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 10.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-nokogiri-dependency-in-gitaly&quot;&gt;Update Nokogiri dependency in Gitaly&lt;&#x2F;h2&gt;
&lt;p&gt;The Nokogiri dependency has been upgraded to 1.10.9 in Gitaly. This upgrade includes a security fix for &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7595&quot;&gt;CVE-2020-7595&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-openssl-dependency&quot;&gt;Update OpenSSL Dependency&lt;&#x2F;h2&gt;
&lt;p&gt;The OpenSSL dependency has been upgraded from 1.1.1f to 1.1.1g. This upgrade includes a security fix for &lt;a href=&quot;https:&#x2F;&#x2F;www.openssl.org&#x2F;news&#x2F;secadv&#x2F;20200421.txt&quot;&gt;CVE-2020-1967&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab Omnibus 12.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-git&quot;&gt;Update git&lt;&#x2F;h2&gt;
&lt;p&gt;git has been updated to version 2.24.3. This upgrade includes a security fix for &lt;a href=&quot;https:&#x2F;&#x2F;lore.kernel.org&#x2F;git&#x2F;xmqq4kterq5s.fsf@gitster.c.googlers.com&#x2F;&quot;&gt;CVE-2020-11008&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab  Critical Security Release: 12.9.3, 12.8.9, and 12.7.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/</id>
<published>2020-04-14T00:00:00+00:00</published>
<updated>2020-04-14T00:00:00+00:00</updated>
<author>
<name>Jeremy Matos</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.9.3, 12.8.9, and 12.7.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;NOTE: The GPG keys used to sign GitLab packages has changed. If you see
errors due to signature verification or GPG errors, be sure to
update these public keys. See &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;blog&#x2F;gpg-key-for-gitlab-package-repositories-metadata-changing&#x2F;&quot;&gt;this blog post&lt;&#x2F;a&gt;
for more details.&lt;&#x2F;p&gt;

&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;nuget-package-and-file-disclosure-through-gitlab-workhorse&quot;&gt;NuGet Package and File Disclosure through GitLab Workhorse&lt;&#x2F;h2&gt;

&lt;p&gt;An internal investigation revealed that a particular header could be used to override restriction and results in GitLab Workhorse disclosing NuGet packages and files in the &lt;code&gt;&#x2F;tmp&lt;&#x2F;code&gt; directory. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-11505&quot;&gt;CVE-2020-11505&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for also responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.8.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;job-artifact-uploads-and-file-disclosure-through-gitlab-workhorse&quot;&gt;Job Artifact Uploads and File Disclosure through GitLab Workhorse&lt;&#x2F;h2&gt;

&lt;p&gt;An internal investigation revealed that a particular header could be used to override restrictions and results in GitLab Workhorse disclosing job artifact uploads and files in the &lt;code&gt;&#x2F;tmp&lt;&#x2F;code&gt; directory. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-11506&quot;&gt;CVE-2020-11506&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;manassehzhou&quot;&gt;@manassehzhou&lt;&#x2F;a&gt; for also responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE&#x2F;CE 10.7.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;incorrect-membership-following-group-removal&quot;&gt;Incorrect membership following group removal&lt;&#x2F;h2&gt;

&lt;p&gt;An internal investigation revealed that members of a group could still have access after a group is deleted. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-11649&quot;&gt;CVE-2020-11649&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE&#x2F;CE 8.15 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;logging-of-praefect-tokens&quot;&gt;Logging of Praefect tokens&lt;&#x2F;h2&gt;

&lt;p&gt;An internal investigation revealed that Praefect tokens were logged by Gitaly. The issue is now fixed.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus 12.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-rack-dependency&quot;&gt;Update Rack dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The Rack dependency and its related gems have been upgraded to 2.0.9. This upgrade includes a security fix for &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-16782&quot;&gt;CVE-2019-16782&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-openssl-dependency&quot;&gt;Update OpenSSL dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The OpenSSL dependency has been upgraded from 1.1.d to 1.1.1f to include those &lt;a href=&quot;https:&#x2F;&#x2F;www.openssl.org&#x2F;news&#x2F;changelog.html#openssl-111&quot;&gt;improvements&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 12.9.1, 12.8.8, and 12.7.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/</id>
<published>2020-03-26T00:00:00+00:00</published>
<updated>2020-03-26T00:00:00+00:00</updated>
<author>
<name>Vitor Meireles De Sousa</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.9.1, 12.8.8, and 12.7.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-file-read-when-moving-an-issue&quot;&gt;Arbitrary File Read when Moving an Issue&lt;&#x2F;h2&gt;
&lt;p&gt;An arbitrary local file read was possible when an moving issues between projects. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10977&quot;&gt;CVE-2020-10977&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 8.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;path-traversal-in-npm-package-registry&quot;&gt;Path Traversal in NPM Package Registry&lt;&#x2F;h2&gt;
&lt;p&gt;The NPM package registry was vulnerable to a path traversal issue. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10953&quot;&gt;CVE-2020-10953&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;saltyyolk&quot;&gt;@saltyyolk&lt;&#x2F;a&gt; of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE 11.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-on-project-import&quot;&gt;SSRF on Project Import&lt;&#x2F;h2&gt;
&lt;p&gt;An SSRF issue was discovered in the project import note feature. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10956&quot;&gt;CVE-2020-10956&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 8.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;external-users-can-create-personal-snippet&quot;&gt;External Users Can Create Personal Snippet&lt;&#x2F;h2&gt;
&lt;p&gt;Insufficient access verification lead to unauthorized creation of personal snippets through the API by an external user. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12275&quot;&gt;CVE-2020-12275&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks the GitLab team for finding and reporting this issue.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 12.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;triggers-decription-can-be-updated-by-other-maintainers-in-project&quot;&gt;Triggers Decription Can be Updated by Other Maintainers in Project&lt;&#x2F;h2&gt;
&lt;p&gt;A maintainer can modify other maintainers&#x27; pipeline trigger descriptions within the same project. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10981&quot;&gt;CVE-2020-10981&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-on-confidential-issues-moved-to-private-programs&quot;&gt;Information Disclosure on Confidential Issues Moved to Private Programs&lt;&#x2F;h2&gt;
&lt;p&gt;Issues opened in a public project and then moved to a private project reveal the private project namespace through Web-UI and GraphQL API. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10978&quot;&gt;CVE-2020-10978&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;0xwintermute&quot;&gt;@0xwintermute&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 8.11 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;potential-dos-in-repository-archive-download&quot;&gt;Potential DoS in Repository Archive Download&lt;&#x2F;h2&gt;
&lt;p&gt;Repository archives download could be abused to cause large resource consumption on an instance. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10954&quot;&gt;CVE-2020-10954&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks the GitLab team for finding and reporting this issue.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;blocked-users-can-still-pullpush-docker-images&quot;&gt;Blocked Users Can Still Pull&#x2F;Push Docker Images&lt;&#x2F;h2&gt;
&lt;p&gt;Under certain circumstances a blocked user still had the ability to pull images from the internal container registry of any projects to which the user had access. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10952&quot;&gt;CVE-2020-10952&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;logan5&quot;&gt;@logan5&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 8.11 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;repository-mirroring-not-disabled-when-feature-not-activated&quot;&gt;Repository Mirroring not Disabled when Feature not Activated&lt;&#x2F;h2&gt;
&lt;p&gt;A project repository could still be mirrored when the feature was not enabled. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12277&quot;&gt;CVE-2020-12277&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;adam__b&quot;&gt;@adam__b&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;vulnerability-feedback-page-was-leaking-information-on-vulnerabilities&quot;&gt;Vulnerability Feedback Page Was Leaking Information on Vulnerabilities&lt;&#x2F;h2&gt;
&lt;p&gt;The vulnerability feedback page was leaking metadata and comments on vulnerabilities to unauthorized users. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10975&quot;&gt;CVE-2020-10975&lt;&#x2F;a&gt; .&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-vulnerability-in-admin-feature&quot;&gt;Stored XSS Vulnerability in Admin Feature&lt;&#x2F;h2&gt;
&lt;p&gt;A stored XSS vulnerability was discovered in an admin notification feature. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-12276&quot;&gt;CVE-2020-12276&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks the GitLab team for finding and reporting this issue.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 9.5.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upload-feature-allowed-a-user-to-read-unauthorized-exported-files&quot;&gt;Upload Feature Allowed a User to Read Unauthorized Exported Files&lt;&#x2F;h2&gt;
&lt;p&gt;The upload feature was vulnerable to parameter tampering allowing and unauthorized user to read content available under specific folders. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10955&quot;&gt;CVE-2020-10955&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;manassehzhou&quot;&gt;@manassehzhou&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 11.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-users-are-able-to-see-ci-metrics&quot;&gt;Unauthorized Users Are Able to See CI Metrics&lt;&#x2F;h2&gt;
&lt;p&gt;Restricted CI pipelines metrics could be seen by members even if the pipeline was restricted. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10979&quot;&gt;CVE-2020-10979&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 11.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;last-pipeline-status-of-a-merge-request-leaked&quot;&gt;Last Pipeline Status of a Merge Request Leaked&lt;&#x2F;h2&gt;
&lt;p&gt;The last status of a restricted pipeline was returned through a query in the merge request widget. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10976&quot;&gt;CVE-2020-10976&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 8.17 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;blind-ssrf-on-fogbugz&quot;&gt;Blind SSRF on FogBugz&lt;&#x2F;h2&gt;
&lt;p&gt;A blind SSRF was discovered in the FogBugz integration. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10980&quot;&gt;CVE-2020-10980&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 8.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-nokogiri-dependency&quot;&gt;Update Nokogiri dependency&lt;&#x2F;h2&gt;
&lt;p&gt;The Nokogiri dependency has been upgraded to 1.10.8. This upgrade include a security fix for &lt;a href=&quot;https:&#x2F;&#x2F;github.com&#x2F;advisories&#x2F;GHSA-7553-jr98-vx47&quot;&gt;CVE-2020-7595&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-pcre2-dependency&quot;&gt;Update Pcre2 dependency&lt;&#x2F;h2&gt;
&lt;p&gt;The pcre2 dependency has been upgraded to 10.34. This upgrade include a security fix for &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-20454&quot;&gt;CVE-2019-20454&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects all previous versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;new-ssh-keys-not-being-added-to-the-authorized_keys-file&quot;&gt;New SSH keys not being added to the &lt;code&gt;authorized_keys&lt;&#x2F;code&gt; file&lt;&#x2F;h2&gt;
&lt;p&gt;A bug in GitLab 12.9.0 prevented new SSH keys from being added to the Git user&#x27;s
&lt;code&gt;authorized_keys&lt;&#x2F;code&gt; file, effectively breaking Git-over-SSH operations for new
users. See issue &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;-&#x2F;issues&#x2F;212178&quot;&gt;#212178&lt;&#x2F;a&gt;
for full details.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab 12.9.0 only.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;Upgrade to GitLab 12.9.1 or later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 12.8.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/03/11/critical-security-release-gitlab-12-dot-8-dot-6-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/03/11/critical-security-release-gitlab-12-dot-8-dot-6-released/</id>
<published>2020-03-11T00:00:00+00:00</published>
<updated>2020-03-11T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing version 12.8.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;This version contains an important security fix, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;email-confirmation-not-required-on-sign-up&quot;&gt;Email Confirmation Not Required on Sign-up&lt;&#x2F;h2&gt;

&lt;p&gt;With the release of 12.8.0, a soft email confirmation sign-up flow was enabled by default. For instances with sign-up enabled, users were able to sign up and access the instance for a 2 day grace period with an unconfirmed email address, potentially bypassing domain restrictions. The change was reverted and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10535&quot;&gt;CVE-2020-10535&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.8.0 through 12.8.5.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 12.8.2, 12.7.7, and 12.6.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/</id>
<published>2020-03-04T00:00:00+00:00</published>
<updated>2020-03-04T00:00:00+00:00</updated>
<author>
<name>Andrew Kelly</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.8.2, 12.7.7, and 12.6.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;directory-traversal-to-arbitrary-file-read&quot;&gt;Directory Traversal to Arbitrary File Read&lt;&#x2F;h2&gt;

&lt;p&gt;A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10086&quot;&gt;CVE-2020-10086&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 10.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;account-takeover-through-expired-link&quot;&gt;Account Takeover Through Expired Link&lt;&#x2F;h2&gt;

&lt;p&gt;A scenario was discovered in which a GitLab account could be taken over through an expired link. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10074&quot;&gt;CVE-2020-10074&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;gnux&quot;&gt;@gnux&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 10.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;server-side-request-forgery-through-deprecated-service&quot;&gt;Server Side Request Forgery Through Deprecated Service&lt;&#x2F;h2&gt;

&lt;p&gt;An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10077&quot;&gt;CVE-2020-10077&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 3.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-two-factor-authentication-requirement-bypass&quot;&gt;Group Two-Factor Authentication Requirement Bypass&lt;&#x2F;h2&gt;

&lt;p&gt;Under certain conditions where users should have been required to configure two-factor authentication, it was not being required. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10079&quot;&gt;CVE-2020-10079&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 7.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-merge-request-pages&quot;&gt;Stored XSS in Merge Request Pages&lt;&#x2F;h2&gt;

&lt;p&gt;A stored cross-site scripting vulnerability was discovered when displaying merge requests. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10076&quot;&gt;CVE-2020-10076&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mike12&quot;&gt;@mike12&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 12.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-merge-request-submission-form&quot;&gt;Stored XSS in Merge Request Submission Form&lt;&#x2F;h2&gt;

&lt;p&gt;The merge request submission form was determined to have a stored cross-site scripting vulnerability. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10078&quot;&gt;CVE-2020-10078&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 12.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-file-view&quot;&gt;Stored XSS in File View&lt;&#x2F;h2&gt;

&lt;p&gt;A cross-site scripting vulnerability was found when viewing particular file types. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10091&quot;&gt;CVE-2020-10091&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mike12&quot;&gt;@mike12&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 9.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-grafana-integration&quot;&gt;Stored XSS in Grafana Integration&lt;&#x2F;h2&gt;

&lt;p&gt;A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10092&quot;&gt;CVE-2020-10092&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 12.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;contribution-analytics-exposed-to-non-members&quot;&gt;Contribution Analytics Exposed to Non-members&lt;&#x2F;h2&gt;

&lt;p&gt;It was possible for certain non-members to access the Contribution Analytics page of a private group. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10080&quot;&gt;CVE-2020-10080&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 8.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;incorrect-access-control-in-docker-registry-via-deploy-tokens&quot;&gt;Incorrect Access Control in Docker Registry via Deploy Tokens&lt;&#x2F;h2&gt;

&lt;p&gt;The Docker registry was improperly accessible through a particular set of conditions. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-8113&quot;&gt;CVE-2020-8113&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 10.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-via-permission-checks&quot;&gt;Denial of Service via Permission Checks&lt;&#x2F;h2&gt;

&lt;p&gt;It was internally discovered that a potential denial of service involving permissions checks could impact a project home page. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10073&quot;&gt;CVE-2020-10073&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.4.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-in-design-for-public-issue&quot;&gt;Denial of Service in Design For Public Issue&lt;&#x2F;h2&gt;

&lt;p&gt;A denial of service vulnerability impacting the designs for public issues was discovered. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10082&quot;&gt;CVE-2020-10082&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 12.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;incorrect-access-control-via-lfs-import&quot;&gt;Incorrect Access Control via LFS Import&lt;&#x2F;h2&gt;

&lt;p&gt;It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10081&quot;&gt;CVE-2020-10081&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unescaped-html-in-header&quot;&gt;Unescaped HTML in Header&lt;&#x2F;h2&gt;

&lt;p&gt;A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10075&quot;&gt;CVE-2020-10075&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 12.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-merge-request-titles-leaked-via-widget&quot;&gt;Private Merge Request Titles Leaked via Widget&lt;&#x2F;h2&gt;

&lt;p&gt;A particular view was exposing merge private merge request titles. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10085&quot;&gt;CVE-2020-10085&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 12.3.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-namespace-exposed-via-vulnerability-feedback-endpoint&quot;&gt;Project Namespace Exposed via Vulnerability Feedback Endpoint&lt;&#x2F;h2&gt;

&lt;p&gt;Sending a specially crafted request to the &lt;code&gt;vulnerability_feedback&lt;&#x2F;code&gt; endpoint could result in the exposure of a private project namespace. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10084&quot;&gt;CVE-2020-10084&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-through-recursive-requests&quot;&gt;Denial of Service Through Recursive Requests&lt;&#x2F;h2&gt;

&lt;p&gt;Using several features to recursively request eachother, it was possible to cause the denial of service of a GitLab instance. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10089&quot;&gt;CVE-2020-10089&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;exem_pt&quot;&gt;@exem_pt&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 8.11 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-authorization-not-being-updated&quot;&gt;Project Authorization Not Being Updated&lt;&#x2F;h2&gt;

&lt;p&gt;Under certain conditions involving groups, project authorization changes were not being applied. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10083&quot;&gt;CVE-2020-10083&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 12.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;incorrect-permission-level-for-group-invites&quot;&gt;Incorrect Permission Level For Group Invites&lt;&#x2F;h2&gt;

&lt;p&gt;Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10088&quot;&gt;CVE-2020-10088&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;cristian.berner&quot;&gt;Cristian Berner&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-18&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 12.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-18&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-private-group-epic-information&quot;&gt;Disclosure of Private Group Epic Information&lt;&#x2F;h2&gt;

&lt;p&gt;Under certain group conditions, group epic information was unintentionally being disclosed. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10090&quot;&gt;CVE-2020-10090&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-19&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 11.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-19&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-ip-address-exposed-via-badge-images&quot;&gt;User IP Address Exposed via Badge images&lt;&#x2F;h2&gt;

&lt;p&gt;Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-10087&quot;&gt;CVE-2020-10087&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-20&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-20&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-postgresql-gitlab-omnibus&quot;&gt;Update postgresql (GitLab Omnibus)&lt;&#x2F;h2&gt;

&lt;p&gt;The version of postgresql was updated from 9.6.14 to 9.6.16 and postgresql_new 10.9 and 10.11 to remediate &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2019-10208&quot;&gt;CVE-2019-10208&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-21&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab Omnibus versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-21&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab  Critical Security Release: 12.7.6, 12.6.7, and 12.5.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/02/13/critical-security-release-gitlab-12-dot-7-dot-6-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/02/13/critical-security-release-gitlab-12-dot-7-dot-6-released/</id>
<published>2020-02-13T00:00:00+00:00</published>
<updated>2020-02-13T00:00:00+00:00</updated>
<author>
<name>Jeremy Matos</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.7.6, 12.6.7, and 12.5.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain an important security fix, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;incorrect-membership-handling-of-group-sharing-feature&quot;&gt;Incorrect membership handling of group sharing feature&lt;&#x2F;h2&gt;

&lt;p&gt;Sharing a group with another group could grant project access to unauthorized users. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-8795&quot;&gt;CVE-2020-8795&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.5.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 12.7.4, 12.6.6, and 12.5.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/</id>
<published>2020-01-30T00:00:00+00:00</published>
<updated>2020-01-30T00:00:00+00:00</updated>
<author>
<name>Andrew Kelly</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.7.4, 12.6.6, and 12.5.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;path-traversal-to-arbitrary-file-read&quot;&gt;Path Traversal to Arbitrary File Read&lt;&#x2F;h2&gt;

&lt;p&gt;The dependency proxy was found to have a path traversal vulnerability that if combined with an arbitrary file read vulnerability could potentially result in access to files and user data. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7966&quot;&gt;CVE-2020-7966&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.11 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-permissions-not-validated-in-projectexportworker&quot;&gt;User Permissions Not Validated in ProjectExportWorker&lt;&#x2F;h2&gt;

&lt;p&gt;An internal investigation revealed that permissions were not being validated in the ProjectExportWorker for the user scheduling exports. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-8114&quot;&gt;CVE-2020-8114&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-vulnerability-in-file-api&quot;&gt;XSS Vulnerability in File API&lt;&#x2F;h2&gt;

&lt;p&gt;Under certain conditions, requests involving the file API could result in an XSS vulnerability. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7973&quot;&gt;CVE-2020-7973&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;package-and-file-disclosure-through-gitlab-workhorse&quot;&gt;Package and File Disclosure through GitLab Workhorse&lt;&#x2F;h2&gt;

&lt;p&gt;An internal investigation revealed that a particular header could be used to override restrictions and result in the GitLab Workhorse disclosing packages and files in the &lt;code&gt;&#x2F;tmp&lt;&#x2F;code&gt; directory. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-6833&quot;&gt;CVE-2020-6833&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-vulnerability-in-create-groups&quot;&gt;XSS Vulnerability in Create Groups&lt;&#x2F;h2&gt;

&lt;p&gt;A stored XSS vulnerability was discovered using the create group functionality. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7971&quot;&gt;CVE-2020-7971&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rioncool22&quot;&gt;@rioncool22&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;issue-and-merge-request-activity-counts-exposed&quot;&gt;Issue and Merge Request Activity Counts Exposed&lt;&#x2F;h2&gt;

&lt;p&gt;Despite project settings otherwise, non-members were able to view activity counts of issues and merge requests. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7967&quot;&gt;CVE-2020-7967&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;email-confirmation-bypass-using-api&quot;&gt;Email Confirmation Bypass Using API&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that a certain API endpoint could be used to bypass email verification requirements. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7972&quot;&gt;CVE-2020-7972&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;whitehattushu&quot;&gt;@whitehattushu&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-forked-private-project-source-code&quot;&gt;Disclosure of Forked Private Project Source Code&lt;&#x2F;h2&gt;

&lt;p&gt;Authorization checks were not being applied in some cases for public repositories with merge request visibility set to members only, resulting in source code potentially being disclosed. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7968&quot;&gt;CVE-2020-7968&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-project-names-exposed-in-graphql-queries&quot;&gt;Private Project Names Exposed in GraphQL queries&lt;&#x2F;h2&gt;

&lt;p&gt;Under certain conditions, particularly crafted GraphQL queries could expose private project names. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7979&quot;&gt;CVE-2020-7979&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-issues-and-merge-requests-via-todos&quot;&gt;Disclosure of Issues and Merge Requests via Todos&lt;&#x2F;h2&gt;

&lt;p&gt;Unexpired Todos could be leveraged to disclose (potentially confidential) issues and merge requests. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7969&quot;&gt;CVE-2020-7969&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-via-asciidoc&quot;&gt;Denial of Service via AsciiDoc&lt;&#x2F;h2&gt;

&lt;p&gt;Certain payloads could result in a denial of service due to abuse of AsciiDoc includes. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7978&quot;&gt;CVE-2020-7978&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;kgadyrka&quot;&gt;@kgadyrka&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;last-pipeline-status-exposed&quot;&gt;Last Pipeline Status Exposed&lt;&#x2F;h2&gt;

&lt;p&gt;Despite restrictions in place, the last pipeline status was visible via the commits API. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7974&quot;&gt;CVE-2020-7974&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-change-of-pipeline-status&quot;&gt;Arbitrary Change of Pipeline Status&lt;&#x2F;h2&gt;

&lt;p&gt;Under certain conditions, a developer of a project can change the pipeline status of a protected branch to any value. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7977&quot;&gt;CVE-2020-7977&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;grafana-token-displayed-in-plaintext&quot;&gt;Grafana Token Displayed in Plaintext&lt;&#x2F;h2&gt;

&lt;p&gt;The Grafana token was displayed in plaintext on the settings page, but is now being masked. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-7976&quot;&gt;CVE-2020-7976&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-excon-gem&quot;&gt;Update excon gem&lt;&#x2F;h2&gt;

&lt;p&gt;The excon gem was updated to address a flaw within that library, identified as &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-16779&quot;&gt;CVE-2019-16779&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 5.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-rdoc-gem&quot;&gt;Update rdoc gem&lt;&#x2F;h2&gt;

&lt;p&gt;The rdoc gem was updated, which removed an older version of the jQuery library that had several known security vulnerabilities.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-rack-cors-gem&quot;&gt;Update rack-cors gem&lt;&#x2F;h2&gt;

&lt;p&gt;The rack-cors gem was updated to address a vulnerability in that library, &lt;a href=&quot;https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2019-18978&quot;&gt;CVE-2019-18978&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 6.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-rubyzip-gem&quot;&gt;Update rubyzip gem&lt;&#x2F;h2&gt;

&lt;p&gt;The rubyzip gem was updated to address a vulnerability in that library, &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-16892&quot;&gt;CVE-2019-16892&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;apply-january-mattermost-security-updates-gitlab-omnibus&quot;&gt;Apply January Mattermost Security Updates (GitLab Omnibus)&lt;&#x2F;h2&gt;

&lt;p&gt;The &lt;a href=&quot;https:&#x2F;&#x2F;mattermost.com&#x2F;blog&#x2F;mattermost-security-update-5-18-1-5-17-3-5-16-5-5-9-8-esr-released&#x2F;&quot;&gt;January Mattermost Security Updates&lt;&#x2F;a&gt; were applied.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-18&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab  Critical Security Release: 12.6.4, 12.5.7, and 12.4.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/</id>
<published>2020-01-13T00:00:00+00:00</published>
<updated>2020-01-13T00:00:00+00:00</updated>
<author>
<name>Jeremy Matos</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.6.4, 12.5.7, and 12.4.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain an important security fix, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-objects-exposed-through-project-import&quot;&gt;Private objects exposed through project import&lt;&#x2F;h2&gt;

&lt;p&gt;Using the project import feature, it was possible for someone to obtain issues from private projects. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2020-6832&quot;&gt;CVE-2020-6832&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab  Security Release: 12.6.2, 12.5.6, and 12.4.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2020/01/02/security-release-gitlab-12-6-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2020/01/02/security-release-gitlab-12-6-2-released/</id>
<published>2020-01-02T00:00:00+00:00</published>
<updated>2020-01-02T00:00:00+00:00</updated>
<author>
<name>Vitor Meireles De Sousa</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.6.2, 12.5.6, and 12.4.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes that were inadvertently not included in our most recent security release. We strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-maintainers-can-updatedelete-group-runners-using-api&quot;&gt;Group Maintainers Can Update&#x2F;Delete Group Runners Using API&lt;&#x2F;h2&gt;
&lt;p&gt;Insufficient access verification lead to unauthorized modification of group runners through the API. This issue is now mitigated in the latest release and is assigned CVE-2019-20144.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;graphql-queries-can-hang-the-application&quot;&gt;GraphQL Queries Can Hang the Application&lt;&#x2F;h2&gt;
&lt;p&gt;Certain GraphQL queries can hang the application due to some server&#x27;s missing parameters in handling time consuming queries. This issue is now mitigated in the latest release and is assigned CVE-2019-20146.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks the GitLab team for finding and reporting this issue.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 11.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-users-have-access-to-milestones-of-releases&quot;&gt;Unauthorized Users Have Access to Milestones of Releases&lt;&#x2F;h2&gt;
&lt;p&gt;Under certain circumstances, an unauthenticated user can access a release&#x27;s milestone and issues. This issue is now mitigated in the latest release and is assigned CVE-2019-20143.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 12.6.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-group-name-revealed-through-protected-tags-api&quot;&gt;Private Group Name Revealed Through Protected Tags API&lt;&#x2F;h2&gt;
&lt;p&gt;When a group is removed from a project membership, it was possible for group members to see project namespace changes through the Protected Tags API. This issue is now mitigated in the latest release and is assigned CVE-2019-20147.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 9.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;users-can-publish-reviews-on-locked-merge-requests&quot;&gt;Users Can Publish Reviews on Locked Merge Requests&lt;&#x2F;h2&gt;
&lt;p&gt;When a merge request was locked, a user was still able to submit a drafted review and publish. This issue is now mitigated in the latest release and is assigned CVE-2019-20145.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rafiem&quot;&gt;@rafiem&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 11.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;dos-in-the-issue-and-commit-comments-pages&quot;&gt;DoS in the Issue and Commit Comments Pages&lt;&#x2F;h2&gt;
&lt;p&gt;While adding a comment in the Issue and Commit pages, a malicious user can cause  HTTP 500 code when sending a special message. This issue is now mitigated in the latest release and is assigned CVE-2019-20142.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;dfens&quot;&gt;@dfens&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab CE&#x2F;EE 12.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-name-disclosed-through-unsubscribe-link&quot;&gt;Project Name Disclosed Through Unsubscribe Link&lt;&#x2F;h2&gt;
&lt;p&gt;When an unauthenticated user visits an unsubscribe link, a private project name can be disclosed under certain conditions. This issue is now mitigated in the latest release and is assigned CVE-2019-20148.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 8.13 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-project-name-disclosed-through-notification-settings&quot;&gt;Private Project Name Disclosed Through Notification Settings&lt;&#x2F;h2&gt;
&lt;p&gt;Under specific conditions an user can view the name of a private project through the notifications settings. This issue is now mitigated in the latest release and is assigned CVE-2020-5197.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;iframe&quot;&gt;@iframe&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;
&lt;p&gt;Affects GitLab EE&#x2F;CE 5.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;
&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;
&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;Update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;
&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Patch Release: 12.0.12, 12.1.17, and 12.2.12</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/12/16/gitlab-12-2-12-release/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/12/16/gitlab-12-2-12-release/</id>
<published>2019-12-16T00:00:00+00:00</published>
<updated>2019-12-16T00:00:00+00:00</updated>
<author>
<name>John T Skarbek</name>
</author>
<content type='html'>&lt;!-- For detailed instructions on how to complete this, please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;release&#x2F;docs&#x2F;blob&#x2F;master&#x2F;general&#x2F;patch&#x2F;blog-post.md --&gt;

&lt;p&gt;Today we are releasing version 12.0.12, 12.1.17, and 12.2.12 for GitLab Community Edition and Enterprise Edition.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-community-edition-and-enterprise-edition&quot;&gt;GitLab Community Edition and Enterprise Edition&lt;&#x2F;h2&gt;

&lt;p&gt;Available in GitLab Core, Starter, Premium, and Ultimate:&lt;&#x2F;p&gt;

&lt;h3 id=&quot;backport&quot;&gt;Backport&lt;&#x2F;h3&gt;
&lt;p&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;sidekiq-reliable-fetch&#x2F;merge_requests&#x2F;14&quot;&gt;Fix infinite retries of interrupted jobs&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h3 id=&quot;dependency-update&quot;&gt;Dependency Update&lt;&#x2F;h3&gt;

&lt;p&gt;The Git dependency has been upgraded to 2.22.2 in order to apply security fixes
detailed
&lt;a href=&quot;https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;git&#x2F;git&#x2F;master&#x2F;Documentation&#x2F;RelNotes&#x2F;2.22.2.txt&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19604&quot;&gt;CVE-2019-19604&lt;&#x2F;a&gt;
was identified by the GitLab Security Research team. For more information on
that issue, please visit the &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;gl-security&#x2F;disclosures&#x2F;blob&#x2F;master&#x2F;003_git_submodule&#x2F;advisory.md&quot;&gt;GitLab Security Research Advisory&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-barometer&quot;&gt;Upgrade barometer&lt;&#x2F;h2&gt;

&lt;p&gt;This version does not include any new migrations, and should not require any
downtime.&lt;&#x2F;p&gt;

&lt;p&gt;Please be aware that by default the Omnibus packages will stop, run migrations,
and start again, no matter how “big” or “small” the upgrade is. This behavior
can be changed by adding a &lt;a href=&quot;http:&#x2F;&#x2F;docs.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;&lt;code&gt;&#x2F;etc&#x2F;gitlab&#x2F;skip-auto-reconfigure&lt;&#x2F;code&gt;&lt;&#x2F;a&gt; file,
which is only used for &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;updates&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-subscriptions&quot;&gt;GitLab subscriptions&lt;&#x2F;h2&gt;

&lt;p&gt;Access to GitLab Starter, Premium, and Ultimate features is granted by a paid &lt;a href=&quot;&#x2F;pricing&#x2F;&quot;&gt;subscription&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Alternatively, &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;users&#x2F;sign_in&quot;&gt;sign up for GitLab.com&lt;&#x2F;a&gt;
to use GitLab&#x27;s own infrastructure.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab  Critical Security Release: 12.5.4, 12.4.6, and 12.3.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/12/10/critical-security-release-gitlab-12-5-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/12/10/critical-security-release-gitlab-12-5-4-released/</id>
<published>2019-12-10T00:00:00+00:00</published>
<updated>2019-12-10T00:00:00+00:00</updated>
<author>
<name>Jeremy Matos</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.5.4, 12.4.6, and 12.3.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;path-traversal-with-potential-remote-code-execution&quot;&gt;Path traversal with potential remote code execution&lt;&#x2F;h2&gt;

&lt;p&gt;Insufficient parameter sanitization for Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19628&quot;&gt;CVE-2019-19628&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-private-code-via-elasticsearch-integration&quot;&gt;Disclosure of private code via Elasticsearch integration&lt;&#x2F;h2&gt;

&lt;p&gt;When transferring a public project to a private group, private code would be disclosed via the Group Search API provided by Elasticsearch integration. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19629&quot;&gt;CVE-2019-19629&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above &lt;strong&gt;with enabled&lt;&#x2F;strong&gt; Elasticsearch integration are upgraded to the latest version as soon as possible. If you are unable to upgrade, consider &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;elasticsearch.html#disabling-elasticsearch&quot;&gt;disabling Elasticsearch&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-git-dependency&quot;&gt;Update Git dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The Git dependency has been upgraded to 2.22.2 in order to apply security fixes detailed &lt;a href=&quot;https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;git&#x2F;git&#x2F;master&#x2F;Documentation&#x2F;RelNotes&#x2F;2.22.2.txt&quot;&gt;here&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19604&quot;&gt;CVE-2019-19604&lt;&#x2F;a&gt; was identified by the GitLab Security Research team. For more information on that issue, please visit the &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;gl-security&#x2F;disclosures&#x2F;blob&#x2F;master&#x2F;003_git_submodule&#x2F;advisory.md&quot;&gt;GitLab Security Research Advisory&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab Omnibus.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab  Security Release: 12.5.2, 12.4.5, and 12.3.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/11/27/security-release-gitlab-12-5-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/11/27/security-release-gitlab-12-5-2-released/</id>
<published>2019-11-27T00:00:00+00:00</published>
<updated>2019-11-27T00:00:00+00:00</updated>
<author>
<name>Andrew Kelly</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.5.2, 12.4.5, and 12.3.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes that were inadvertently not included in our most recent security release. We strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-access-to-grafana-metrics&quot;&gt;Unauthorized access to grafana metrics&lt;&#x2F;h2&gt;

&lt;p&gt;Grafana metrics were unintentionally being exposed to unauthorized users. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19262&quot;&gt;CVE-2019-19262&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;d0xing&quot;&gt;@d0xing&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost-dependency&quot;&gt;Update Mattermost dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The Mattermost dependency has been upgraded to 5.14.5 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus 12.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab  Security Release: 12.5.1, 12.4.4, and 12.3.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/11/27/security-release-gitlab-12-5-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/11/27/security-release-gitlab-12-5-1-released/</id>
<published>2019-11-27T00:00:00+00:00</published>
<updated>2019-11-27T00:00:00+00:00</updated>
<author>
<name>Andrew Kelly</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.5.1, 12.4.4, and 12.3.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. If you are unable to upgrade, consider &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;elasticsearch.html#disabling-elasticsearch&quot;&gt;disabling Elasticsearch&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Update&lt;&#x2F;strong&gt; Two fixes for GitLab Omnibus inadvertently did not make it into this release, so we are releasing new minor versions in order to include those changes in all versions of GitLab. We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations be updated to the new versions (12.5.2, 12.4.5, 12.3.8) once they are available.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;path-traversal-with-potential-remote-code-execution&quot;&gt;Path traversal with potential remote code execution&lt;&#x2F;h2&gt;

&lt;p&gt;Improper parameter sanitization for Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19088&quot;&gt;CVE-2019-19088&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-objects-exposed-through-project-import&quot;&gt;Private objects exposed through project import&lt;&#x2F;h2&gt;

&lt;p&gt;Using the project import feature, it was possible for someone to obtain issue, merge request, and other data from private projects. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19309&quot;&gt;CVE-2019-19309&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-notes-via-elasticsearch-integration&quot;&gt;Disclosure of notes via Elasticsearch integration&lt;&#x2F;h2&gt;

&lt;p&gt;Private notes would be disclosed via the API of the Group Search feature provided by Elasticsearch integration. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19086&quot;&gt;CVE-2019-19086&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.17 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above &lt;strong&gt;with enabled&lt;&#x2F;strong&gt; Elasticsearch integration are upgraded to the latest version as soon as possible. If you are unable to upgrade, consider &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;elasticsearch.html#disabling-elasticsearch&quot;&gt;disabling Elasticsearch&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-comments-via-elasticsearch-integration&quot;&gt;Disclosure of comments via Elasticsearch integration&lt;&#x2F;h2&gt;

&lt;p&gt;Comments on restricted public projects could be guessed via the Group Search feature provided by Elasticsearch integration. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19087&quot;&gt;CVE-2019-19087&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.17 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above &lt;strong&gt;with enabled&lt;&#x2F;strong&gt; Elasticsearch integration are upgraded to the latest version as soon as possible. If you are unable to upgrade, consider &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;elasticsearch.html#disabling-elasticsearch&quot;&gt;disabling Elasticsearch&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;dns-rebind-ssrf-in-various-chat-notifications&quot;&gt;DNS Rebind SSRF in various chat notifications&lt;&#x2F;h2&gt;

&lt;p&gt;An internal review identified several situations in which particular chat notifications could be used to perform DNS rebind SSRF attacks. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19261&quot;&gt;CVE-2019-19261&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 6.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-vulnerability-status-in-dependency-list&quot;&gt;Disclosure of vulnerability status in dependency list&lt;&#x2F;h2&gt;

&lt;p&gt;It was internally identified that the vulnerability status of a particular dependency was being displayed to unauthenticated users. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19256&quot;&gt;CVE-2019-19256&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-commit-count-in-cycle-analytics&quot;&gt;Disclosure of commit count in Cycle Analytics&lt;&#x2F;h2&gt;

&lt;p&gt;Project members with the Guest access level were erronneously able to see the number of commits in the Cycle Analytics area. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19254&quot;&gt;CVE-2019-19254&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;exposure-of-related-branch-names&quot;&gt;Exposure of related branch names&lt;&#x2F;h2&gt;

&lt;p&gt;Under certain circumstances, guests and non-members were able to see branch names. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19257&quot;&gt;CVE-2019-19257&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;tags-pushes-from-blocked-users&quot;&gt;Tags pushes from blocked users&lt;&#x2F;h2&gt;

&lt;p&gt;In some situations, a blocked user was still able to push git tags depsite other git access being revoked. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19263&quot;&gt;CVE-2019-19263&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;branches-and-commits-exposed-to-guest-members-via-integration&quot;&gt;Branches and Commits exposed to Guest members via integration&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that using certain integrations a guest user was able to view branch names and commit messages. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19258&quot;&gt;CVE-2019-19258&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-when-adding-users-to-protected-environments&quot;&gt;IDOR when adding users to protected environments&lt;&#x2F;h2&gt;

&lt;p&gt;Non-project members were unintentionally allowed to be added to protected environments. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19259&quot;&gt;CVE-2019-19259&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;former-project-members-able-to-access-repository-information&quot;&gt;Former project members able to access repository information&lt;&#x2F;h2&gt;

&lt;p&gt;Under specific circumstances, a former project member was still able to access repositories from which their access had been removed. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19260&quot;&gt;CVE-2019-19260&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mclaren650sspider&quot;&gt;@mclaren650sspider&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-access-to-grafana-metrics&quot;&gt;Unauthorized access to grafana metrics&lt;&#x2F;h2&gt;

&lt;p&gt;Grafana metrics were unintentionally being exposed to unauthorized users. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19262&quot;&gt;CVE-2019-19262&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;d0xing&quot;&gt;@d0xing&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;todos-created-for-former-project-members&quot;&gt;Todos created for former project members&lt;&#x2F;h2&gt;

&lt;p&gt;Under specific circumstances, a former project member would potentially receive Todos even after being removed from the project. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19255&quot;&gt;CVE-2019-19255&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to Jimmy Soh for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;update-mattermost-dependency&quot;&gt;Update Mattermost dependency&lt;&#x2F;h2&gt;

&lt;p&gt;The Mattermost dependency has been upgraded to 5.14.5 in order to mitigate security concerns.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus 12.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-aws-secret-keys-on-certain-admin-pages&quot;&gt;Disclosure of AWS secret keys on certain Admin pages&lt;&#x2F;h2&gt;

&lt;p&gt;Certain Admin pages potentially disclosed AWS secret keys in plain text. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19310&quot;&gt;CVE-2019-19310&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-in-group-and-user-profile-fields&quot;&gt;Stored XSS in Group and User profile fields&lt;&#x2F;h2&gt;

&lt;p&gt;Multiple group and user profile fields were not being sanitized properly and potentially resulting in a stored cross-site scripting vulnerability. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19311&quot;&gt;CVE-2019-19311&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @constructor2019 for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.14 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;forked-project-information-disclosed-via-project-api&quot;&gt;Forked project information disclosed via Project API&lt;&#x2F;h2&gt;

&lt;p&gt;After a project changed to private, previously forked repositories were still able to get information about the private project through the API. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19312&quot;&gt;CVE-2019-19312&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.14 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-in-the-issue-and-commit-comment-pages&quot;&gt;Denial of Service in the issue and commit comment pages&lt;&#x2F;h2&gt;

&lt;p&gt;Certain characters were making it impossible to create, edit, or view issues and commits. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19313&quot;&gt;CVE-2019-19313&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;dfens&quot;&gt;@dfens&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-18&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-18&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;tokens-stored-in-plaintext&quot;&gt;Tokens stored in plaintext&lt;&#x2F;h2&gt;

&lt;p&gt;Several tokens that were being stored in plaintext are now being encrypted. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-19314&quot;&gt;CVE-2019-19314&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-19&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-19&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;receive-security-release-notifications&quot;&gt;Receive Security Release Notifications&lt;&#x2F;h2&gt;

&lt;p&gt;To receive security release blog notifications delivered to your inbox, visit our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;company&#x2F;contact&#x2F;&quot;&gt;contact us&lt;&#x2F;a&gt; page.
To receive security release blog notifications via RSS, subscribe to our &lt;a href=&quot;https:&#x2F;&#x2F;about.gitlab.com&#x2F;security-releases.xml&quot;&gt;RSS feed&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 12.4.1, 12.3.6, and 12.2.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/</id>
<published>2019-10-30T00:00:00+00:00</published>
<updated>2019-10-30T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.4.1, 12.3.6, and 12.2.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;source-branch-of-a-mr-could-be-removed-by-an-unauthorised-user&quot;&gt;Source branch of a MR could be removed by an unauthorised user&lt;&#x2F;h2&gt;

&lt;p&gt;An unauthorised member of the target project could delete the source branch of MR. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18446&quot;&gt;CVE-2019-18446&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.15 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-group-members-could-be-listed&quot;&gt;Private group members could be listed&lt;&#x2F;h2&gt;

&lt;p&gt;An unauthorised user could view the members of a private group. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18447&quot;&gt;CVE-2019-18447&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-system-notes-via-elasticsearch-integration&quot;&gt;Disclosure of System Notes via Elasticsearch integration&lt;&#x2F;h2&gt;

&lt;p&gt;System Notes would be disclosed with the Comments Search feature provided by Elasticsearch integration. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18460&quot;&gt;CVE-2019-18460&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 8.8.3 and later&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above &lt;strong&gt;with enabled&lt;&#x2F;strong&gt; Elasticsearch integration are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-private-comments-via-elasticsearch-integration&quot;&gt;Disclosure of Private Comments via Elasticsearch integration&lt;&#x2F;h2&gt;

&lt;p&gt;Private comments in restricted groups would be disclosed with the Search feature provided by Elasticsearch integration. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18456&quot;&gt;CVE-2019-18456&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.17 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above &lt;strong&gt;with enabled&lt;&#x2F;strong&gt; Elasticsearch integration are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;confirm-existence-of-private-repositories&quot;&gt;Confirm existence of private repositories&lt;&#x2F;h2&gt;

&lt;p&gt;By using brute-force an unauthorised user could check if a private repository exists. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18448&quot;&gt;CVE-2019-18448&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;brxxn&quot;&gt;@brxxn&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-group-membership-could-be-disclosed&quot;&gt;Private group membership could be disclosed&lt;&#x2F;h2&gt;

&lt;p&gt;Unauthorised users were able to read private groups membership using the autocomplete endpoint. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18449&quot;&gt;CVE-2019-18449&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-project-labels&quot;&gt;Disclosure of Project Labels&lt;&#x2F;h2&gt;

&lt;p&gt;Project labels could be disclosed through the GitLab API to unauthorised users. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18450&quot;&gt;CVE-2019-18450&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-private-project-path-and-labels&quot;&gt;Disclosure of Private Project Path and Labels&lt;&#x2F;h2&gt;

&lt;p&gt;When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18452&quot;&gt;CVE-2019-18452&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;uncontrolled-resource-consumption-due-to-nested-graphql-queries&quot;&gt;Uncontrolled Resource Consumption due to Nested GraphQL Queries&lt;&#x2F;h2&gt;

&lt;p&gt;Nested GraphQL queries could be built so that it resulted a denial of service of the affected page. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18455&quot;&gt;CVE-2019-18455&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;freddd&quot;&gt;@freddd&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-control-on-comments&quot;&gt;Improper access control on comments&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue discovered allowed a demoted user to add comments via email. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18453&quot;&gt;CVE-2019-18453&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;hx01&quot;&gt;@hx01&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sentry-token-access-control&quot;&gt;Sentry Token Access Control&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue discovered in the Sentry tokens handling that allowed access to a demoted user . The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18457&quot;&gt;CVE-2019-18457&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;authorisation-check-for-project-transfer-option&quot;&gt;Authorisation check for Project Transfer option&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization check needed for transfer projects to another group feature allowed users with developer rights to move projects. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18458&quot;&gt;CVE-2019-18458&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-in-wiki-pages-using-rdoc&quot;&gt;XSS in Wiki Pages Using RDoc&lt;&#x2F;h2&gt;

&lt;p&gt;The link validation for RDoc wiki pages contained an issue that could get exploited to a persistent XSS vulnerability. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18454&quot;&gt;CVE-2019-18454&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;untrusted-input-could-be-used-for-internal-redirect&quot;&gt;Untrusted Input could be used for Internal Redirect&lt;&#x2F;h2&gt;

&lt;p&gt;An internal review determined an issue in the InternalRedirect filtering allowing for open redirect attacks. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18451&quot;&gt;CVE-2019-18451&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.7.4 and later&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;access-control-for-protected-environments&quot;&gt;Access control for protected environments&lt;&#x2F;h2&gt;

&lt;p&gt;An internal review determined that groups could maintain access to protected environments even after removal. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18459&quot;&gt;CVE-2019-18459&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.3 to 12.3.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-sub-group-path-disclosure&quot;&gt;Private Sub Group path Disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The private sub group path was disclosed when a sub group epic was added to a public group. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18461&quot;&gt;CVE-2019-18461&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-group-packages-list&quot;&gt;Disclosure of Group Packages List&lt;&#x2F;h2&gt;

&lt;p&gt;An issue was found that allowed an unauthorised user to list the packages of a group. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18463&quot;&gt;CVE-2019-18463&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-repository-name-disclosure&quot;&gt;Private Repository Name Disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;An issue was found that allowed an unauthorised user to confirm the name of a private repository. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-18462&quot;&gt;CVE-2019-18462&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mclaren650sspider&quot;&gt;@mclaren650sspider&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 12.3.5, 12.2.8, and 12.1.14</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/10/07/security-release-gitlab-12-dot-3-dot-5-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/10/07/security-release-gitlab-12-dot-3-dot-5-released/</id>
<published>2019-10-07T00:00:00+00:00</published>
<updated>2019-10-07T00:00:00+00:00</updated>
<author>
<name>Jeremy Matos</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.3.5, 12.2.8, and 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain an important security fix, and we strongly recommend that all &lt;strong&gt;GitLab EE&lt;&#x2F;strong&gt; installations &lt;strong&gt;with enabled&lt;&#x2F;strong&gt; Elasticsearch integration be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-private-merge-requests-and-issues-via-elasticsearch-integration&quot;&gt;Disclosure of Private Merge Requests and Issues via Elasticsearch integration&lt;&#x2F;h2&gt;

&lt;p&gt;Private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15590&quot;&gt;CVE-2019-15590&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.5 and later.
GitLab CE versions are unaffected.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above &lt;strong&gt;with enabled&lt;&#x2F;strong&gt; Elasticsearch integration are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;
&lt;h2 id=&quot;fixed-geo-not-syncing-new-lfs-files&quot;&gt;Fixed Geo not syncing new LFS files&lt;&#x2F;h2&gt;

&lt;p&gt;We &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues&#x2F;32696&quot;&gt;found a regression&lt;&#x2F;a&gt; in the GitLab Geo code that makes it very likely that any new LFS objects are not synchronized to secondary nodes. This means that these LFS files cannot be pulled from secondary nodes and impacts Disaster Recovery.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.1 and later.
GitLab CE versions are unaffected.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above &lt;strong&gt;with enabled&lt;&#x2F;strong&gt; LFS and Geo are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;
&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 12.3.3, 12.2.7, and 12.1.13</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/10/02/security-release-gitlab-12-dot-3-dot-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/10/02/security-release-gitlab-12-dot-3-dot-3-released/</id>
<published>2019-10-02T00:00:00+00:00</published>
<updated>2019-10-02T00:00:00+00:00</updated>
<author>
<name>Jeremy Matos</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.3.3, 12.2.7, and 12.1.13 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain an important security fix, and we strongly recommend that all GitLab installations &lt;strong&gt;with enabled&lt;&#x2F;strong&gt; Elasticsearch integration be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-private-code-merge-requests-and-commits-via-elasticsearch-integration&quot;&gt;Disclosure of Private Code, Merge Requests and Commits via Elasticsearch integration&lt;&#x2F;h2&gt;

&lt;p&gt;Private code, merge requests and commits would be disclosed with the Group Search feature provided by Elasticsearch integration. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5487&quot;&gt;CVE-2019-5487&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.17 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above &lt;strong&gt;with enabled&lt;&#x2F;strong&gt; Elasticsearch integration are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-container-and-dependency-scanning-reports&quot;&gt;Disclosure of container and dependency scanning reports&lt;&#x2F;h2&gt;

&lt;p&gt;Container and dependency scanning reports were available via the merge request widget even though public pipelines were disabled. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15591&quot;&gt;CVE-2019-15591&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 12.3.2, 12.2.6, and 12.1.12</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/</id>
<published>2019-09-30T00:00:00+00:00</published>
<updated>2019-09-30T00:00:00+00:00</updated>
<author>
<name>Jeremy Matos</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;issues?label_name%5B%5D=security&amp;amp;scope=all&amp;amp;state=opened&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-in-markdown-preview-using-mermaid&quot;&gt;XSS in Markdown Preview Using Mermaid&lt;&#x2F;h2&gt;

&lt;p&gt;The Mermaid plugin was updated in GitLab 12.1 to address an XSS issue in markdown preview. The Mermaid plugin was previously updated in 12.2 and 12.3. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15586&quot;&gt;CVE-2019-15586&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;brainpanic&quot;&gt;@brainpanic&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.1.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypass-email-verification-using-salesforce-authentication&quot;&gt;Bypass Email Verification using Salesforce Authentication&lt;&#x2F;h2&gt;

&lt;p&gt;The Salesforce login integration could be used by an attacker to create an account that bypassed domain restrictions and email verification requirements. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5486&quot;&gt;CVE-2019-5486&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.11 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;account-takeover-using-saml&quot;&gt;Account Takeover using SAML&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab SAML integration had a validation issue that permitted an attacker to takeover another user&#x27;s account. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15585&quot;&gt;CVE-2019-15585&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @mishre for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 7.12 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;uncontrolled-resource-consumption-in-markdown-using-mermaid&quot;&gt;Uncontrolled Resource Consumption in Markdown using Mermaid&lt;&#x2F;h2&gt;

&lt;p&gt;Markdown fields contained an input validation issue that resulted in a denial of service of the affected page. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15584&quot;&gt;CVE-2019-15584&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryhmnlfj&quot;&gt;@ryhmnlfj&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-private-project-path-and-labels&quot;&gt;Disclosure of Private Project Path and Labels&lt;&#x2F;h2&gt;

&lt;p&gt;When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15583&quot;&gt;CVE-2019-15583&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-assignees-via-milestones&quot;&gt;Disclosure of Assignees via Milestones&lt;&#x2F;h2&gt;

&lt;p&gt;The assignee(s) of a confidential issue in a private project would be disclosed to a guest via milestones. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15579&quot;&gt;CVE-2019-15579&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.2.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-project-path-via-unsubscribe-link&quot;&gt;Disclosure of Project Path via Unsubscribe Link&lt;&#x2F;h2&gt;

&lt;p&gt;The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15578&quot;&gt;CVE-2019-15578&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.4.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-project-milestones-via-groups&quot;&gt;Disclosure of Project Milestones via Groups&lt;&#x2F;h2&gt;

&lt;p&gt;Project milestones would be disclosed via groups browsing. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15577&quot;&gt;CVE-2019-15577&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @uzsunny](https:&#x2F;&#x2F;hackerone.com&#x2F;uzsunnyz?type=user) for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.0.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-private-system-notes-via-graphql&quot;&gt;Disclosure of Private System Notes via GraphQL&lt;&#x2F;h2&gt;

&lt;p&gt;Private system notes would be disclosed via GraphQL endpoint. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15576&quot;&gt;CVE-2019-15576&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.0.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;git-command-injection-via-api&quot;&gt;GIT Command Injection via API&lt;&#x2F;h2&gt;

&lt;p&gt;GIT command injection was possible via the API through the &lt;code&gt;blobs&lt;&#x2F;code&gt; scope. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15575&quot;&gt;CVE-2019-15575&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Note:&lt;&#x2F;strong&gt; We recommend to &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;&#x2F;administration&#x2F;gitaly&#x2F;#rotating-a-gitaly-authentication-token&quot;&gt;rotate the Gitaly authentication token&lt;&#x2F;a&gt; as an extra security measure.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;bypass-user-blocking-via-cicd-token&quot;&gt;Bypass User Blocking via CI&#x2F;CD token&lt;&#x2F;h2&gt;

&lt;p&gt;A blocked user would be able to use GIT clone and pull if he had obtained a CI&#x2F;CD token before. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15589&quot;&gt;CVE-2019-15589&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;logan5&quot;&gt;@logan5&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-adding-groups-to-protected-environments&quot;&gt;IDOR Adding Groups to Protected Environments&lt;&#x2F;h2&gt;

&lt;p&gt;An IDOR was discovered that allowed a maintainer to add any private group to a protected environment. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15582&quot;&gt;CVE-2019-15582&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-group-membership-via-merge-request-approval-rules&quot;&gt;Disclosure of Group Membership via Merge Request Approval Rules&lt;&#x2F;h2&gt;

&lt;p&gt;An IDOR was discovered that allowed a project owner or maintainer to see the members of any private group via merge request approval rules. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15581&quot;&gt;CVE-2019-15581&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.13 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-head-pipeline-via-blocking-merge-request-feature&quot;&gt;Disclosure of Head Pipeline via Blocking Merge Request Feature&lt;&#x2F;h2&gt;

&lt;p&gt;When using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15580&quot;&gt;CVE-2019-15580&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;grafana-update&quot;&gt;Grafana update&lt;&#x2F;h2&gt;

&lt;p&gt;We have patched Grafana, which is included in the GitLab Omnibus package for CVE-2018-19039.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 12.2.5, 12.1.9, and 12.0.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/</id>
<published>2019-09-10T00:00:00+00:00</published>
<updated>2019-09-10T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.2.5, 12.1.9, and 12.0.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-template-functionality-could-be-used-to-access-restricted-project-data&quot;&gt;Project Template Functionality Could Be Used to Access Restricted Project Data&lt;&#x2F;h2&gt;

&lt;p&gt;Project creation using custom group templates had a permission issue that
allowed an unauthorized user to clone a project to which they had partial
visibility, allowing them to see the restricted information. The issue is
now mitigated in the latest release and is assigned
&lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-16170&quot;&gt;CVE-2019-16170&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; for responsibly reporting this
vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version
above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;security-enhancements-in-gitlab-pages&quot;&gt;Security Enhancements in GitLab Pages&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab Pages is updated in this release with several security enhancements
to GitLab Pages Access Control. Improvements include use of the &lt;code&gt;Secure&lt;&#x2F;code&gt;
flag on the session cookie, and shortening of the valid session time.&lt;&#x2F;p&gt;

&lt;p&gt;These improvements were identified as part of an internal security review.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;nginx-update&quot;&gt;Nginx Update&lt;&#x2F;h2&gt;

&lt;p&gt;We have patched Nginx, which is included in the GitLab Omnibus package for CVE-2019-9511, CVE-2019-9513, and CVE-2019-9516.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;mattermost-updates&quot;&gt;Mattermost Updates&lt;&#x2F;h2&gt;

&lt;p&gt;We&#x27;ve included respective Mattermost security versions in 12.2, 12.1 and 12.0.&lt;&#x2F;p&gt;

&lt;p&gt;For more information, see &lt;a href=&quot;https:&#x2F;&#x2F;about.mattermost.com&#x2F;security-updates&#x2F;&quot;&gt;Mattermost security updates page&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 12.2.3, 12.1.8, and 12.0.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/</id>
<published>2019-08-29T00:00:00+00:00</published>
<updated>2019-08-29T00:00:00+00:00</updated>
<author>
<name>Andrew Kelly</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.2.3, 12.1.8, and 12.0.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues?scope=all&amp;amp;utf8=%E2%9C%93&amp;amp;state=opened&amp;amp;label_name[]=security&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;kubernetes-integration-server-side-request-forgery&quot;&gt;Kubernetes Integration Server-Side Request Forgery&lt;&#x2F;h2&gt;

&lt;p&gt;An internal review determined that the protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15728&quot;&gt;CVE-2019-15728&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;server-side-request-forgery-in-jira-integration&quot;&gt;Server-Side Request Forgery in Jira Integration&lt;&#x2F;h2&gt;

&lt;p&gt;An internal review determined that the Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which would allow sending requests to any resources accessible in the local network by the GitLab server. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15730&quot;&gt;CVE-2019-15730&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.14 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improved-protection-against-credential-stuffing-attacks&quot;&gt;Improved Protection Against Credential Stuffing Attacks&lt;&#x2F;h2&gt;

&lt;p&gt;A reCaptcha challenge will be required after certain failed login attempt conditions are met. This feature is disabled by default and can be enabled through Admin Area &amp;gt; Settings &amp;gt; Reporting &amp;gt; Enable reCAPTCHA for login.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;markdown-clientside-resource-exhaustion&quot;&gt;Markdown Clientside Resource Exhaustion&lt;&#x2F;h2&gt;

&lt;p&gt;Particular mathematic expressions in GitLab Markdown can exhaust client resources. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15722&quot;&gt;CVE-2019-15722&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Please note that Merge Requests, Issues, Wiki Pages, and other areas with GitLab Markdown containing lots of math formulae or long formulae may need to be split up.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;abdilahrf_&quot;&gt;@abdilahrf_&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.15 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;pipeline-status-disclosure&quot;&gt;Pipeline Status Disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;An internal endpoint unintentionally disclosed information about the last pipeline ran for a merge request. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15729&quot;&gt;CVE-2019-15729&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-runner-authorization-issue&quot;&gt;Group Runner Authorization Issue&lt;&#x2F;h2&gt;

&lt;p&gt;An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15721&quot;&gt;CVE-2019-15721&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ci-metrics-disclosure&quot;&gt;CI Metrics Disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15727&quot;&gt;CVE-2019-15727&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-ip-disclosed-by-embedded-image-and-media&quot;&gt;User IP Disclosed by Embedded Image and Media&lt;&#x2F;h2&gt;

&lt;p&gt;Embedded images and media files in markdown could be pointed to an arbitrary server, which would reveal the IP address of clients requesting the file from that server. This issue can be mitigated by enabling an &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;security&#x2F;asset_proxy.html&quot;&gt;asset proxy&lt;&#x2F;a&gt; and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15726&quot;&gt;CVE-2019-15726&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;iframe&quot;&gt;@iframe&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;label-description-html-injection&quot;&gt;Label Description HTML Injection&lt;&#x2F;h2&gt;

&lt;p&gt;Label descriptions were found to be vulnerable to HTML injection. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15724&quot;&gt;CVE-2019-15724&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-in-epic-notes-api&quot;&gt;IDOR in Epic Notes API&lt;&#x2F;h2&gt;

&lt;p&gt;An IDOR was discovered in the epic notes API which could result in disclosure of private milestones, labels, and other information. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15725&quot;&gt;CVE-2019-15725&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;push-rule-bypass&quot;&gt;Push Rule Bypass&lt;&#x2F;h2&gt;

&lt;p&gt;A vulnerability that allowed users to bypass the push rules of a project had been indirectly fixed in a previous GitLab release. This version improves the fix to make it more robust. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15723&quot;&gt;CVE-2019-15723&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE versions 11.9.4-11.10.0. Please note that this was already fixed in 11.10.1.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-visibility-restriction-bypass&quot;&gt;Project Visibility Restriction Bypass&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that the project import API could be used to bypass project visibility restrictions. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15732&quot;&gt;CVE-2019-15732&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;logan5&quot;&gt;@logan5&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;merge-request-discussion-restriction-bypass&quot;&gt;Merge Request Discussion Restriction Bypass&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that non-members were able to comment on merge requests despite the repository being set to allow only project members to do so. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15731&quot;&gt;CVE-2019-15731&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-merge-request-ids&quot;&gt;Disclosure of Merge Request IDs&lt;&#x2F;h2&gt;

&lt;p&gt;An internal review determined that under certain conditions, merge request IDs were being disclosed via email. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15738&quot;&gt;CVE-2019-15738&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;weak-authentication-in-certain-account-actions&quot;&gt;Weak Authentication In Certain Account Actions&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that certain account actions needed improved authentication and session management. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15737&quot;&gt;CVE-2019-15737&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to Sajibe Kanti for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-commit-title-and-comments&quot;&gt;Disclosure of Commit Title and Comments&lt;&#x2F;h2&gt;

&lt;p&gt;Under very specific conditions, commit titles and team member comments could become viewable to users that did not have permission to do so. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15734&quot;&gt;CVE-2019-15734&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;brijeshshah13&quot;&gt;@brijeshshah13&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-xss-via-markdown&quot;&gt;Stored XSS via Markdown&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that certain areas displaying Markdown were not properly sanitizing some cross site scripting payloads. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15739&quot;&gt;CVE-2019-15739&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;samuelmortenson&quot;&gt;@samuelmortenson&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;exif-geolocation-data-exposure&quot;&gt;EXIF Geolocation Data Exposure&lt;&#x2F;h2&gt;

&lt;p&gt;EXIF Geolocation data was not being removed from certain image uploads. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15740&quot;&gt;CVE-2019-15740&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Please note that when upgrading a GitLab instance, the following rake task should be run: &lt;code&gt;rake gitlab:uploads:sanitize:remove_exif[,,false,0,PersonalFileUploader,2019-01-01]&lt;&#x2F;code&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jackb898?type=user&quot;&gt;@jack898&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 7.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;multiple-ssrf-regressions-on-gitaly&quot;&gt;Multiple SSRF Regressions on Gitaly&lt;&#x2F;h2&gt;

&lt;p&gt;Two previous Gitaly SSRF fixes were mistakenly not included in GitLab 12.2. The issue is now mitigated in the latest release and will be assigned a CVE ID shortly.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-18&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.2.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-18&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;default-branch-name-exposure&quot;&gt;Default Branch Name Exposure&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that the specified default branch name could be exposed to unauthorised users. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15733&quot;&gt;CVE-2019-15733&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-19&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 7.12 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-19&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;potential-denial-of-service-via-ci-pipelines&quot;&gt;Potential Denial of Service via CI Pipelines&lt;&#x2F;h2&gt;

&lt;p&gt;Under certain circumstances, CI pipelines could potentially be used in a denial of service attack. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15736&quot;&gt;CVE-2019-15736&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-20&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-20&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;privilege-escalation-via-logrotate&quot;&gt;Privilege Escalation via Logrotate&lt;&#x2F;h2&gt;

&lt;p&gt;It was discovered that an unsafe interaction with logrotate could result in a privilege escalation. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15741&quot;&gt;CVE-2019-15741&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;petee&quot;&gt;@petee&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-21&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab Omnibus 7.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-21&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-merge-request-id-via-timeline-activities&quot;&gt;Disclosure of Merge Request ID via Timeline Activities&lt;&#x2F;h2&gt;

&lt;p&gt;A Guest user in a private project could see the merge request ID associated to an issue via the activity timeline. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15592&quot;&gt;CVE-2019-15592&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-22&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-22&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-via-issue-comments&quot;&gt;Denial of Service via Issue Comments&lt;&#x2F;h2&gt;

&lt;p&gt;A Denial of Service was possible when posting in an issue a comment of arbitrary length. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15593&quot;&gt;CVE-2019-15593&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;8ayac&quot;&gt;8ayac&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-23&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 9.3.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-23&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 12.1.6, 12.0.6, and 11.11.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/</id>
<published>2019-08-12T00:00:00+00:00</published>
<updated>2019-08-12T00:00:00+00:00</updated>
<author>
<name>Juan Broullon</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.1.6, 12.0.6, and 11.11.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insecure-authentication-methods-disabled-for-grafana-by-default&quot;&gt;Insecure Authentication Methods Disabled for Grafana By Default&lt;&#x2F;h2&gt;

&lt;p&gt;Basic authentication and hard-coded admin credentials are now disabled by default in the bundled Grafana instance as part of the Omnibus-based GitLab packages. 
This change forces GitLab SSO to be the only authentication method, creates a backup of existing data, and resets the Grafana configuration to the GitLab default. 
Custom dashboards and user accounts that have been created will be preserved in the backup. Grafana authentication settings can then be modified following the 
&lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;omnibus&#x2F;settings&#x2F;grafana.html&quot;&gt;Omnibus Configuration Settings&lt;&#x2F;a&gt; guide.&lt;&#x2F;p&gt;

&lt;p&gt;The Grafana dashboard, when accessed using the hard-coded credentials, allowed for a malicious user to view internal resources that are accessible 
by the host where the GitLab instance resides.&lt;&#x2F;p&gt;

&lt;p&gt;The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-14943&quot;&gt;CVE-2019-14943&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;stargo&quot;&gt;@stargo&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;multiple-command-line-flag-injection-vulnerabilities&quot;&gt;Multiple Command-Line Flag Injection Vulnerabilities&lt;&#x2F;h2&gt;

&lt;p&gt;Improper parameter sanitization on Gitaly could lead to privilege escalation and remote code execution vulnerabilities under certain conditions. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-14944&quot;&gt;CVE-2019-14944&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;vakzz&quot;&gt;@vakzz&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating-1&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insecure-cookie-handling-on-gitlab-pages&quot;&gt;Insecure Cookie Handling on GitLab Pages&lt;&#x2F;h2&gt;

&lt;p&gt;Authentication cookies on GitLab Pages with Access Control could be sent over HTTP and weren&#x27;t properly encrypted, which made them vulnerable to Man-In-The-Middle attacks. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-14942&quot;&gt;CVE-2019-14942&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;This issue was internally discovered by the GitLab Security Team.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating-2&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 12.1.2, 12.0.4, and 11.11.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/</id>
<published>2019-07-29T00:00:00+00:00</published>
<updated>2019-07-29T00:00:00+00:00</updated>
<author>
<name>Jeremy Matos</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.1.2, 12.0.4, and 11.11.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues?scope=all&amp;amp;utf8=%E2%9C%93&amp;amp;state=opened&amp;amp;label_name[]=security&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;github-integration-ssrf&quot;&gt;GitHub Integration SSRF&lt;&#x2F;h2&gt;

&lt;p&gt;An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance&#x27;s internal network. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5461&quot;&gt;CVE-2019-5461&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;trigger-token-impersonation&quot;&gt;Trigger Token Impersonation&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue was discovered when trigger tokens are not rotated once ownership of them has changed. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5462&quot;&gt;CVE-2019-5462&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;build-status-disclosure&quot;&gt;Build Status Disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue was discovered in the CI badge images endpoint which could result in disclosure of the build status. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5463&quot;&gt;CVE-2019-5463&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab CE&#x2F;EE versions.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-mitigation-bypass&quot;&gt;SSRF Mitigation Bypass&lt;&#x2F;h2&gt;

&lt;p&gt;A flawed DNS rebinding protection issue was discovered in &lt;code&gt;url_blocker.rb&lt;&#x2F;code&gt; which could result in SSRF where the library is utilized. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5464&quot;&gt;CVE-2019-5464&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mclaren650sspider&quot;&gt;@mclaren650sspider&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-new-issue-id&quot;&gt;Information Disclosure New Issue ID&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue was discovered in the move issue feature which could result in disclosure of the newly created issue ID. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5465&quot;&gt;CVE-2019-5465&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.14 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-label-name-enumeration&quot;&gt;IDOR Label Name Enumeration&lt;&#x2F;h2&gt;

&lt;p&gt;An IDOR was discovered in the new merge requests endpoint which could result in disclosure of label names. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5466&quot;&gt;CVE-2019-5466&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-wiki-pages&quot;&gt;Persistent XSS Wiki Pages&lt;&#x2F;h2&gt;

&lt;p&gt;An input validation and output encoding issue was discovered in the wiki pages feature which could result in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5467&quot;&gt;CVE-2019-5467&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryhmnlfj&quot;&gt;@ryhmnlfj&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-revokation-bypass-with-mattermost-integration&quot;&gt;User Revokation Bypass with Mattermost Integration&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue was discovered when Mattermost slash commands are used with a blocked account. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5468&quot;&gt;CVE-2019-5468&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;logan5&quot;&gt;@logan5&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.14 command service and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-file-upload-via-import-project-archive&quot;&gt;Arbitrary File Upload via Import Project Archive&lt;&#x2F;h2&gt;

&lt;p&gt;A file upload issue was discovered when importing a project archive. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5469&quot;&gt;CVE-2019-5469&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ajxchapman&quot;&gt;@ajxchapman&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-vulnerability-feedback&quot;&gt;Information Disclosure Vulnerability Feedback&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue was discovered in the security dashboard which could result in disclosure of vulnerability feedback information. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5470&quot;&gt;CVE-2019-5470&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-via-email&quot;&gt;Persistent XSS via Email&lt;&#x2F;h2&gt;

&lt;p&gt;An input validation and output encoding issue was discovered in the email notification feature which could result in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5471&quot;&gt;CVE-2019-5471&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mario-areias&quot;&gt;@mario-areias&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-epic-comments&quot;&gt;Denial Of Service Epic Comments&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue was discovered that forbid to delete epic comments. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5472&quot;&gt;CVE-2019-5472&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous GitLab EE 10.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;email-verification-bypass&quot;&gt;Email Verification Bypass&lt;&#x2F;h2&gt;

&lt;p&gt;An authentication issue was discovered that allowed to bypass email verification. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5473&quot;&gt;CVE-2019-5473&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 12.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;override-merge-request-approval-rules&quot;&gt;Override Merge Request Approval Rules&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue was discovered in the merge request approval rules. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5474&quot;&gt;CVE-2019-5474&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-pipeline-details&quot;&gt;Disclosure of Pipeline Details&lt;&#x2F;h2&gt;

&lt;p&gt;Details of restricted pipelines were visible via the merge request endpoint. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-15594&quot;&gt;CVE-2019-15594&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 12.0.3, 11.11.5, and 11.10.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/</id>
<published>2019-07-03T00:00:00+00:00</published>
<updated>2019-07-03T00:00:00+00:00</updated>
<author>
<name>Costel Maxim</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 12.0.3, 11.11.5, and 11.10.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues?scope=all&amp;amp;utf8=%E2%9C%93&amp;amp;state=opened&amp;amp;label_name[]=security&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ability-to-write-a-note-to-a-private-snippet&quot;&gt;Ability to Write a Note to a Private Snippet&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab Snippets were vulnerable to an authorization issue that allowed unauthorized users to add comments to a private snippet. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-13001&quot;&gt;CVE-2019-13001&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;executor&quot;&gt;@executor&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;recent-pipeline-information-disclosed-to-unauthorised-users&quot;&gt;Recent Pipeline Information Disclosed to Unauthorised Users&lt;&#x2F;h2&gt;

&lt;p&gt;Unauthorised users were able to read pipeline information of the last merge request. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-13002&quot;&gt;CVE-2019-13002&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;resource-exhaustion-attack&quot;&gt;Resource Exhaustion Attack&lt;&#x2F;h2&gt;

&lt;p&gt;One of the parsers used by Gitlab CI was vulnerable to a resource exhaustion attack. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-13003&quot;&gt;CVE-2019-13003&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;leipert&quot;&gt;@leipert&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;error-caused-by-encoded-characters-in-comments&quot;&gt;Error Caused by Encoded Characters in Comments&lt;&#x2F;h2&gt;

&lt;p&gt;When specific encoded characters were added to comments, the comments section would become inaccessible. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-13004&quot;&gt;CVE-2019-13004&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;newbiemole&quot;&gt;@newbiemole&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;authorization-issues-in-graphql&quot;&gt;Authorization Issues in GraphQL&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab graphql service was vulnerable to multiple authorization issues that disclosed restricted user, group, and repository metadata to unauthorized users. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-13005&quot;&gt;CVE-2019-13005&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;number-of-merge-requests-was-accessible&quot;&gt;Number of Merge Requests was Accessible&lt;&#x2F;h2&gt;

&lt;p&gt;Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-13006&quot;&gt;CVE-2019-13006&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;enabling-one-of-the-service-templates-could-cause-resource-depletion&quot;&gt;Enabling One of the Service Templates Could Cause Resource Depletion&lt;&#x2F;h2&gt;

&lt;p&gt;When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-13008&quot;&gt;CVE-2019-13007&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.11 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;broken-access-control-for-the-content-of-personal-snippets&quot;&gt;Broken Access Control for the Content of Personal Snippets&lt;&#x2F;h2&gt;

&lt;p&gt;Uploaded files associated with unsaved personal snippets were accessible to unauthorized users due to improper permission settings. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-13009&quot;&gt;CVE-2019-13009&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;mkozono&quot;&gt;@mkozono&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible&lt;&#x2F;p&gt;

&lt;h2 id=&quot;decoding-color-codes-caused-resource-depletion&quot;&gt;Decoding Color Codes Caused Resource Depletion&lt;&#x2F;h2&gt;

&lt;p&gt;The color codes decoder was vulnerable to a resource depletion attack if specific formats were used. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-13010&quot;&gt;CVE-2019-13010&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;8ayac&quot;&gt;@8ayac&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible&lt;&#x2F;p&gt;

&lt;h2 id=&quot;merge-request-template-name-disclosure&quot;&gt;Merge Request Template Name Disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;By using brute-force a user with access to a project, but not it&#x27;s repository could create a list of merge requests template names. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-13011&quot;&gt;CVE-2019-13011&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.11.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-vulnerability-in-project-github-integration&quot;&gt;SSRF Vulnerability in Project GitHub Integration&lt;&#x2F;h2&gt;

&lt;p&gt;The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-13121&quot;&gt;CVE-CVE-2019-13121&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.11.1, 11.10.5, and 11.9.12</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/</id>
<published>2019-06-03T00:00:00+00:00</published>
<updated>2019-06-03T00:00:00+00:00</updated>
<author>
<name>Juan Broullon</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.11.1, 11.10.5, and 11.9.12 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues?scope=all&amp;amp;utf8=%E2%9C%93&amp;amp;state=opened&amp;amp;label_name[]=security&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;remote-command-execution-vulnerability-on-repository-download-feature&quot;&gt;Remote Command Execution Vulnerability on Repository Download Feature&lt;&#x2F;h2&gt;

&lt;p&gt;A specially crafted payload would allow an authenticated malicious user to execute commands remotely through the repository download feature. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12430&quot;&gt;CVE-2019-12430&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.11.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;confidential-issue-titles-revealed-to-restricted-users-on-unsubscribe&quot;&gt;Confidential Issue Titles Revealed to Restricted Users on Unsubscribe&lt;&#x2F;h2&gt;

&lt;p&gt;Non-member users who subscribed to issue notifications could access the title of confidential issues through the unsubscription page. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12432&quot;&gt;CVE-2019-12432&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;skavans&quot;&gt;@skavans&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.13 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-milestone-metadata-through-the-search-api&quot;&gt;Disclosure of Milestone Metadata through the Search API&lt;&#x2F;h2&gt;

&lt;p&gt;Restricted users could access the metadata of private milestones through the Search API. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12431&quot;&gt;CVE-2019-12431&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.13 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-project-discovery-via-comment-links&quot;&gt;Private Project Discovery via Comment Links&lt;&#x2F;h2&gt;

&lt;p&gt;Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12434&quot;&gt;CVE-2019-12434&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;metadata-of-confidential-issues-disclosed-to-restricted-users&quot;&gt;Metadata of Confidential Issues Disclosed to Restricted Users&lt;&#x2F;h2&gt;

&lt;p&gt;Unprivileged users were able to access labels, status and merge request counts of confidential issues via the milestone details page. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12429&quot;&gt;CVE-2019-12429&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;mandatory-external-authentication-provider-sign-in-restrictions-bypass&quot;&gt;Mandatory External Authentication Provider Sign-In Restrictions Bypass&lt;&#x2F;h2&gt;

&lt;p&gt;Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12428&quot;&gt;CVE-2019-12428&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 6.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;internal-projects-allowed-to-be-created-on-in-private-groups&quot;&gt;Internal Projects Allowed to Be Created on in Private Groups&lt;&#x2F;h2&gt;

&lt;p&gt;Restricted visibility settings allow creating internal projects in private groups, leading to multiple permission issues. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12433&quot;&gt;CVE-2019-12433&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;petermarko&quot;&gt;Peter Marko&lt;&#x2F;a&gt; for contributing with a fix for this issue.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;server-side-request-forgery-through-dns-rebinding&quot;&gt;Server-Side Request Forgery Through DNS Rebinding&lt;&#x2F;h2&gt;

&lt;p&gt;Multiple features contained Server-Side Request Forgery (SSRF) vulnerabilities caused by an insufficient validation to prevent DNS rebinding attacks. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12443&quot;&gt;CVE-2019-12443&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Note:&lt;&#x2F;strong&gt; The protection against DNS rebinding attacks can be disabled by unmarking the &quot;Enforce DNS rebinding attack protection&quot; checkbox under &lt;em&gt;Admin Area &amp;gt; Settings &amp;gt; Network &amp;gt; Outbound requests&lt;&#x2F;em&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-cross-site-scripting-on-wiki-pages&quot;&gt;Stored Cross-Site Scripting on Wiki Pages&lt;&#x2F;h2&gt;

&lt;p&gt;Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12444&quot;&gt;CVE-2019-12444&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ryhmnlfj&quot;&gt;@ryhmnlfj&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-cross-site-scripting-on-notes&quot;&gt;Stored Cross-Site Scripting on Notes&lt;&#x2F;h2&gt;

&lt;p&gt;A malicious user could execute JavaScript code on notes by importing a specially crafted project file. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12445&quot;&gt;CVE-2019-12445&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;repository-password-disclosed-on-import-error-page&quot;&gt;Repository Password Disclosed on Import Error Page&lt;&#x2F;h2&gt;

&lt;p&gt;A failure while importing a repository by URL would render an error page containing the plaintext password of the repository to import. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12446&quot;&gt;CVE-2019-12446&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;vandebrj&quot;&gt;@vandebrj&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;protected-branches-restriction-rules-bypass&quot;&gt;Protected Branches Restriction Rules Bypass&lt;&#x2F;h2&gt;

&lt;p&gt;The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12441&quot;&gt;CVE-2019-12441&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;stored-cross-site-scripting-vulnerability-on-child-epics&quot;&gt;Stored Cross-Site Scripting Vulnerability on Child Epics&lt;&#x2F;h2&gt;

&lt;p&gt;The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-12442&quot;&gt;CVE-2019-12442&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @near_ for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-to-knative-05&quot;&gt;Upgrade to Knative 0.5&lt;&#x2F;h2&gt;

&lt;p&gt;Knative was upgraded to version 0.5 for the GitLab 11.11, 11.10 and 11.9 packages. This Knative release contains several security fixes.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.10.3, 11.9.11, and 11.8.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released/</id>
<published>2019-04-30T00:00:00+00:00</published>
<updated>2019-04-30T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.10.3, 11.9.11, and 11.8.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;The GitLab EE versions contain an important security fix, and we strongly recommend that all GitLab EE installations be upgraded immediately. GitLab CE is not affected, but the
version numbers were increased to be consistent with EE versioning.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-with-limited-scope-token&quot;&gt;Information Disclosure with Limited Scope Token&lt;&#x2F;h2&gt;

&lt;p&gt;A small number of GitLab API endpoints would disclose project information when using a &lt;em&gt;read_user&lt;&#x2F;em&gt; scoped token. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-11605&quot;&gt;CVE-2019-11605&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.10.2, 11.9.10, and 11.8.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/</id>
<published>2019-04-29T00:00:00+00:00</published>
<updated>2019-04-29T00:00:00+00:00</updated>
<author>
<name>Juan Broullon</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.10.2, 11.9.10, and 11.8.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues?scope=all&amp;amp;utf8=%E2%9C%93&amp;amp;state=opened&amp;amp;label_name[]=security&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;moving-an-issue-to-private-repo-leaks-project-namespace&quot;&gt;Moving an Issue to Private Repo Leaks Project Namespace&lt;&#x2F;h2&gt;

&lt;p&gt;When an issue was moved to a private project, the private project namespace was leaked to unauthorized users with access to the original issue. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-11545&quot;&gt;CVE-2019-11545&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;notification-emails-sent-to-restricted-users&quot;&gt;Notification Emails Sent to Restricted Users&lt;&#x2F;h2&gt;

&lt;p&gt;Non-member users who subscribed to notifications of an internal project with issue and repository restrictions would receive emails about restricted events. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-11544&quot;&gt;CVE-2019-11544&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yashrs&quot;&gt;@yashrs&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-comments-on-confidential-issues&quot;&gt;Unauthorized Comments on Confidential Issues&lt;&#x2F;h2&gt;

&lt;p&gt;Unprivileged members of a project were able to post comments on confidential issues through an authorization issue in the note endpoint. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-11548&quot;&gt;CVE-2019-11548&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @mishre for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 5.4.0 through 11.8.8.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;merge-request-approval-count-inflation&quot;&gt;Merge Request Approval Count Inflation&lt;&#x2F;h2&gt;

&lt;p&gt;A Race Condition vulnerability was discovered which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-11546&quot;&gt;CVE-2019-11546&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;flashdisk&quot;&gt;@flashdisk&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unsanitized-branch-names-on-new-merge-request-notification-emails&quot;&gt;Unsanitized Branch Names on New Merge Request Notification Emails&lt;&#x2F;h2&gt;

&lt;p&gt;The branch name on new merge request notification emails wasn&#x27;t being escaped, which could potentially lead to XSS issues. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-11547&quot;&gt;CVE-2019-11547&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;mario-areias&quot;&gt;@mario-areias&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 6.0.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-sanitation-of-credentials-in-gitaly&quot;&gt;Improper Sanitation of Credentials in Gitaly&lt;&#x2F;h2&gt;

&lt;p&gt;Gitaly has been upgraded to fix an information disclosure issue where HTTP&#x2F;GIT credentials were included in logs on connection errors. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-11549&quot;&gt;CVE-2019-11549&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @j-jam for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-to-rails-5072&quot;&gt;Upgrade to Rails 5.0.7.2&lt;&#x2F;h2&gt;

&lt;p&gt;Ruby on Rails was upgraded to version 5.0.7.2 for the Gitlab 11.10.2 package. This Ruby on Rails release contains several security fixes.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 11.9.7, 11.8.7, and 11.7.11</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/</id>
<published>2019-04-10T00:00:00+00:00</published>
<updated>2019-04-10T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.9.7, 11.8.7, and 11.7.11 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;The GitLab EE versions contain an important security fix, and we strongly recommend that all GitLab EE installations be upgraded immediately. GitLab CE is not affected, but the
version numbers were increased to be consistent with EE versioning.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;group-runner-registration-token-exposure&quot;&gt;Group Runner Registration Token Exposure&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab groups API was vulnerable to an information disclosure issue that disclosed group runner registration tokens to unauthorized users. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-11000&quot;&gt;CVE-2019-11000&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;storm_spirit&quot;&gt;@storm_spirit&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.9.4, 11.8.6, and 11.7.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/</id>
<published>2019-04-01T00:00:00+00:00</published>
<updated>2019-04-01T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.9.4, 11.8.6, and 11.7.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues?scope=all&amp;amp;utf8=%E2%9C%93&amp;amp;state=opened&amp;amp;label_name[]=security&quot;&gt;issue tracker&lt;&#x2F;a&gt; in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;dos-potential-for-regex-in-cicd-refs&quot;&gt;DoS potential for regex in CI&#x2F;CD &lt;code&gt;refs&lt;&#x2F;code&gt;&lt;&#x2F;h2&gt;

&lt;p&gt;An regex input validation issue for the &lt;code&gt;.gitlab-ci.yml&lt;&#x2F;code&gt; &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;ci&#x2F;yaml&#x2F;index.html#onlyrefs--exceptrefs&quot;&gt;&lt;code&gt;refs&lt;&#x2F;code&gt; value&lt;&#x2F;a&gt; was discovered which could allow an attacker to execute a denial of service on the platform. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-10640&quot;&gt;CVE-2019-10640&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;notes&quot;&gt;Notes&lt;&#x2F;h3&gt;

&lt;p&gt;Due to this fix, certain regular expression patterns in &lt;code&gt;refs&lt;&#x2F;code&gt; values may no longer be supported and will require modification.&lt;&#x2F;p&gt;

&lt;p&gt;This fix will go live for GitLab.com users on April 8, 2019.&lt;&#x2F;p&gt;

&lt;p&gt;Related issues:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues&#x2F;59703&lt;&#x2F;li&gt;
  &lt;li&gt;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;customer-success&#x2F;professional-services&#x2F;issues&#x2F;421&lt;&#x2F;li&gt;
  &lt;li&gt;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues&#x2F;49665 (confidential for first 30 days past publication)&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;explanation&quot;&gt;Explanation&lt;&#x2F;h3&gt;

&lt;p&gt;Previously, GitLab used &lt;a href=&quot;https:&#x2F;&#x2F;ruby-doc.org&#x2F;core-2.4.2&#x2F;Regexp.html&quot;&gt;Ruby&#x27;s Regexp&lt;&#x2F;a&gt; for pattern matching. This change switches the regular expression engine to &lt;a href=&quot;https:&#x2F;&#x2F;github.com&#x2F;google&#x2F;re2&#x2F;&quot;&gt;RE2&lt;&#x2F;a&gt; while maintaining the previous syntax. GitLab internally converts &lt;code&gt;&#x2F;pattern&#x2F;flags&lt;&#x2F;code&gt; into valid RE2 patterns.&lt;&#x2F;p&gt;

&lt;p&gt;However, this is considered a breaking change because RE2 does not support some patterns, such as negative lookahead, due to computational complexity. For the list of supported syntaxes, see https:&#x2F;&#x2F;github.com&#x2F;google&#x2F;re2&#x2F;wiki&#x2F;Syntax.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;example-1&quot;&gt;Example 1&lt;&#x2F;h4&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight plaintext&quot;&gt;&lt;code&gt;  only:
    - tags
  except:
    - &#x2F;^(?!master).+@&#x2F;
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;p&gt;The intent of this matcher is to possibly create a job only on tags that are created for &lt;code&gt;master&lt;&#x2F;code&gt;. However, this did not work as intended, as Git does not have a concept of creating a reference on top of another reference. Tag, branch, and any reference are always created on top of a revision.&lt;&#x2F;p&gt;

&lt;p&gt;The valid equivalent syntax here is:&lt;&#x2F;p&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight plaintext&quot;&gt;&lt;code&gt;only:
  - tags
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;h4 id=&quot;example-2&quot;&gt;Example 2&lt;&#x2F;h4&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight plaintext&quot;&gt;&lt;code&gt;  only:
    - &#x2F;&#x2F;@gitlab-org&#x2F;gitlab-ce
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;p&gt;The intent of this matcher is to create a job only for an upstream repository. It fails, as RE2 requires a pattern to be matching. In the above example the behavior is undefined.&lt;&#x2F;p&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight plaintext&quot;&gt;&lt;code&gt;  only:
    - &#x2F;.&#x2F;@gitlab-org&#x2F;gitlab-ce
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;p&gt;This syntax will successfully match any refname.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;related-branches-visible-in-issues-for-guests&quot;&gt;Related branches visible in issues for guests&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue was discovered which allowed Guests of a project to see Related Branches created for an issue. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-10116&quot;&gt;CVE-2019-10116&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-at-merge-request-resolve-conflicts&quot;&gt;Persistent XSS at merge request resolve conflicts&lt;&#x2F;h2&gt;

&lt;p&gt;An input validation and output encoding issue was discovered in the merge request &quot;resolve conflicts&quot; page which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-10111&quot;&gt;CVE-2019-10111&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;valis_&quot;&gt;@valis_&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.0 to 11.8.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-authorization-control-move-issue&quot;&gt;Improper authorization control &quot;move issue&quot;&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue was discovered in the &quot;move issue&quot; feature which could allow an attackers to create projects under any namespace on any GitLab instance on which they already hold credentials. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-10110&quot;&gt;CVE-2019-10110&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @mishre for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;guest-users-of-private-projects-have-access-to-releases&quot;&gt;Guest users of private projects have access to releases&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue was discovered for the GitLab Releases feature which could allow guest users access to private information like release details. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-10115&quot;&gt;CVE-2019-10115&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;dos-potential-on-project-languages-page&quot;&gt;DoS potential on project languages page&lt;&#x2F;h2&gt;

&lt;p&gt;A potential denial of service attack vector was discovered on the project languages endpoint. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-10113&quot;&gt;CVE-2019-10113&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;github.com&#x2F;opalmer&quot;&gt;@opalmer&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;recurity-assessment-information-exposure-through-timing-discrepancy&quot;&gt;Recurity assessment: information exposure through timing discrepancy&lt;&#x2F;h2&gt;

&lt;p&gt;During the OAuth authentication process, the application attempts to validate a parameter in an insecure way, potentially exposing data. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-10114&quot;&gt;CVE-2019-10114&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;www.recurity-labs.com&#x2F;&quot;&gt;Recurity&lt;&#x2F;a&gt; for reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;recurity-assessment-loginstate-hmac-issues&quot;&gt;Recurity assessment: loginState HMAC issues&lt;&#x2F;h2&gt;

&lt;p&gt;The construction of the HMAC key was insecurely derived. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-10112&quot;&gt;CVE-2019-10112&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;www.recurity-labs.com&#x2F;&quot;&gt;Recurity&lt;&#x2F;a&gt; for reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;recurity-assessment-open-redirect&quot;&gt;Recurity assessment: open redirect&lt;&#x2F;h2&gt;

&lt;p&gt;Within the &lt;code&gt;GeoAuthController&lt;&#x2F;code&gt; for the secondary Geo node, a redirect is triggered after successful authentication which was subject to an open redirect vulnerability. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-10117&quot;&gt;CVE-2019-10117&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;www.recurity-labs.com&#x2F;&quot;&gt;Recurity&lt;&#x2F;a&gt; for reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;pdfjs-vulnerable-to-cve-2018-5158&quot;&gt;PDF.js vulnerable to CVE-2018-5158&lt;&#x2F;h2&gt;

&lt;p&gt;The version of PDF.js embedded in Gitlab is 1.8.172, which is vulnerable to CVE-2018-5158. Per the summary, attacker-supplied JavaScript will be executed in a web worker context. Please see https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1452075 for more details about the CVE. The issue is now mitigated in the latest release.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;certifiable&quot;&gt;@certifiable&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-labels-of-private-projectsgroups&quot;&gt;IDOR labels of private projects&#x2F;groups&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization issue was discovered which allowed non-members of a private project&#x2F;group to add and read labels. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-10108&quot;&gt;CVE-2019-10108&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @vijay_kumar1110](https:&#x2F;&#x2F;hackerone.com&#x2F;indoappsec?type=user) for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.11.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;exif-geolocation-data-not-stripped-from-uploaded-images&quot;&gt;EXIF geolocation data not stripped from uploaded images&lt;&#x2F;h2&gt;

&lt;p&gt;Images uploaded to GitLab were not stripped of EXIF geolocation data. As a result, anyone with access to the uploaded image could obtain the its geolocation, device, and software version data, if present. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-10109&quot;&gt;CVE-2019-10109&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;strong&gt;Note:&lt;&#x2F;strong&gt; if you are using CentOS Minimal, you may need to install &lt;code&gt;perl&lt;&#x2F;code&gt; package: &lt;code&gt;yum install perl&lt;&#x2F;code&gt;&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jackb898?type=user&quot;&gt;@jackb898&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rgupt&quot;&gt;@rgupt&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all previous versions of GitLab.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above are upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;additional-notes-for-removing-existing-uploads&quot;&gt;Additional notes for removing existing uploads&lt;&#x2F;h3&gt;

&lt;p&gt;Since 11.9, EXIF data are automatically stripped from JPG or TIFF image uploads.
Because EXIF data may contain sensitive information (e.g. GPS location), you
may also choose to remove EXIF data from images which were uploaded to older versions of GitLab
with &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;administration&#x2F;raketasks&#x2F;uploads&#x2F;sanitize.html&quot;&gt;the rake task&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update GitLab, see the &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;blogimages&#x2F;security-cover-new.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 11.8.3 and 11.7.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/03/20/critical-security-release-gitlab-11-dot-8-dot-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/03/20/critical-security-release-gitlab-11-dot-8-dot-3-released/</id>
<published>2019-03-20T00:00:00+00:00</published>
<updated>2019-03-20T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.8.3 and 11.7.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;project-runner-registration-token-exposed-through-issues-quick-actions&quot;&gt;Project Runner Registration Token Exposed Through Issues Quick Actions&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab issues quick actions were vulnerable to an information disclosure issue that disclosed project runner registration tokens to unauthorized users. The issue is now mitigated in the latest release 
and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9866&quot;&gt;CVE-2019-9866&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-mattermost-to-version-565-in-gitlab-117&quot;&gt;Upgrade Mattermost to Version 5.6.5 in GitLab 11.7&lt;&#x2F;h2&gt;

&lt;p&gt;The Mattermost integration was updated to version 5.6.5 for the GitLab 11.7 package. Included in this Mattermost release are several security fixes.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.8.1, 11.7.6, and 11.6.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/</id>
<published>2019-03-04T00:00:00+00:00</published>
<updated>2019-03-04T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.8.1, 11.7.6, and 11.6.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-file-read-via-mergerequestdiff&quot;&gt;Arbitrary file read via MergeRequestDiff&lt;&#x2F;h2&gt;

&lt;p&gt;A problem with lack of input validation was discovered for MergeRequestDiff objects which resulted in an arbitrary local file read. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9221&quot;&gt;CVE-2019-9221&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-add-publicinternal-groups-as-members-to-project&quot;&gt;IDOR add &lt;code&gt;public&lt;&#x2F;code&gt;&#x2F;&lt;code&gt;internal&lt;&#x2F;code&gt; groups as members to project&lt;&#x2F;h2&gt;

&lt;p&gt;An IDOR was discovered which could allow project owners to add &lt;code&gt;public&lt;&#x2F;code&gt;&#x2F;&lt;code&gt;internal&lt;&#x2F;code&gt; groups, of which they are not a member, to their project. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9756&quot;&gt;CVE-2019-9756&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;indoappsec?type=user&quot;&gt;@vijay_kumar1110&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.8.0 and earlier.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;csrf-add-kubernetes-cluster-integration&quot;&gt;CSRF add Kubernetes cluster integration&lt;&#x2F;h2&gt;

&lt;p&gt;The Kubernetes integration feature was vulnerable to CSRF which could result in overwriting an existing Kubernetes integration with the attacker&#x27;s cluster. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9176&quot;&gt;CVE-2019-9176&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;cache-money&quot;&gt;@cache-money&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;blind-ssrf-in-prometheus-integration&quot;&gt;Blind SSRF in prometheus integration&lt;&#x2F;h2&gt;

&lt;p&gt;The prometheus integration feature was vulnerable to SSRF which could result access to internal services. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9174&quot;&gt;CVE-2019-9174&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;merge-request-information-disclosure&quot;&gt;Merge request information disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;Projects configured with MRs accessible only by project members were subject to information disclosure to non-members via a specific API endpoint. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9172&quot;&gt;CVE-2019-9172&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-milestone-name-information-disclosure&quot;&gt;IDOR milestone name information disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The milestone picker was vulnerable to an IDOR which resulted in disclosure of milestone names. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9170&quot;&gt;CVE-2019-9170&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 2.9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;burndown-chart-information-disclosure&quot;&gt;Burndown chart information disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The burndown chart feature was inadvertently leaking confidential issue attribute information. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9175&quot;&gt;CVE-2019-9175&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 7.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-merge-request-titles-in-public-project-information-disclosure&quot;&gt;Private merge request titles in public project information disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The milestones tab was inadvertently leaking private merge request titles to the public. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9178&quot;&gt;CVE-2019-9178&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.12 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-namespace-disclosure-in-email-notification-when-issue-is-moved&quot;&gt;Private namespace disclosure in email notification when issue is moved&lt;&#x2F;h2&gt;

&lt;p&gt;When an issue is moved to a private namespace, the email notification was inadvertently disclosing the project path which it was moved to. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9179&quot;&gt;CVE-2019-9179&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;users-with-restricted-repo-access-can-access-and-create-discussions-on-commits&quot;&gt;Users with restricted repo access can access and create discussions on commits&lt;&#x2F;h2&gt;

&lt;p&gt;A permissions issue was discovered for access to discussions&#x2F;notes on commits. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9890&quot;&gt;CVE-2019-9890&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.8.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;milestone-name-disclosure&quot;&gt;Milestone name disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;When a project is public and issues are set to &lt;code&gt;Only Project Members&lt;&#x2F;code&gt;, milestone names are able to be disclosed via the milestone autocomplete and board endpoints. These issues are now mitigated in the latest release and are assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9171&quot;&gt;CVE-2019-9171&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9224&quot;&gt;CVE-2019-9224&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.16 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;issue-board-name-disclosure&quot;&gt;Issue board name disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;When a project is public and issues are set to &lt;code&gt;Only Project Members&lt;&#x2F;code&gt;, issue board names are able to be disclosed via the boards and boards list API endpoints. These issues are now mitigated in the latest release and are assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9225&quot;&gt;CVE-2019-9225&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9219&quot;&gt;CVE-2019-9219&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;indoappsec?type=user&quot;&gt;@vijay_kumar1110&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.16 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;npm-automatic-package-referencer&quot;&gt;NPM automatic package referencer&lt;&#x2F;h2&gt;

&lt;p&gt;The automatic package referencer contained an issue where victims could be tricked into installing and executing a malicious package from the npm registry. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9217&quot;&gt;CVE-2019-9217&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;edoverflow&quot;&gt;@edoverflow&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.16 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;path-traversal-snippet-mover&quot;&gt;Path traversal snippet mover&lt;&#x2F;h2&gt;

&lt;p&gt;The logic to move snippets contained a path traversal vulnerability which is currently resulting in a denial of service but could result in data exposure. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9222&quot;&gt;CVE-2019-9222&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pindakaas&quot;&gt;@pindakaas&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-repo-existence&quot;&gt;Information disclosure repo existence&lt;&#x2F;h2&gt;

&lt;p&gt;An information disclosure was discovered which could allow an attacker to determine the existence of a private repo by attempting to clone it. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9223&quot;&gt;CVE-2019-9223&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;tim241&quot;&gt;Tim Wanders&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.15 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;issue-dos-via-mermaid&quot;&gt;Issue DoS via Mermaid&lt;&#x2F;h2&gt;

&lt;p&gt;An input validation issue was discovered in the issue page markdown field which could result in a DoS on the affected issue. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9220&quot;&gt;CVE-2019-9220&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;8ayac&quot;&gt;@8ayac&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;privilege-escalation-impersonate-user&quot;&gt;Privilege escalation impersonate user&lt;&#x2F;h2&gt;

&lt;p&gt;The impersonate user feature contained a vulnerability which could allow for the user being impersonated to escalate privileges. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-9485&quot;&gt;CVE-2019-9485&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;skavans&quot;&gt;@skavans&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;validate-inresponseto-when-linking-gitlabcom-group-saml&quot;&gt;Validate InResponseTo when linking GitLab.com Group SAML&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab.com is now validating the &lt;code&gt;InResponseTo&lt;&#x2F;code&gt; field in the SAML response matches the unique ID we generated for the initial request in order to prevent account hijacking. Note that GitLab.com issues cannot be assigned CVE IDs.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab.com Only.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;The patch has already been applied to GitLab.com&lt;&#x2F;p&gt;

&lt;h2 id=&quot;permissions-issue-gitlabcom-group-saml&quot;&gt;Permissions issue GitLab.com Group SAML&lt;&#x2F;h2&gt;

&lt;p&gt;Disabling the Group SAML option, after previously enabling it, could still allow users to join via SAML SSO. Note that GitLab.com issues cannot be assigned CVE IDs.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-18&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab.com Only.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-18&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;The patch has already been applied to GitLab.com&lt;&#x2F;p&gt;

&lt;h2 id=&quot;omnibus-updates&quot;&gt;Omnibus updates&lt;&#x2F;h2&gt;

&lt;p&gt;Non-security updates for the &lt;code&gt;gitlab-ctl restart unicorn&lt;&#x2F;code&gt; &lt;code&gt;restart_command&lt;&#x2F;code&gt; have been applied. Please see https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;omnibus-gitlab&#x2F;merge_requests&#x2F;3062 for more details regarding this update.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 11.7.4 and 11.6.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/02/05/critical-security-release-gitlab-11-dot-7-dot-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/02/05/critical-security-release-gitlab-11-dot-7-dot-4-released/</id>
<published>2019-02-05T00:00:00+00:00</published>
<updated>2019-02-05T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.7.4 and 11.6.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;leak-of-confidential-issue-and-merge-request-titles&quot;&gt;Leak of Confidential Issue and Merge Request Titles&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-7353&quot;&gt;CVE-2019-7353&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-user-status&quot;&gt;Persistent XSS in User Status&lt;&#x2F;h2&gt;

&lt;p&gt;A regression was identified in the patch for a persistent XSS attack in user status. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6796&quot;&gt;CVE-2019-6796&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.7.3, 11.6.8, 11.5.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/</id>
<published>2019-01-31T00:00:00+00:00</published>
<updated>2019-01-31T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.7.3, 11.6.8, and 11.5.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;These versions are the public releases following 11.7.0, 11.6.5, and 11.5.7. The intermediate versions were not made public for quality assurance reasons.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;remote-command-execution-via-gitlab-pages&quot;&gt;Remote Command Execution via GitLab Pages&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab Pages contained a directory traversal vulnerability that could lead to remote command execution. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6783&quot;&gt;CVE-2019-6783&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;bink&quot;&gt;@bink&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE 8.17, and EE 8.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;covert-redirect-to-steal-githubbitbucket-tokens&quot;&gt;Covert Redirect to Steal GitHub&#x2F;Bitbucket Tokens&lt;&#x2F;h2&gt;

&lt;p&gt;For installations using GitHub or Bitbucket OAuth integrations, it was possible to use a &lt;a href=&quot;http:&#x2F;&#x2F;tetraph.com&#x2F;covert_redirect&#x2F;&quot;&gt;covert redirect&lt;&#x2F;a&gt; to obtain the user OAuth token for those services. This release moves the OAuth callbacks to a common path to mitigate the issue.  The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6788&quot;&gt;CVE-2019-6788&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @mishre and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;yipman&quot;&gt;@yipman&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;em&gt;Necessary Action:&lt;&#x2F;em&gt; It is necessary to append &lt;code&gt;&#x2F;users&#x2F;auth&lt;&#x2F;code&gt; to the callback URL in GitHub or Bitbucket to fully protect against this issue. Please see our pages on the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;github.html&quot;&gt;GitHub&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;bitbucket.html&quot;&gt;Bitbucket&lt;&#x2F;a&gt; integrations for more information.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;remote-mirror-branches-leaked-by-git-transfer-refs&quot;&gt;Remote Mirror Branches Leaked by Git Transfer Refs&lt;&#x2F;h2&gt;

&lt;p&gt;A Gitv2 feature used to hide certain internal references does not function correctly, and can reveal hidden refs. This release disables Gitv2 in GitLab until the problem is resolved. No additional action is required, even if Gitv2 was manually configured.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;denial-of-service-with-markdown&quot;&gt;Denial of Service with Markdown&lt;&#x2F;h2&gt;

&lt;p&gt;It was found that inputting an overly long string into a Markdown field could cause a denial of service. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6785&quot;&gt;CVE-2019-6785&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;8ayac&quot;&gt;@8ayac&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 7.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;guests-can-view-list-of-group-merge-requests&quot;&gt;Guests Can View List of Group Merge Requests&lt;&#x2F;h2&gt;

&lt;p&gt;Guest users were able to view the list of a group&#x27;s merge requests. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6790&quot;&gt;CVE-2019-6790&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.14 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;guest-can-view-merge-request-titles-via-system-notes&quot;&gt;Guest Can View Merge Request Titles via System Notes&lt;&#x2F;h2&gt;

&lt;p&gt;System notes contained an access control issue that permitted a guest user to view merge request titles. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6997&quot;&gt;CVE-2019-6997&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-via-katex&quot;&gt;Persistent XSS via KaTeX&lt;&#x2F;h2&gt;

&lt;p&gt;Markdown fields contained a lack of input validation and output encoding when processing KaTeX that resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6784&quot;&gt;CVE-2019-6784&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jouko&quot;&gt;@jouko&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;emails-sent-to-unauthorized-users&quot;&gt;Emails Sent to Unauthorized Users&lt;&#x2F;h2&gt;

&lt;p&gt;In some cases, users without project permissions received emails after a project move. For private projects, this would disclose the new project namespace to an unauthorized user. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6789&quot;&gt;CVE-2019-6789&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 6.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;hyperlink-injection-in-notification-emails&quot;&gt;Hyperlink Injection in Notification Emails&lt;&#x2F;h2&gt;

&lt;p&gt;It was possible to use the profile name to inject a potentially malicious link into notification emails. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6781&quot;&gt;CVE-2019-6781&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;corb3nik&quot;&gt;@corb3nik&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-access-to-lfs-objects&quot;&gt;Unauthorized Access to LFS Objects&lt;&#x2F;h2&gt;

&lt;p&gt;The contents of an LFS object could be accessed by an unauthorized user, if the file size and OID were known. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6786&quot;&gt;CVE-2019-6786&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to Maxim Ivanov for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.16 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;trigger-token-exposure&quot;&gt;Trigger Token Exposure&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab API contained an authorization issue that permitted project Maintainers and Owners to view the trigger tokens of other project users. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6787&quot;&gt;CVE-2019-6787&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.12 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-rails-to-5071-and-4211&quot;&gt;Upgrade Rails to 5.0.7.1 and 4.2.11&lt;&#x2F;h2&gt;

&lt;p&gt;This release upgrades the version of Ruby on Rails included in GitLab to address &lt;a href=&quot;https:&#x2F;&#x2F;groups.google.com&#x2F;forum&#x2F;#!topic&#x2F;rubyonrails-security&#x2F;FL4dSdzr2zw&quot;&gt;CVE-2018-16476&lt;&#x2F;a&gt;. GitLab versions 11.7 and 11.6 will now use Rails 5.0.7.1, and GitLab 11.5 will now use 4.2.11&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;contributed-project-information-visible-in-private-profile&quot;&gt;Contributed Project Information Visible in Private Profile&lt;&#x2F;h2&gt;

&lt;p&gt;Due to an authorization issue the contributed project information of a private profile could be viewed. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6782&quot;&gt;CVE-2019-6782&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;imported-project-retains-prior-visibility-setting&quot;&gt;Imported Project Retains Prior Visibility Setting&lt;&#x2F;h2&gt;

&lt;p&gt;When a project with visibility more permissive than the target group was imported, it would retain its prior visibility. This release will now change the visibility of the project to the visibility of the group. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6791&quot;&gt;CVE-2019-6791&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;error-disclosure-on-project-import&quot;&gt;Error disclosure on Project Import&lt;&#x2F;h2&gt;

&lt;p&gt;When an error was encountered on project import, the error message would display instance internal information. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6792&quot;&gt;CVE-2019-6792&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-user-status&quot;&gt;Persistent XSS in User Status&lt;&#x2F;h2&gt;

&lt;p&gt;The user status field contained a lack of input validation and output encoding that resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6796&quot;&gt;CVE-2019-6796&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;last-commit-status-leaked-to-guest-users&quot;&gt;Last Commit Status Leaked to Guest Users&lt;&#x2F;h2&gt;

&lt;p&gt;A project guest user could view the last commit status of the default branch. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6794&quot;&gt;CVE-2019-6794&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;mitigations-for-idn-homograph-and-rtlo-attacks&quot;&gt;Mitigations for IDN Homograph and RTLO Attacks&lt;&#x2F;h2&gt;

&lt;p&gt;IDN homographs and RTLO characters were rendered to unicode, which could be used for social engineering. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6795&quot;&gt;CVE-2019-6795&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;edoverflow&quot;&gt;@edoverflow&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;access-to-internal-wiki-when-external-wiki-enabled&quot;&gt;Access to Internal Wiki When External Wiki Enabled&lt;&#x2F;h2&gt;

&lt;p&gt;Access to the internal wiki was permitted when an external wiki service was enabled. With this release, each type of wiki will be managed and displayed separately in the UI. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6960&quot;&gt;CVE-2019-6960&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-18&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-18&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-can-comment-on-locked-project-issues&quot;&gt;User Can Comment on Locked Project Issues&lt;&#x2F;h2&gt;

&lt;p&gt;Users were able to comment on locked project issues. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6995&quot;&gt;CVE-2019-6995&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;flashdisk&quot;&gt;@flashdisk&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-19&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-19&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-reaction-emojis-by-guest-users&quot;&gt;Unauthorized Reaction Emojis by Guest Users&lt;&#x2F;h2&gt;

&lt;p&gt;Guest users were able to add reaction emojis on comments to which they had no visibility. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-7176&quot;&gt;CVE-2019-7176&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-20&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-20&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;user-retains-project-role-after-removal-from-private-group&quot;&gt;User Retains Project Role After Removal from Private Group&lt;&#x2F;h2&gt;

&lt;p&gt;A user would retain their role within a project in a private group after being removed from the group, if their privileges within the project were different from the group. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-7155&quot;&gt;CVE-2019-7155&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;rpadovani&quot;&gt;@rpadovani&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-21&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-21&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;github-token-leaked-to-maintainers&quot;&gt;GitHub Token Leaked to Maintainers&lt;&#x2F;h2&gt;

&lt;p&gt;The GitHub token used in &lt;strong&gt;CI&#x2F;CD for External Repos&lt;&#x2F;strong&gt; was being leaked to project maintainers in the UI. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6797&quot;&gt;CVE-2019-6797&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-22&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-22&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthenticated-blind-ssrf-in-jira-integration&quot;&gt;Unauthenticated Blind SSRF in Jira Integration&lt;&#x2F;h2&gt;

&lt;p&gt;The Jira integration feature was vulnerable to an unauthenticated blind SSRF issue. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6793&quot;&gt;CVE-2019-6793&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-23&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-23&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-access-to-group-membership&quot;&gt;Unauthorized Access to Group Membership&lt;&#x2F;h2&gt;

&lt;p&gt;The merge request approvers section had an access control issue that permitted project maintainers to view membership of private groups. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6996&quot;&gt;CVE-2019-6996&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-24&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-24&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;validate-saml-response-in-group-saml-sso&quot;&gt;Validate SAML Response in Group SAML SSO&lt;&#x2F;h2&gt;

&lt;p&gt;In preparation for enhanced group SAML SSO support in GitLab.com, additional validations were added to the group SAML implementation to validate that an SSO request was initiated from GitLab.com. This will ensure that a malicious user is unable to trick users into linking their account to a malicious IdP.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-25&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-25&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;This enhancement currently applies only to GitLab.com&lt;&#x2F;p&gt;

&lt;p&gt;&lt;em&gt;Updated: 2019-02-07&lt;&#x2F;em&gt;&lt;&#x2F;p&gt;
&lt;h2 id=&quot;pipelines-section-is-available-to-unauthorized-users&quot;&gt;Pipelines section is available to unauthorized users&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab pipelines feature was vulnerable to authorization issues that allowed unauthorized users to view job information. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-7549&quot;&gt;CVE-2019-7549&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;Soullivaneuh&quot;&gt;Sullivan Senechal&lt;&#x2F;a&gt;, &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt;, and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-26&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-26&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 11.6.4, 11.5.7, 11.4.14</title>
<release></release>
<link href='https://about.gitlab.com/releases/2019/01/16/critical-security-release-gitlab-11-dot-6-dot-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2019/01/16/critical-security-release-gitlab-11-dot-6-dot-4-released/</id>
<published>2019-01-16T00:00:00+00:00</published>
<updated>2019-01-16T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.6.4, 11.5.7, and 11.4.14 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain an important security fix, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-repo-read-in-gitlab-project-import&quot;&gt;Arbitrary repo read in Gitlab project import&lt;&#x2F;h2&gt;

&lt;p&gt;The project import feature contained a lack of archive validation which could result in an arbitrary repo read. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-6240&quot;&gt;CVE-2019-6240&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.6.1, 11.5.6, 11.4.13</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/</id>
<published>2018-12-31T00:00:00+00:00</published>
<updated>2018-12-31T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.6.1, 11.5.6, and 11.4.13 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain an important security fix, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;source-code-disclosure-merge-request-diff&quot;&gt;Source code disclosure merge request diff&lt;&#x2F;h2&gt;

&lt;p&gt;The merge request diff feature was missing an authorization control which resulted in source code disclosure of public or internal projects with a repository available to team members only. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20493&quot;&gt;CVE-2018-20493&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.17 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;todos-improper-access-control&quot;&gt;Todos improper access control&lt;&#x2F;h2&gt;

&lt;p&gt;The todos component was vulnerable to an improper access control issue which could&#x27;ve resulted in access to confidential issues or merge requests. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20492&quot;&gt;CVE-2018-20492&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;url-rel-attribute-not-set&quot;&gt;URL &lt;code&gt;rel&lt;&#x2F;code&gt; attribute not set&lt;&#x2F;h2&gt;

&lt;p&gt;The &lt;code&gt;rel&lt;&#x2F;code&gt; attribute was not set for some URLs in a markdown field. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20489&quot;&gt;CVE-2018-20489&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; from HackerOne for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.1 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-autocompletion&quot;&gt;Persistent XSS Autocompletion&lt;&#x2F;h2&gt;

&lt;p&gt;An attribute used in autocompletion contained an input validation and output encoding issue which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20490&quot;&gt;CVE-2018-20490&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jouko&quot;&gt;@jouko&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.2 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-repository-mirroring&quot;&gt;SSRF repository mirroring&lt;&#x2F;h2&gt;

&lt;p&gt;The repository mirroring feature was vulnerable to an SSRF issue. It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20497&quot;&gt;CVE-2018-20497&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;p&gt;By default, this fix forbids importing projects or mirroring repositories in the same network. In order to allow URLs pointing to the local network, the option located in &lt;code&gt;Admin &amp;gt; Settings &amp;gt; Network &amp;gt; Outbound requests &amp;gt; Allow requests to the local network from hooks and services&lt;&#x2F;code&gt; has to be enabled.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.7.0 and later.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;em&gt;Updated: 2019-01-14:&lt;&#x2F;em&gt; A similar SSRF issue in &lt;code&gt;CI&#x2F;CD Pipelines for External Repositories&lt;&#x2F;code&gt; was also mitigated with this fix. It now respects the &lt;code&gt;Outbound requests&lt;&#x2F;code&gt; setting above. Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;math1as&quot;&gt;@math1as&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ci-job-token-lfs-error-message-disclosure&quot;&gt;CI job token LFS error message disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The CI job token was being disclosed in the job output due to an LFS error message. It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20495&quot;&gt;CVE-2018-20495&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;Nowaker&quot;&gt;Damian Nowak&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;secret-ci-variable-exposure&quot;&gt;Secret CI variable exposure&lt;&#x2F;h2&gt;

&lt;p&gt;Secret CI variables can be exposed by creating a tag with the same name as an existing protected branch. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20488&quot;&gt;CVE-2018-20488&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.3 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;guest-user-ci-job-disclosure&quot;&gt;Guest user CI job disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The CI jobs API endpoint contained an improper access control issue which resulted in guest users being able to access job information. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20494&quot;&gt;CVE-2018-20494&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.4 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-label-reference&quot;&gt;Persistent XSS label reference&lt;&#x2F;h2&gt;

&lt;p&gt;The markdown label references feature contained a lack of input validation and output encoding issue which resulted in a persistent XSS. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20496&quot;&gt;CVE-2018-20496&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jouko&quot;&gt;@jouko&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.10 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-wiki-in-ie-browser&quot;&gt;Persistent XSS wiki in IE browser&lt;&#x2F;h2&gt;

&lt;p&gt;A persistent XSS issue was discovered in wiki markdown pages due to an issue of how Internet Explorer treats a certain configuration of the CSP header. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20491&quot;&gt;CVE-2018-20491&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @ruvlol for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.3. GitLab.com was not affected.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-in-project-imports-with-lfs&quot;&gt;SSRF in project imports with LFS&lt;&#x2F;h2&gt;

&lt;p&gt;The project imports feature was vulnerable to an SSRF issue which allowed an attacker to make requests to any local network resource accessible from the GitLab server. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20499&quot;&gt;CVE-2018-20499&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.0 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-control-cicd-settings&quot;&gt;Improper access control CI&#x2F;CD settings&lt;&#x2F;h2&gt;

&lt;p&gt;The CI&#x2F;CD settings contained an issue where the runner registration token could not be reset. This was a security risk if one of the maintainers leaves the group and they know the token. This issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20500&quot;&gt;CVE-2018-20500&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.4 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;missing-authorization-control-merge-requests&quot;&gt;Missing authorization control merge requests&lt;&#x2F;h2&gt;

&lt;p&gt;A project member that has been removed from a private project retains control over the state, assignee, milestones, and labels of a merge request and issue. It is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20501&quot;&gt;CVE-2018-20501&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; from HackerOne for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.12 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-access-control-branches-and-tags&quot;&gt;Improper access control branches and tags&lt;&#x2F;h2&gt;

&lt;p&gt;Guest users were able to view branches and tag names, which is normally forbidden. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20498&quot;&gt;CVE-2018-20498&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;bull&quot;&gt;@bull&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.10 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;missing-authentication-for-prometheus-alert-endpoint&quot;&gt;Missing authentication for Prometheus alert endpoint&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab Prometheus integration alert endpoint was lacking authentication which could result in falsely generated notification emails. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20507&quot;&gt;CVE-2018-20507&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.2 and later.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 11.5.5, 11.4.12, 11.3.14</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released/</id>
<published>2018-12-20T00:00:00+00:00</published>
<updated>2018-12-20T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.5.5, 11.4.12, and 11.3.14 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain an important security fix, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-file-read-in-gitlab-project-import&quot;&gt;Arbitrary File read in Gitlab project import&lt;&#x2F;h2&gt;

&lt;p&gt;The project import feature contained a insecure file permissions issue due to how symlinks are processed which could result in an arbitrary file read. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20229&quot;&gt;CVE-2018-20229&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech and @mishre for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 11.6RC7, 11.5.4, 11.4.11, 11.3.13</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/</id>
<published>2018-12-13T00:00:00+00:00</published>
<updated>2018-12-13T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.5.4, 11.4.11, and 11.3.13 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain an important security fix, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-file-read-in-gitlab-project-import-with-git-lfs&quot;&gt;Arbitrary File read in GitLab project import with Git LFS&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab Git LFS contained a validation issue during project import which could allow an attacker to read arbitrary files on a GitLab server. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-20144&quot;&gt;CVE-2018-20144&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;em&gt;Updated: 2018-12-17:&lt;&#x2F;em&gt; We have received some questions regarding 11.6 Release Candidates. While, 11.6-RC7 also includes this security fix, but we do not recommend using RCs as they are not part of stable releases.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 11.5.3, 11.4.10, 11.3.12</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/</id>
<published>2018-12-06T00:00:00+00:00</published>
<updated>2018-12-06T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.5.3, 11.4.10, and 11.3.12 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain an important security fix, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;directory-traversal-in-templates-api&quot;&gt;Directory Traversal in Templates API&lt;&#x2F;h2&gt;

&lt;p&gt;The templates api was vulnerable to a directory traversal issue which could allow an attacker to read arbitrary files on a GitLab server. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19856&quot;&gt;CVE-2018-19856&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.11 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.5.1, 11.4.8, and 11.3.11</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/</id>
<published>2018-11-28T00:00:00+00:00</published>
<updated>2018-11-28T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.5.1, 11.4.8, and 11.3.11 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-at-issue-notes&quot;&gt;IDOR at issue notes&lt;&#x2F;h2&gt;

&lt;p&gt;The issue comments feature contained an authorization bug which could allow an attacker to comment on a confidential issue which they shouldn&#x27;t be allowed to. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2019-5883&quot;&gt;CVE-2019-5883&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;lucky_sen&quot;&gt;@lucky_sen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 6.0 to 11.5.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;view-names-of-private-groups&quot;&gt;View Names of Private Groups&lt;&#x2F;h2&gt;

&lt;p&gt;The Todos dashboard permitted an unauthorized user to view the names of private groups. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19494&quot;&gt;CVE-2018-19494&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ashish_r_padelkar&quot;&gt;@ashish_r_padelkar&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-environments&quot;&gt;Persistent XSS in Environments&lt;&#x2F;h2&gt;

&lt;p&gt;The Environments page contained a lack of input validation and output encoding issue which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19493&quot;&gt;CVE-2018-19493&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;xanbanx&quot;&gt;@xanbanx&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-in-prometheus-integration&quot;&gt;SSRF in Prometheus integration&lt;&#x2F;h2&gt;

&lt;p&gt;The Prometheus integration was vulnerable to an SSRF issue which allowed an attacker to make requests to any local network resource accessible from the GitLab server. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19495&quot;&gt;CVE-2018-19495&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;bull&quot;&gt;@bull&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-promotion-of-milestones&quot;&gt;Unauthorized Promotion of Milestones&lt;&#x2F;h2&gt;

&lt;p&gt;Milestones were vulnerable to an insecure object reference issue where a user with insufficient privileges could promote a project milestone to a group milestone. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19496&quot;&gt;CVE-2018-19496&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sandeep_hodkasia&quot;&gt;@sandeep_hodkasia&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;exposure-of-confidential-issue-title&quot;&gt;Exposure of Confidential Issue Title&lt;&#x2F;h2&gt;

&lt;p&gt;The commits listing page in a project permitted an unauthorized user to view the title of a confidential issue. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19577&quot;&gt;CVE-2018-19577&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persisent-xss-in-markdown-fields-via-mermaid-script&quot;&gt;Persisent XSS in Markdown Fields via Mermaid Script&lt;&#x2F;h2&gt;

&lt;p&gt;Fields that accept Markdown contained incomplete input validation and output encoding when accepting Mermaid script, which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19573&quot;&gt;CVE-2018-19573&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;@fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-markdown-fields-via-unrecognized-html-tags&quot;&gt;Persistent XSS in Markdown Fields via Unrecognized HTML Tags&lt;&#x2F;h2&gt;

&lt;p&gt;Fields that accept Markdown contained incomplete input validation and output encoding when accepting unrecognized HTML tags, which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19570&quot;&gt;CVE-2018-19570&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;otr&quot;&gt;@otr&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;symlink-race-condition-in-pages&quot;&gt;Symlink Race Condition in Pages&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab Pages had a symlink race condition that would allow unauthorized access to files in the Pages chroot. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19572&quot;&gt;CVE-2018-19572&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;waldi&quot;&gt;Bastian Blank&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE 8.17 &amp;amp; EE 8.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-changes-by-guest-user-in-issues&quot;&gt;Unauthorized Changes by Guest User in Issues&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab issues were vulnerable to an insecure object reference issue that allowed a Guest user to make changes to, or delete their own comments after an issue had been made confidential. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19576&quot;&gt;CVE-2018-19576&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sandeep_hodkasia&quot;&gt;@sandeep_hodkasia&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-comments-on-locked-issues&quot;&gt;Unauthorized Comments on Locked Issues&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab issues were vulnerable to an insecure object reference issue that allowed an unauthorized user to make comments after an issue had been locked. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19575&quot;&gt;CVE-2018-19575&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-enforcement-of-token-scope&quot;&gt;Improper Enforcement of Token Scope&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab web interface was vulnerable to an authorization issue that allowed access to the web-UI as a user using their Personal Access Token (PAT) of any scope. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19569&quot;&gt;CVE-2018-19569&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;With this fix, the use of PATs is limited to the API, the RSS feed, and the registry, which could break any existing automation scripts that don&#x27;t use the API. The impact is expected to be limited.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to Jan Alsenz of Oneconsult AG for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;em&gt;Updated: 2018-11-28:&lt;&#x2F;em&gt; We have received reports that this change has impacted how repo files and job artifacts are downloaded for some users. For instructions on how to do so through the API, please see &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues&#x2F;54572#note_120859334&quot;&gt;our support issue&lt;&#x2F;a&gt;. Thank you to the users participating in this issue. Your feedback is important to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.8 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;crlf-injection-in-project-mirroring&quot;&gt;CRLF Injection in Project Mirroring&lt;&#x2F;h2&gt;

&lt;p&gt;When using the Git protocol, project mirroring was vulnerable to a CRLF injection vulnerability. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19585&quot;&gt;CVE-2018-19585&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;chromium1337&quot;&gt;@chromium1337&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-12&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.18 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-12&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-in-oauth-authorization&quot;&gt;XSS in OAuth Authorization&lt;&#x2F;h2&gt;

&lt;p&gt;The OAuth authorization process contained a lack of input validation and output encoding which resulted in an XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19574&quot;&gt;CVE-2018-19574&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;@fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-13&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 7.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-13&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-in-webhooks&quot;&gt;SSRF in Webhooks&lt;&#x2F;h2&gt;

&lt;p&gt;Webhooks were vulnerable to an SSRF vulnerability that allowed an attacker to make requests to any local network resource accessible from the GitLab server. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19571&quot;&gt;CVE-2018-19571&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-14&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.18 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-14&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;send-email-on-email-address-change&quot;&gt;Send Email on Email Address Change&lt;&#x2F;h2&gt;

&lt;p&gt;Previously, GitLab did not send an email to the old email address when an email address change was made. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19580&quot;&gt;CVE-2018-19580&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;muon4&quot;&gt;@muon4&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-15&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-15&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;workhorse-logs-contained-tokens&quot;&gt;Workhorse Logs Contained Tokens&lt;&#x2F;h2&gt;

&lt;p&gt;Workhorse was logging access tokens, which allowed administrators with access to the logs to see the tokens of other users. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19583&quot;&gt;CVE-2018-19583&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-16&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-16&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-publishing-of-draft-comments&quot;&gt;Unauthorized Publishing of Draft Comments&lt;&#x2F;h2&gt;

&lt;p&gt;The discussion drafts endpoint, used in merge requests, contained an insecure object reference vulnerability that permitted an unauthorized user to publish the drafts of another user. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19582&quot;&gt;CVE-2018-19582&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;lucky_sen&quot;&gt;@lucky_sen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-17&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-17&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;guest-can-set-weight-of-a-new-issue&quot;&gt;Guest Can Set Weight of a New Issue&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab issues were vulnerable to an insecure object reference issue that allowed a Guest user to set the weight of an issue they created. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19581&quot;&gt;CVE-2018-19581&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-18&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-18&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;disclosure-of-private-groups-members-and-milestones&quot;&gt;Disclosure of Private Group&#x27;s Members and Milestones&lt;&#x2F;h2&gt;

&lt;p&gt;An insecure direct object reference vulnerability in issue boards allowed authenticated, but unauthorized users to view members and milestone details of private groups. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19584&quot;&gt;CVE-2018-19584&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-19&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-19&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persisent-xss-in-operations&quot;&gt;Persisent XSS in Operations&lt;&#x2F;h2&gt;

&lt;p&gt;The Operations page contained a lack of input validation and output encoding which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19579&quot;&gt;CVE-2018-19579&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-20&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.5.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-20&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;reporter-can-view-operations-page&quot;&gt;Reporter Can View Operations Page&lt;&#x2F;h2&gt;

&lt;p&gt;Due to incomplete permissions validation, a user with Reporter privileges was permitted to view the Jaeger Tracing Operations page. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19578&quot;&gt;CVE-2018-19578&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;indoappsec?type=user&quot;&gt;@vijay_kumar1110&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-21&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.5.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-21&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-to-redis-3212&quot;&gt;Upgrade to Redis 3.2.12&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Redis used in the Omnibus package was upgraded in the GitLab 11.3 release. This upgrade was previously included in GitLab 11.4 and 11.5 Omnibus packages, and includes several security fixes.
The upgrade to Redis was incorrectly reported in the &lt;a href=&quot;&#x2F;releases&#x2F;2018&#x2F;10&#x2F;29&#x2F;security-release-gitlab-11-dot-4-dot-3-released&#x2F;&quot;&gt;October security release&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 11.5.0-rc12, 11.4.6, 11.3.10</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/</id>
<published>2018-11-19T00:00:00+00:00</published>
<updated>2018-11-19T00:00:00+00:00</updated>
<author>
<name>Ethan Strike</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.5.0-rc12, 11.4.6, and 11.3.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-autocompletion&quot;&gt;Persistent XSS Autocompletion&lt;&#x2F;h2&gt;

&lt;p&gt;An attribute used in autocompletion contained an input validation and output encoding issue which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18643&quot;&gt;CVE-2018-18643&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE 11.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-service-template-creation&quot;&gt;Unauthorized service template creation&lt;&#x2F;h2&gt;

&lt;p&gt;The project import feature contained an input validation issue that resulted in the ability for an unauthorized user to create service templates. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-19359&quot;&gt;CVE-2018-19359&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE 8.9 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;em&gt;Updated: 2018-11-20:&lt;&#x2F;em&gt; We have received some questions regarding the XSS vulnerability in this release and a similar vulnerability reported in October. The fix in this release does correct an incomplete patch in the &lt;a href=&quot;&#x2F;releases&#x2F;2018&#x2F;10&#x2F;29&#x2F;security-release-gitlab-11-dot-4-dot-3-released&#x2F;&quot;&gt;October security release&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 11.4.4, 11.3.9, 11.2.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/</id>
<published>2018-11-01T00:00:00+00:00</published>
<updated>2018-11-01T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.4.4, 11.3.9, and 11.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-in-kubernetes-integration&quot;&gt;SSRF in Kubernetes integration&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab Kubernetes integration was vulnerable to a SSRF issue which could allow an attacker to make requests to access any internal URLs. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18843&quot;&gt;CVE-2018-18843&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.4.3, 11.3.8, and 11.2.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/</id>
<published>2018-10-29T00:00:00+00:00</published>
<updated>2018-10-29T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.4.3, 11.3.8, and 11.2.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;rce-in-gitlab-wiki-api&quot;&gt;RCE in Gitlab Wiki API&lt;&#x2F;h2&gt;

&lt;p&gt;The wiki API contained an input validation issue which resulted in remote code execution. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18649&quot;&gt;CVE-2018-18649&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-in-hipchat-integration&quot;&gt;SSRF in Hipchat integration&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab Hipchat integration was vulnerable to a SSRF issue which allowed an attacker to make requests to any local network resource accessible from the GitLab server. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18646&quot;&gt;CVE-2018-18646&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;bull&quot;&gt;@bull&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 5.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cleartext-storage-of-personal-access-tokens&quot;&gt;Cleartext storage of personal access tokens&lt;&#x2F;h2&gt;

&lt;p&gt;Personal access tokens were being stored unencrypted as plain text in the database which could result in attackers potentially reading them via SQL injection or other database leaks. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18641&quot;&gt;CVE-2018-18641&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.10.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-exposure-through-stack-trace-error-message&quot;&gt;Information exposure through stack trace error message&lt;&#x2F;h2&gt;

&lt;p&gt;A JSON endpoint was disclosing Gem version information which could result in an attacker discovering vulnerable Gems available on a specific GitLab instance. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18648&quot;&gt;CVE-2018-18648&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-autocomplete&quot;&gt;Persistent XSS autocomplete&lt;&#x2F;h2&gt;

&lt;p&gt;The fragment identifier (hash) of several pages in GitLab contained a lack of input validation and output encoding issue which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18643&quot;&gt;CVE-2018-18643&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-exposure-in-stored-browser-history&quot;&gt;Information exposure in stored browser history&lt;&#x2F;h2&gt;

&lt;p&gt;Private project pages had inadequate cache control, which resulted in unauthorized users being able to view them in the browser. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18640&quot;&gt;CVE-2018-18640&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;8ayac&quot;&gt;@8ayac&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-exposure-when-replying-to-issues-through-email&quot;&gt;Information exposure when replying to issues through email&lt;&#x2F;h2&gt;

&lt;p&gt;It was found that when replying to an issue through email, with the GitLab email footer included, a user&#x27;s unsubscribe link would be included in the issue. This information is considered sensitive. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18645&quot;&gt;CVE-2018-18645&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;underyx&quot;&gt;Bence Nagy&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects all versions of GitLab CE&#x2F;EE&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-license-management-and-security-reports&quot;&gt;Persistent XSS in License Management and Security Reports&lt;&#x2F;h2&gt;

&lt;p&gt;The license management and security reports pages contained a lack of input validation and output encoding which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18642&quot;&gt;CVE-2018-18642&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Security Reports - Affects GitLab EE 10.4.0 and later
License Management - Affects GitLab EE 11.0.0 and later&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;metrics-information-disclosure-in-prometheus-integration&quot;&gt;Metrics information disclosure in Prometheus integration&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab Prometheus integration was vulnerable to an indirect object reference issue which allowed an unauthorized user to see private information. This information includes the project name, environment name, metric name, and metric query. Additionally, an unauthorized user could create false alarms. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18644&quot;&gt;CVE-2018-18644&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 11.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;unauthorized-changes-to-a-protected-branchs-access-levels&quot;&gt;Unauthorized changes to a protected branch&#x27;s access levels&lt;&#x2F;h2&gt;

&lt;p&gt;The protected_branches api was vulnerable to an issue which allowed an unauthorized user to remove the &lt;code&gt;merge_access_levels&lt;&#x2F;code&gt; and &lt;code&gt;push_access_levels&lt;&#x2F;code&gt; objects. This could result in the inability of project participants to push or merge into the branch. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-18647&quot;&gt;CVE-2018-18647&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.11 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-ruby-to-245&quot;&gt;Upgrade Ruby to 2.4.5&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Ruby used in the Omnibus package was upgraded to version 2.4.5. Included in this Ruby release are several security fixes.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-redis-to-3212&quot;&gt;Upgrade Redis to 3.2.12&lt;&#x2F;h2&gt;

&lt;p&gt;The version of Redis used in the Omnibus package was upgraded in the GitLab 11.2 and 11.3 releases. This upgrade was previously included in GitLab 11.4 Omnibus package. Included in this Redis release are several security fixes.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 11.3.4, 11.2.5, and 11.1.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/10/05/critical-security-release-11-3-4/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/10/05/critical-security-release-11-3-4/</id>
<published>2018-10-05T00:00:00+00:00</published>
<updated>2018-10-05T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.3.4, 11.2.5, and 11.1.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;git-updates&quot;&gt;Git updates&lt;&#x2F;h2&gt;

&lt;p&gt;We&#x27;ve included updated Git security versions 2.18.1 and 2.17.2 in this latest release for 11.3.4, 11.2.5, and 11.1.8.&lt;&#x2F;p&gt;

&lt;p&gt;For more information, see the Git &lt;a href=&quot;https:&#x2F;&#x2F;public-inbox.org&#x2F;git&#x2F;xmqqy3bcuy3l.fsf@gitster-ct.c.googlers.com&#x2F;T&#x2F;#u&quot;&gt;release notes&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;merge-request-information-disclosure&quot;&gt;Merge request information disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The merge request JSON endpoint was inadvertently disclosing all &lt;code&gt;User&lt;&#x2F;code&gt; record data of a person associated with the discussion. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17939&quot;&gt;CVE-2018-17939&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.3, 11.2, and 11.1.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;private-project-namespace-information-disclosure&quot;&gt;Private project namespace information disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The epic feature is leaking private project namespaces if someone adds a related issue to the epic. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17976&quot;&gt;CVE-2018-17976&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.2 - 11.3.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-flavored-markdown-api-information-disclosure&quot;&gt;Gitlab Flavored Markdown API information disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The GFM API is missing an authorization control which results in leaking confidential issue titles and private snippet titles. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17975&quot;&gt;CVE-2018-17975&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE 11.0 - 11.3.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.3.1, 11.2.4, and 11.1.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/</id>
<published>2018-10-01T00:00:00+00:00</published>
<updated>2018-10-01T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;blockquote&gt;
  &lt;p&gt;Note: 11.1.7 is still vulnerable to these issues because of a mistake tagging the release. Please upgrade to &lt;a href=&quot;&#x2F;releases&#x2F;2018&#x2F;10&#x2F;05&#x2F;critical-security-release-11-3-4&#x2F;&quot;&gt;11.1.8&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;&#x2F;blockquote&gt;

&lt;p&gt;Today we are releasing versions 11.3.1, 11.2.4, and 11.1.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-gcp-access-token-disclosure&quot;&gt;SSRF GCP access token disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab Kubernetes integration was vulnerable to a SSRF issue which allowed for access to any URL accessible from the GitLab server. For example, for users which run GitLab on GCP, an attacker with access to use the GitLab instance would have been able to determine the GCP service token for the GitLab host. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17450&quot;&gt;CVE-2018-17450&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.2 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-on-issue-details&quot;&gt;Persistent XSS on issue details&lt;&#x2F;h2&gt;

&lt;p&gt;The issue details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17454&quot;&gt;CVE-2018-17454&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;8ayac&quot;&gt;@8ayac&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;diff-formatter-dos-in-sidekiq-jobs&quot;&gt;Diff formatter DoS in Sidekiq jobs&lt;&#x2F;h2&gt;

&lt;p&gt;The diff formatter using &lt;code&gt;rouge&lt;&#x2F;code&gt; lacks timeout in Sidekiq jobs which can result in a denial of service. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-15472&quot;&gt;CVE-2018-15472&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;waldi&quot;&gt;Bastian Blank&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 7.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;confidential-information-disclosure-in-events-api-endpoint&quot;&gt;Confidential information disclosure in events API endpoint&lt;&#x2F;h2&gt;

&lt;p&gt;The events API contained insecure direct object reference issue which resulted in disclosure of confidential issues, comments, and titles of public projects. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17449&quot;&gt;CVE-2018-17449&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.3 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;validate_localhost-function-in-url_blockerrb-could-be-bypassed&quot;&gt;&lt;code&gt;validate_localhost&lt;&#x2F;code&gt; function in &lt;code&gt;url_blocker.rb&lt;&#x2F;code&gt; could be bypassed&lt;&#x2F;h2&gt;

&lt;p&gt;The &lt;code&gt;validate_localhost&lt;&#x2F;code&gt; function was missing a check for loopback addresses which could result in SSRF issues. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17452&quot;&gt;CVE-2018-17452&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;math1as&quot;&gt;@math1as&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.3 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;slack-integration-csrf-oauth2&quot;&gt;Slack integration CSRF Oauth2&lt;&#x2F;h2&gt;

&lt;p&gt;The Slack integration contained a CSRF issue which could allow an attacker to issue slash commands on behalf of the victim. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17451&quot;&gt;CVE-2018-17451&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&quot;&gt;@ngalog&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;grpcunknown-logging-token-disclosure&quot;&gt;&lt;code&gt;GRPC::Unknown&lt;&#x2F;code&gt; logging token disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The &lt;code&gt;GRPC::Unknown&lt;&#x2F;code&gt; exception was disclosing access tokens in Sentry logs. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17453&quot;&gt;CVE-2018-17453&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;idor-merge-request-approvals&quot;&gt;IDOR merge request approvals&lt;&#x2F;h2&gt;

&lt;p&gt;The merge request approvals component contained an insecure direct object reference vulnerability which resulted in disclosure of private group names, avatars, LDAP settings, and descriptions. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17455&quot;&gt;CVE-2018-17455&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;@jobert&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.13 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-packagejson&quot;&gt;Persistent XSS &lt;code&gt;package.json&lt;&#x2F;code&gt;&lt;&#x2F;h2&gt;

&lt;p&gt;When a &lt;code&gt;package.json&lt;&#x2F;code&gt; file is present, the blog-viewer will display a notice when browsing the repository which lacks input validation and output encoding which can result in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17537&quot;&gt;CVE-2018-17537&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;@fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-merge-request-project-import&quot;&gt;Persistent XSS merge request project import&lt;&#x2F;h2&gt;

&lt;p&gt;The merge request page contained a lack of input validation and output encoding issue which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-17536&quot;&gt;CVE-2018-17536&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;isra17&quot;&gt;@isra17&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.4 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>Exposure of Confidential Issues on Public Projects through the Events API </title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/10/01/events-api-security-issue/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/10/01/events-api-security-issue/</id>
<published>2018-10-01T00:00:00+00:00</published>
<updated>2018-10-01T00:00:00+00:00</updated>
<author>
<name>Kathy Wang</name>
</author>
<content type='html'>&lt;h2 id=&quot;summary&quot;&gt;Summary&lt;&#x2F;h2&gt;

&lt;p&gt;On September 20, 2018, we were notified by HackerOne hacker &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&#x2F;&quot;&gt;ngalog&lt;&#x2F;a&gt; of a bug in GitLab Events API code that resulted in exposure of confidential issues within all public projects.&lt;&#x2F;p&gt;

&lt;p&gt;Upon further validation and investigation, we discovered that this exposure dates back to June 22, 2017, with the 9.3 release. GitLab’s Events API was returning private events related to projects that were marked as public during that time frame. These events included information that was marked as private, such as confidential issues and private merge requests, among others. The issue was present in all versions of GitLab between 9.3 and 11.3, and across all deployments, including GitLab.com.&lt;&#x2F;p&gt;

&lt;p&gt;The exposure of these private events was present only through the API, whereas the UI behaved as-intended and filtered these events.&lt;&#x2F;p&gt;

&lt;p&gt;All projects that were marked as public are affected by this exposure. This issue has already been mitigated for all GitLab.com customers. Projects marked as private were not impacted by this issue.&lt;&#x2F;p&gt;

&lt;p&gt;We investigated four months of retained GitLab.com logs, and found no evidence that unauthorized parties accessed any of your private events.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;background&quot;&gt;Background&lt;&#x2F;h2&gt;

&lt;p&gt;The Events API was introduced with the release of GitLab 9.3, and it enabled users to programmatically access the activity log of projects and users. The adoption of this API has not been very wide, topping an average of 180 requests per hour.&lt;&#x2F;p&gt;

&lt;p&gt;Unfortunately, a bug was introduced at release time and the API would not honor the private flag of events related to numerous target types that belonged to public projects. As a result, events for said target types were exposed to potentially unauthenticated and unauthorized parties.&lt;&#x2F;p&gt;

&lt;p&gt;As documented in our &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;api&#x2F;events.html#target-types&quot;&gt;Events API documentation&lt;&#x2F;a&gt;, existing target types for the Events API are:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;Issue&lt;&#x2F;li&gt;
  &lt;li&gt;Milestone&lt;&#x2F;li&gt;
  &lt;li&gt;Merge_request&lt;&#x2F;li&gt;
  &lt;li&gt;Note&lt;&#x2F;li&gt;
  &lt;li&gt;Snippet&lt;&#x2F;li&gt;
  &lt;li&gt;Project&lt;&#x2F;li&gt;
  &lt;li&gt;User&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;For projects that were marked as public, events belonging to private versions of all these target types were mistakenly returned by the  &#x2F;api&#x2F;v4&#x2F;users&#x2F;:id&#x2F;events and &#x2F;api&#x2F;v4&#x2F;projects&#x2F;:id&#x2F;events API endpoints. What this means is that the following parts of a public project were exposed:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;Confidential issues&lt;&#x2F;li&gt;
  &lt;li&gt;Private milestones&lt;&#x2F;li&gt;
  &lt;li&gt;Private merge requests&lt;&#x2F;li&gt;
  &lt;li&gt;Private notes&lt;&#x2F;li&gt;
  &lt;li&gt;Private snippets&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;response-and-mitigation&quot;&gt;Response and mitigation&lt;&#x2F;h2&gt;

&lt;p&gt;On September 20, 2018, we learned of the issue from HackerOne security researcher &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;ngalog&#x2F;&quot;&gt;ngalog&lt;&#x2F;a&gt;, who is part of our bounty program, and with whom we have a track record of great engagements. Upon assessing the issue, the GitLab Security Team started working with the Create team to mitigate the issue. Besides working on the fix, the Create team also produced a hotfix, which the Production team deployed for GitLab.com on September 21, 2018. By September 24, 2018, the Production team confirmed that the hotfix was successfully deployed across all affected GitLab.com infrastructure.&lt;&#x2F;p&gt;

&lt;p&gt;The discovery of this issue aligned with the release of our planned Security Release on October 1, 2018. In order to avoid any mishaps with its implementation, we decided proceed with the release as originally planned.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;who-was-impacted&quot;&gt;Who was impacted?&lt;&#x2F;h2&gt;

&lt;p&gt;Given the wide time window during which the issue was present (more than a year), we are unable to determine with accuracy the extent of the impact. While we don’t have any indication that the issue was ever misused, we are also unable to say with any certainty that it hasn’t been.&lt;&#x2F;p&gt;

&lt;p&gt;We investigated four months of retained GitLab.com logs, and found no evidence that unauthorized parties accessed any of your private events.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improvements&quot;&gt;Improvements&lt;&#x2F;h2&gt;

&lt;p&gt;Since the discovery of the issue, a cross-functional effort has been executed at GitLab in order to identify and improve on safeguards that could have helped us identify this issue sooner, respond more quickly, and ensure the reliability of our patched systems. As such, we are working on numerous improvements to our internal processes and practices. This includes the following highlights:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;Our QA process will improve its focus on &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;www-gitlab-com&#x2F;merge_requests&#x2F;14935&#x2F;&quot;&gt;tests related to confidential data&lt;&#x2F;a&gt;.&lt;&#x2F;li&gt;
  &lt;li&gt;Our Engineering team will &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;security&#x2F;issues&#x2F;211&quot;&gt;create a canary system to alarm on unexpected responses and regressions&lt;&#x2F;a&gt; to security issues within GitLab APIs, and our Security team will monitor this canary system in order to triage and mitigate any discovered security issues.&lt;&#x2F;li&gt;
  &lt;li&gt;Our Production and Release teams will &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;gl-infra&#x2F;infrastructure&#x2F;issues&#x2F;5116&quot;&gt;define guardrails around deployments time windows&lt;&#x2F;a&gt;, taking in consideration several factors that might impact our ability to respond promptly to issues that arise during deployments.&lt;&#x2F;li&gt;
  &lt;li&gt;Our Production and Release teams will &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;gl-infra&#x2F;gitlab-patcher&#x2F;issues&#x2F;13&quot;&gt;improve&lt;&#x2F;a&gt; &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;gl-infra&#x2F;gitlab-patcher&#x2F;issues&#x2F;14&quot;&gt;our&lt;&#x2F;a&gt; &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;gl-infra&#x2F;gitlab-patcher&#x2F;issues&#x2F;15&quot;&gt;existing&lt;&#x2F;a&gt; &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-com&#x2F;gl-infra&#x2F;gitlab-patcher&#x2F;issues&#x2F;16&quot;&gt;tooling&lt;&#x2F;a&gt; to address issues that were identified while mitigating this event.&lt;&#x2F;li&gt;
  &lt;li&gt;Several additional improvements that we cannot publicly disclose at this time in order to retain advantage over possible adversaries.&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;We apologize for the impact this issue has caused our users. GitLab takes your information and your data extremely seriously and have more than quadrupled the size our internal security team in the last six months, with further plans to grow. We will learn from this incident and use it to improve upon our security posture even further.&lt;&#x2F;p&gt;

&lt;p&gt;In keeping with our company value of transparency we also believe in communicating about such incidents clearly and promptly. If you have any questions, please contact us via &lt;a href=&quot;https:&#x2F;&#x2F;support.gitlab.com&#x2F;&quot;&gt;support.gitlab.com&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Sincerely,
GitLab Security Team&lt;&#x2F;p&gt;

&lt;p&gt;&lt;em&gt;Updated: 2018-10-11&lt;&#x2F;em&gt;: While generating the list of project owners and
maintainers, further analysis showed limited impact to private projects. For
private projects, the impact is limited to those with &lt;code&gt;Guest&lt;&#x2F;code&gt; users. Users
with only &lt;code&gt;Guest&lt;&#x2F;code&gt; permissions would have potentially been able to view
details for the confidential and private items as described. The owners and
maintainers of affected projects were notified, but this note was not
included in the email or the original version of this blog post.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.2.3, 11.1.6, and 11.0.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/</id>
<published>2018-08-28T00:00:00+00:00</published>
<updated>2018-08-28T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.2.3, 11.1.6, and 11.0.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-pipeline-tooltip&quot;&gt;Persistent XSS in Pipeline Tooltip&lt;&#x2F;h2&gt;

&lt;p&gt;The tooltip of the job inside the CI&#x2F;CD pipeline was not properly sanitized which resulted in a persistent XSS. The issue is now resolved in the latest release and will be assigned a CVE shortly.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;@fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlabcom-gcp-endpoints-exposure&quot;&gt;GitLab.com GCP Endpoints Exposure&lt;&#x2F;h2&gt;

&lt;p&gt;Zeroconf endpoints in Google Cloud Platform (GCP) would have been accessible
via webhooks post-migration. The issue is now resolved in the latest release
for gitlab.com.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;@fransrosen&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;avlidienbrunn&quot;&gt;@avlidienbrunn&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab.com and instances deployed to GCP.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-merge-request-changes-view&quot;&gt;Persistent XSS in Merge Request Changes View&lt;&#x2F;h2&gt;

&lt;p&gt;The Merge Request &lt;code&gt;Changes&lt;&#x2F;code&gt; view was not properly sanitizing certain hunk locations which resulted in a persistent XSS. The issue is now resolved in the latest release and will be assigned a CVE shortly.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;@fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.1 and 11.2.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sensitive-data-disclosure-in-sidekiq-logs&quot;&gt;Sensitive Data Disclosure in Sidekiq Logs&lt;&#x2F;h2&gt;

&lt;p&gt;The project import url credentials were being output to the Sidekiq logs. The issue is now resolved in the latest release and will be assigned a CVE shortly.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;kevinksd&quot;&gt;@kevinksd&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;Johlandabee&quot;&gt;@Johlandabee&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.10.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;missing-csrf-in-system-hooks&quot;&gt;Missing CSRF in System Hooks&lt;&#x2F;h2&gt;

&lt;p&gt;There is a CSRF Vulnerability which allows an attacker to resend requests to multiple hooks. The &quot;resend request&quot; CSRF token is missing. For this reason attacker can trick user of gitlab to perform an unwanted action on a System Hook for which the user is currently authenticated.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sql00&quot;&gt;Lyubomir Tsirkov&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab 2.7.0pre and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;orphaned-upload-files-exposure&quot;&gt;Orphaned Upload Files Exposure&lt;&#x2F;h2&gt;

&lt;p&gt;Through various bugs, it is possible to orphan a project upload file so that it is not tracked by the uploads table. If the project is moved, then it is possible for another user to create a new project with the same path. Exporting that project will contain the orphaned file, and thus exposing data. The issue is now resolved in the latest release and will be assigned a CVE shortly.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.10.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;missing-authorization-control-api-repository-storage&quot;&gt;Missing Authorization Control API Repository Storage&lt;&#x2F;h2&gt;

&lt;p&gt;Regular users are currently able to change the repository storage value using the API. The issue is now resolved in the latest release and will be assigned a CVE shortly.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 8.10 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-barometer&quot;&gt;Upgrade barometer&lt;&#x2F;h2&gt;

&lt;p&gt;This version does not include any new migrations, and should not require any
downtime.&lt;&#x2F;p&gt;

&lt;p&gt;Please be aware that by default the Omnibus packages will stop, run migrations,
and start again, no matter how “big” or “small” the upgrade is. This behavior
can be changed by adding a &lt;a href=&quot;http:&#x2F;&#x2F;docs.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;&lt;code&gt;&#x2F;etc&#x2F;gitlab&#x2F;skip-auto-migrations&lt;&#x2F;code&gt;&lt;&#x2F;a&gt; file,
which is only used for &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;updates&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.1.2, 11.0.5, and 10.8.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/</id>
<published>2018-07-26T00:00:00+00:00</published>
<updated>2018-07-26T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.1.2, 11.0.5, and 10.8.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;markdown-dos&quot;&gt;Markdown DoS&lt;&#x2F;h2&gt;

&lt;p&gt;An &lt;code&gt;11.1.0&lt;&#x2F;code&gt; regression caused Markdown rendering times to slow exponentially, possibly leading to a denial of service. This issue is now resolved in the latest release and is assigned to &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-14601&quot;&gt;CVE-2018-14601&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 11.1.0.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;information-disclosure-prometheus-metrics&quot;&gt;Information Disclosure Prometheus Metrics&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab Prometheus metrics was disclosing private project pathnames. This also affected the Prometheus instances on &lt;code&gt;dashboards.gitlab.com&lt;&#x2F;code&gt;. The issue is now resolved in the latest release and is assigned to &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-14602&quot;&gt;CVE-2018-14602&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;csrf-in-system-hooks&quot;&gt;CSRF in System Hooks&lt;&#x2F;h2&gt;

&lt;p&gt;The &quot;Test&quot; feature of the System Hooks component contained low severity CSRF vulnerability. The issue is now resolved in the latest release and is assigned to &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-14603&quot;&gt;CVE-2018-14603&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;sql00&quot;&gt;Lyubomir Tsirkov&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 2.7.0pre and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-pipeline-tooltip&quot;&gt;Persistent XSS Pipeline Tooltip&lt;&#x2F;h2&gt;

&lt;p&gt;The tooltip of the job inside the CI&#x2F;CD pipeline was not properly sanitized and resulted in a persistent XSS. The issue is now resolved in the latest release and is assigned to &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-14604&quot;&gt;CVE-2018-14604&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;@fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-branch-name-via-web-ide&quot;&gt;Persistent XSS in Branch Name via Web IDE&lt;&#x2F;h2&gt;

&lt;p&gt;The branch name was not properly sanitized when committing a file via the Web IDE which resulted in a persistent XSS. The issue is now resolved in the latest release and is assigned to &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-14605&quot;&gt;CVE-2018-14605&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;@fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.7 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-milestone-promotion&quot;&gt;Persistent XSS Milestone Promotion&lt;&#x2F;h2&gt;

&lt;p&gt;When promoting a Milestone, the name of the Milestone is not sanitized properly which results in the notification to trigger a persistent XSS. The issue is now resolved in the latest release and is assigned to &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-14606&quot;&gt;CVE-2018-14606&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;@fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.6 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;mattermost-updates&quot;&gt;Mattermost Updates&lt;&#x2F;h2&gt;

&lt;p&gt;Mattermost has been updated to version 5.0.2, and it contains a security fix that&#x27;s also been backported to 4.10.2.&lt;&#x2F;p&gt;

&lt;p&gt;For more information, see &lt;a href=&quot;https:&#x2F;&#x2F;about.mattermost.com&#x2F;security-updates&#x2F;&quot;&gt;Mattermost security updates page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 11.0.4, 10.8.6, and 10.7.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/</id>
<published>2018-07-17T00:00:00+00:00</published>
<updated>2018-07-17T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.0.4, 10.8.6, and 10.7.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;remote-code-execution-vulnerability-in-gitlab-projects-import&quot;&gt;Remote Code Execution Vulnerability in GitLab Projects Import&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab projects import component contained a vulnerability which allowed an attacker to write files to arbitrary directories on the server and that could result in remote code execution. The vulnerability has now been mitigated and is assigned to &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-14364&quot;&gt;CVE-2018-14364&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.9.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;additional-workarounds&quot;&gt;Additional Workarounds&lt;&#x2F;h3&gt;
&lt;ol&gt;
  &lt;li&gt;Go to &lt;code&gt;&#x2F;admin&#x2F;application_settings&lt;&#x2F;code&gt; of your GitLab instance.&lt;&#x2F;li&gt;
  &lt;li&gt;Under &quot;Import sources&quot;, uncheck the &quot;GitLab export&quot; checkbox.&lt;&#x2F;li&gt;
  &lt;li&gt;Click &lt;code&gt;Save&lt;&#x2F;code&gt;.&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 11.0.1, 10.8.5, and 10.7.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/</id>
<published>2018-06-25T00:00:00+00:00</published>
<updated>2018-06-25T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 11.0.1, 10.8.5, and 10.7.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;wiki-xss&quot;&gt;Wiki XSS&lt;&#x2F;h2&gt;

&lt;p&gt;The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature. The issue is now resolved in the latest release. It has been assigned to &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-12606&quot;&gt;CVE-2018-12606&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;@fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 7.11 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sanitize-gem-updates&quot;&gt;Sanitize gem updates&lt;&#x2F;h2&gt;

&lt;p&gt;The sanitize gem is updated to version 4.6.4 due to versions &amp;lt; 4.6.3 being affected by &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-3740&quot;&gt;CVE-2018-3740&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 6.8.0 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-in-url_forparams&quot;&gt;XSS in url_for(params)&lt;&#x2F;h2&gt;

&lt;p&gt;The usage of &lt;code&gt;url_for&lt;&#x2F;code&gt; contained a XSS issue due to it allowing arbitrary protocols as a parameter. The issue is now resolved in the latest release. It has been assigned to &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-12605&quot;&gt;CVE-2018-12605&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.7 only. This is already fixed in 10.8 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;content-injection-via-username&quot;&gt;Content injection via username&lt;&#x2F;h2&gt;

&lt;p&gt;The username field contained an input validation issue which resulted in HTML content injection on several pages and could lead to phishing attacks. The issue is now resolved in the latest release.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to @talaohu28 for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 4.1 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;activity-feed-publicly-displaying-internal-project-names&quot;&gt;Activity feed publicly displaying internal project names&lt;&#x2F;h2&gt;

&lt;p&gt;The activity feed was disclosing membership and project-level events of internal projects, even when logged out. The issue is now resolved in the latest release.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;ppjet6&quot;&gt;@ppjet6&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.7 - 11.0.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-charts&quot;&gt;Persistent XSS in charts&lt;&#x2F;h2&gt;

&lt;p&gt;The charts feature contained a persistent XSS issue due to a lack of output encoding. The issue is now resolved in the latest release. It has been assigned to &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-12607&quot;&gt;CVE-2018-12607&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;@fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.5 and later.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 10.8.2, 10.7.5, and 10.6.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/</id>
<published>2018-05-29T00:00:00+00:00</published>
<updated>2018-05-29T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 10.8.2, 10.7.5, and 10.6.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;git-updates&quot;&gt;Git updates&lt;&#x2F;h2&gt;

&lt;p&gt;We&#x27;ve included updated Git security versions 2.16.4 and 2.14.4 in this latest release for 10.8.2, 10.7.5, and 10.6.6.&lt;&#x2F;p&gt;

&lt;p&gt;For more information, see &lt;a href=&quot;https:&#x2F;&#x2F;public-inbox.org&#x2F;git&#x2F;xmqqy3g2flb6.fsf@gitster-ct.c.googlers.com&#x2F;&quot;&gt;Git release notes&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;removing-public-deploy-keys-regression&quot;&gt;Removing public deploy keys regression&lt;&#x2F;h2&gt;

&lt;p&gt;The &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;api&#x2F;deploy_keys.html#delete-deploy-key&quot;&gt;delete deploy key&lt;&#x2F;a&gt; operation contained a security issue which could allow an attacker to delete shared deploy keys. The issue is now resolved in the latest release.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to Christian Seelheim for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.1.6 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;users-can-update-their-password-without-entering-current-password&quot;&gt;Users can update their password without entering current password&lt;&#x2F;h2&gt;

&lt;p&gt;The settings page contained an unverified password change weakness which could&#x27;ve been used to reset a user&#x27;s password without knowing the user&#x27;s current password. This only worked if either the attacker had hijacked a victim&#x27;s session or had access to a victim&#x27;s email address to intercept a password reset token.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;jobertabma&quot;&gt;Jobert&lt;&#x2F;a&gt; via &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;HackerOne&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 1.0 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss---selecting-users-as-allowed-merge-request-approvers&quot;&gt;Persistent XSS - Selecting users as allowed merge request approvers&lt;&#x2F;h2&gt;

&lt;p&gt;The merge request approvers dropdown in GitLab EE contained a persistent xss issue which is now resolved in the latest release.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;phillycheeze&quot;&gt;phillycheeze&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 9.1 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss---multiple-locations-of-user-selection-drop-downs&quot;&gt;Persistent XSS - Multiple locations of user selection drop downs&lt;&#x2F;h2&gt;

&lt;p&gt;The user select drop down contained a persistent xss issue in GitLab EE which is now resolved in the latest release.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;phillycheeze&quot;&gt;phillycheeze&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 9.1 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;include-directive-in-gitlab-ciyml-allows-ssrf-requests&quot;&gt;&lt;code&gt;include&lt;&#x2F;code&gt; directive in .gitlab-ci.yml allows SSRF requests&lt;&#x2F;h2&gt;

&lt;p&gt;Arbitrary GET request could be performed against internal resources due to &lt;code&gt;include&lt;&#x2F;code&gt; directive in .gitlab-ci.yml. Data exfiltration potential is limited to resources that respond with a YAML file following certain constraints. This issue is now resolved in the latest release.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab EE 10.5 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;permissions-issue-in-merge-requests-create-service&quot;&gt;Permissions issue in Merge Requests Create Service&lt;&#x2F;h2&gt;

&lt;p&gt;Users which were not project members could create merge requests via a fork for internal projects. This issue is now resolved in the latest release.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.6.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;arbitrary-assignment-of-project-fields-using-import-project&quot;&gt;Arbitrary assignment of project fields using &quot;Import project&quot;&lt;&#x2F;h2&gt;

&lt;p&gt;Any project model database column can be controlled on import by fields in the &lt;code&gt;project.json&lt;&#x2F;code&gt; of an exported project. This issue is now resolved in the latest release.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;jobertabma&quot;&gt;Jobert&lt;&#x2F;a&gt; via &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;HackerOne&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 10.4 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>Summary of limited download archive unauthorized access of repositories on GitLab.com</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/05/02/download-archive-security-vulnerability/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/05/02/download-archive-security-vulnerability/</id>
<published>2018-05-02T00:00:00+00:00</published>
<updated>2018-05-02T00:00:00+00:00</updated>
<author>
<name>Kathy Wang</name>
</author>
<content type='html'>&lt;h2 id=&quot;summary&quot;&gt;Summary&lt;&#x2F;h2&gt;

&lt;p&gt;From April 17, 2018 to April 24, 2018, a limited number of public and private repositories may have been inadvertently downloaded by unauthorized users on GitLab.com. GitLab user Lee Pugh notified us of this issue on April 23, 2018. The affected users represent 0.04 percent of our GitLab.com user base. While files generated by users would be unique for that repository, a recent change to support a use case to download the latest copy of the repository with the same filename inadvertently introduced this vulnerability.&lt;&#x2F;p&gt;

&lt;p&gt;This vulnerability affected GitLab.com users, and was mitigated as of April 23, 2018. None of the our on-prem users are affected by this vulnerability. We have notified the affected users via email, and are implementing a series of security enhancements to prevent such issues from happening again.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;accidental-unauthorized-access-of-download-archives&quot;&gt;Accidental unauthorized access of download archives&lt;&#x2F;h2&gt;

&lt;p&gt;From April 17, 2018 to April 24, 2018, a subset of GitLab.com users were potentially affected by a security vulnerability where a limited number of public and private repositories may have been inadvertently downloaded by unauthorized users.&lt;&#x2F;p&gt;

&lt;p&gt;Prior to v10.7.0, a unique hash value was always included in the request for the archive file  to processed by Workhorse, the subsystem responsible for performing slower operations on Git repositories. This meant any file generated by the user would generally be unique for that repository. With the release of v10.7.0, the &lt;code&gt;append_sha&lt;&#x2F;code&gt; parameter was made optional. The motivation of the change was to support the use case where the latest copy of the repository could be downloaded with the same filename.&lt;&#x2F;p&gt;

&lt;p&gt;However, this introduced a problem - a repository download archive request without this parameter will return the ArchivePath value without a unique ID. As a result of this change, an archive request for a second project with the same name will point to the same archive file. This vulnerability was mitigated in production within hours of discovery by disabling feature flags controlling the caching behavior. The vulnerability has been patched in the &lt;a href=&quot;&#x2F;releases&#x2F;2018&#x2F;04&#x2F;30&#x2F;security-release-gitlab-10-dot-7-dot-2-released&#x2F;&quot;&gt;latest Security Release&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;impact&quot;&gt;Impact&lt;&#x2F;h2&gt;

&lt;p&gt;There is no evidence of malicious activity for the accidental unauthorized access of download archives. However, the detailed audit logs for our log aggregator only cover part of the seven days in question. Potentially affected users have received email notifications accordingly. Although there is no evidence to suggest it happened, in the worst case, a private repository could have been accidentally downloaded.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;mitigations&quot;&gt;Mitigations&lt;&#x2F;h2&gt;

&lt;p&gt;Since the discovery, we have worked to investigate and mitigate all of these related security issues. We are continually improving our security processes and logging mechanisms to ensure that similar incidents will not occur again. These improvements include:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;Increase logging retention periods&lt;&#x2F;li&gt;
  &lt;li&gt;Fine-grain access controls to all logging infrastructure&lt;&#x2F;li&gt;
  &lt;li&gt;Add unit&#x2F;integration tests to ensure consistent coding practices&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;If your project or account is potentially affected by this security issue, you will receive an email notification listing affected projects.&lt;&#x2F;p&gt;

&lt;p&gt;We apologize for the impact this issue has caused our users. GitLab takes your information and your data extremely seriously. We will learn from this incident and use it to improve upon our security even further.&lt;&#x2F;p&gt;

&lt;p&gt;In keeping with our company value of transparency we also believe in communicating about such incidents clearly and promptly. If you have any questions, please contact &lt;a href=&quot;&amp;#109;&amp;#097;&amp;#105;&amp;#108;&amp;#116;&amp;#111;:&amp;#115;&amp;#101;&amp;#099;&amp;#117;&amp;#114;&amp;#105;&amp;#116;&amp;#121;&amp;#064;&amp;#103;&amp;#105;&amp;#116;&amp;#108;&amp;#097;&amp;#098;&amp;#046;&amp;#099;&amp;#111;&amp;#109;&quot;&gt;&amp;#115;&amp;#101;&amp;#099;&amp;#117;&amp;#114;&amp;#105;&amp;#116;&amp;#121;&amp;#064;&amp;#103;&amp;#105;&amp;#116;&amp;#108;&amp;#097;&amp;#098;&amp;#046;&amp;#099;&amp;#111;&amp;#109;&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 10.7.2, 10.6.5, and 10.5.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released/</id>
<published>2018-04-30T00:00:00+00:00</published>
<updated>2018-04-30T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 10.7.2, 10.6.5, and 10.5.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-move-issue-using-project-namespace&quot;&gt;Persistent XSS in &#x27;Move Issue&#x27; using project namespace&lt;&#x2F;h2&gt;

&lt;p&gt;The &lt;code&gt;Move Issue&lt;&#x2F;code&gt; feature contained a persistent XSS vulnerability that is now resolved in the latest release. This issue has been assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-10379&quot;&gt;CVE-2018-10379&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.5 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;download-archive-allowing-unauthorized-private-repo-access&quot;&gt;Download Archive allowing unauthorized private repo access&lt;&#x2F;h2&gt;

&lt;p&gt;The &lt;code&gt;Download Archive&lt;&#x2F;code&gt; feature contained an improper authorization issue which is fixed in this release. Affected users will receive an email notification, and a separate blog post will be published with further details regarding this issue and its impact.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;mattermost-updates&quot;&gt;Mattermost Updates&lt;&#x2F;h2&gt;

&lt;p&gt;We&#x27;ve included respective Mattermost security versions in 10.5 and 10.6. The omnibus-gitlab package for 10.7.0, already contains the Mattermost security update.&lt;&#x2F;p&gt;

&lt;p&gt;For more information, see &lt;a href=&quot;https:&#x2F;&#x2F;about.mattermost.com&#x2F;security-updates&#x2F;&quot;&gt;Mattermost security updates page&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 10.6.3, 10.5.7, and 10.4.7</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/</id>
<published>2018-04-04T00:00:00+00:00</published>
<updated>2018-04-04T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 10.6.3, 10.5.7, and 10.4.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;confidential-issue-comments-in-slack-mattermost-and-webhook-integrations&quot;&gt;Confidential issue comments in Slack, Mattermost, and webhook integrations&lt;&#x2F;h2&gt;

&lt;p&gt;Comments on confidential issues were previously sent to webhooks and integrations when notifications were configured to send notes or comments. This applied to custom webhooks, Slack, and Mattermost notifications.&lt;&#x2F;p&gt;

&lt;p&gt;We&#x27;ve introduced a new option to control the sending of confidential notes as well as an option for specifying a different channel for Slack and Mattermost.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.6 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-milestones-data-milestone-id&quot;&gt;Persistent XSS in milestones data-milestone-id&lt;&#x2F;h2&gt;

&lt;p&gt;The milestone dropdown feature contained a persistent XSS issue that is now resolved in the latest release. This issue has been assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-9244&quot;&gt;CVE-2018-9244&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 9.2 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-in-filename-of-merge-request&quot;&gt;Persistent XSS in filename of merge request&lt;&#x2F;h2&gt;

&lt;p&gt;Filenames in the changes tab contained a persistent XSS issue that is now resolved in the latest release. This issue has been assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-9243&quot;&gt;CVE-2018-9243&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;fransrosen&quot;&gt;fransrosen&lt;&#x2F;a&gt; for responsibly reporting this vulnerability to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;p&gt;Affects GitLab CE&#x2F;EE 8.4 and up.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-barometer&quot;&gt;Upgrade barometer&lt;&#x2F;h2&gt;

&lt;p&gt;This release includes one database migration, which can be run without downtime. This migration adds a column to the
&lt;code&gt;services&lt;&#x2F;code&gt; table. Another background migration is launched to populate this value.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>Summary of limited GitLab credentials exposed in an internal logging system</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/03/26/summary-of-limited-gitlab-credentials-exposed/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/03/26/summary-of-limited-gitlab-credentials-exposed/</id>
<published>2018-03-26T00:00:00+00:00</published>
<updated>2018-03-26T00:00:00+00:00</updated>
<author>
<name>Kathy Wang</name>
</author>
<content type='html'>&lt;h2 id=&quot;summary&quot;&gt;Summary&lt;&#x2F;h2&gt;

&lt;p&gt;From February 19, 2018 to March 19, 2018, some GitLab.com personal access tokens and third-party credentials were inadvertently exposed publicly via an unprotected logging dashboard. The affected users represent approximately 0.5 percent of our GitLab.com user base. While the dashboard was originally protected from unauthorized access, a recent configuration change made this internal system publically accessible.&lt;&#x2F;p&gt;


&lt;p&gt;Upon further review, we discovered a limited number of tokens and third-party credentials were incorrectly stored in this system. We’ve already mitigated all issues that led to this exposure. Our audit logs only cover a portion of the time the dashboard was exposed, but only one login resulted in a deep query that resulted in a personal access token being exposed. This activity was positively linked to the user that immediately disclosed the issue to us. As such, we have no evidence that any of the affected credentials were used in a malicious manner.&lt;&#x2F;p&gt;

&lt;p&gt;We have notified the affected users via email to update their credentials and are implementing a series of security enhancements to prevent such issues from happening again. Note that self-managed GitLab customers are entirely unaffected, as their credentials are stored in their own database and this logging functionality is off by default in self-managed instances.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;credentials-written-to-logs&quot;&gt;Credentials written to logs&lt;&#x2F;h2&gt;

&lt;p&gt;On February 28, 2018 we discovered internally that GitLab’s Gitaly service was, in certain circumstances, mishandling the sanitization of private third-party credentials for push-mirrored and imported repositories. These unscrubbed credentials were then sent to our logging system (ELK) and our exception management system (Sentry).&lt;&#x2F;p&gt;

&lt;p&gt;During the investigation, we realized that some other credentials were also leaking into our HAProxy load balancers logs. These were personal access tokens used for GitLab API access when passed via query parameters in an HTTP request. Additionally, credentials that allow access to some third-party Git repositories were leaked into the logs. These have been fixed in the following:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitaly&#x2F;merge_requests&#x2F;624&quot;&gt;Sanitize URLs before logging them&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-cookbooks&#x2F;gitlab_fluentd&#x2F;merge_requests&#x2F;7&quot;&gt;Sanitize private_token field in HA Proxy logs&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;&lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-cookbooks&#x2F;gitlab-oauth2-proxy&#x2F;merge_requests&#x2F;10&quot;&gt;Reconfigure OAuth mechanism, removing ‘*’ email domain access&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h2 id=&quot;exposure-of-logs&quot;&gt;Exposure of logs&lt;&#x2F;h2&gt;

&lt;p&gt;On March 19, 2018, GitLab user Ryan Hefner discovered an authentication misconfiguration on our internal logging dashboard. A configuration change was made incorrectly on February 19, 2018, which resulted in potential public read-only access to the centralized, internal logging server for GitLab. This misconfiguration was resolved immediately upon notification.&lt;&#x2F;p&gt;

&lt;p&gt;GitLab uses an OAuth proxy service to authenticate all access to our internal logging infrastructure. Previously, this proxy service had been correctly configured to only allow access to authorized GitLab engineers. However, in the course of migrating this proxy service to our new cloud infrastructure, we inadvertently introduced a misconfiguration that allowed anyone with a valid Google account read-only access to our internal logging server, instead of the intended behavior of allowing only authorized GitLab engineering accounts.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;impact&quot;&gt;Impact&lt;&#x2F;h2&gt;

&lt;p&gt;There is no evidence of user credential abuse. However, the audit logs for the dashboard only cover seven of the 30 days in question. The only audit log activity accessing sensitive information was from the user that immediately reported the issue to GitLab. We found no evidence of abuse against the API itself. Regardless, we are taking every precaution, and strongly recommending all affected Gitlab.com users rotate their personal access tokens. Affected users have received further instructions via email notifications, accordingly.&lt;&#x2F;p&gt;

&lt;p&gt;Although there is no evidence to suggest it happened, in the worst case an attacker could have gained access and obtained personal access tokens used in API calls between February 19, 2018 and March 19, 2018.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;mitigations&quot;&gt;Mitigations&lt;&#x2F;h2&gt;

&lt;p&gt;Since the discovery, we have worked to investigate and mitigate all of these related security issues. We are continually improving our security processes and logging mechanisms to ensure that similar incidents will not occur again. These improvements are:&lt;&#x2F;p&gt;

&lt;ul&gt;
  &lt;li&gt;Increase logging retention periods&lt;&#x2F;li&gt;
  &lt;li&gt;Fine-grain access controls to all logging infrastructure&lt;&#x2F;li&gt;
  &lt;li&gt;Regular, periodic audits of all our logs&lt;&#x2F;li&gt;
  &lt;li&gt;Adding mandatory review of any security-relevant changes by a GitLab Application Security engineer&lt;&#x2F;li&gt;
  &lt;li&gt;Document this process in our runbooks to ensure repeatability&lt;&#x2F;li&gt;
  &lt;li&gt;An additional measure we won&#x27;t disclose because informing adversaries could render it less effective&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;If your project or account is affected by this security issue, you will receive an email notification listing affected projects with steps to rotate your personal access tokens. To proactively change them visit this page: &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;profile&#x2F;personal_access_tokens&quot;&gt;https:&#x2F;&#x2F;gitlab.com&#x2F;profile&#x2F;personal_access_tokens&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;We apologize for the impact this issue has caused our users. GitLab takes your information and your data extremely seriously. We have quadrupled the size of our internal security team in the last six months and have further plans to grow. We will learn from this incident and use it to improve upon our security even further.&lt;&#x2F;p&gt;

&lt;p&gt;In keeping with our company value of transparency we also believe in communicating about such incidents clearly and promptly. If you have any questions, please contact &lt;a href=&quot;&amp;#109;&amp;#097;&amp;#105;&amp;#108;&amp;#116;&amp;#111;:&amp;#115;&amp;#101;&amp;#099;&amp;#117;&amp;#114;&amp;#105;&amp;#116;&amp;#121;&amp;#064;&amp;#103;&amp;#105;&amp;#116;&amp;#108;&amp;#097;&amp;#098;&amp;#046;&amp;#099;&amp;#111;&amp;#109;&quot;&gt;&amp;#115;&amp;#101;&amp;#099;&amp;#117;&amp;#114;&amp;#105;&amp;#116;&amp;#121;&amp;#064;&amp;#103;&amp;#105;&amp;#116;&amp;#108;&amp;#097;&amp;#098;&amp;#046;&amp;#099;&amp;#111;&amp;#109;&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Critical Security Release: 10.5.6, 10.4.6, and 10.3.9</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/</id>
<published>2018-03-20T00:00:00+00:00</published>
<updated>2018-03-20T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 10.5.6, 10.4.6, and 10.3.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;The vulnerability details will be made public on our issue tracker in approximately 30 days.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more information regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ssrf-in-services-and-web-hooks&quot;&gt;SSRF in services and web hooks&lt;&#x2F;h2&gt;

&lt;p&gt;There were multiple server-side request forgery issues in the Services feature. An attacker could make requests to servers within the same network of the GitLab instance. This could lead to information disclosure, authentication bypass, or potentially code execution. This issue has been assigned &lt;a href=&quot;https:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2018-8801&quot;&gt;CVE-2018-8801&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;jobertabma&quot;&gt;@jobert&lt;&#x2F;a&gt; from &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;HackerOne&lt;&#x2F;a&gt; for reporting this.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;Affects GitLab CE&#x2F;EE 8.3 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-auth0-integration-issue&quot;&gt;Gitlab Auth0 integration issue&lt;&#x2F;h2&gt;

&lt;p&gt;There was an issue with the GitLab &lt;code&gt;omniauth-auth0&lt;&#x2F;code&gt; configuration which resulted in the Auth0 integration signing in the wrong users.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;trondhindenes&quot;&gt;Trond Hindenes&lt;&#x2F;a&gt; for reporting this issue.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;Affects GitLab CE 8.6 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;update-2018-03-21-700pm-utc&quot;&gt;Update (2018-03-21 7:00PM UTC)&lt;&#x2F;h4&gt;

&lt;p&gt;In order to address the SSRF issue, we created a new checkbox setting to allow outbound requests to local networks (IPv4 and IPv6 private address ranges). This is currently unchecked by default.&lt;&#x2F;p&gt;

&lt;p&gt;The setting is located in &lt;code&gt;Admin area-&amp;gt;Settings-&amp;gt;Outbound Requests&lt;&#x2F;code&gt;. If you need to allow outbound requests to your local network for hooks and services, please enable this checkbox. Note that by checking this, your GitLab instance will be vulnerable to the SSRF issue mentioned above.&lt;&#x2F;p&gt;

&lt;p&gt;To provide a more flexible and improved solution, we may add a configurable whitelist at a future date.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;update-2018-03-23-900am-utc&quot;&gt;Update (2018-03-23 9:00AM UTC)&lt;&#x2F;h4&gt;

&lt;p&gt;If you are currently using Auth0, the configuration will need to be updated slightly.&lt;&#x2F;p&gt;

&lt;p&gt;Check the &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;integration&#x2F;auth0.html&quot;&gt;Auth0 integration documentation&lt;&#x2F;a&gt; for the correct syntax.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>Announcing March 20, 2018 Critical Security Update</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/03/16/gitlab-critical-release-preannouncement/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/03/16/gitlab-critical-release-preannouncement/</id>
<published>2018-03-16T00:00:00+00:00</published>
<updated>2018-03-16T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;On Tuesday, March 20th, 2018 at 23:59 UTC, we will publish a critical GitLab
security update. More details will be forthcoming on &lt;a href=&quot;&#x2F;blog&#x2F;&quot;&gt;our blog&lt;&#x2F;a&gt;, including which
versions of GitLab are affected.&lt;&#x2F;p&gt;

&lt;p&gt;We recommend installations running affected versions to upgrade
immediately. Please forward this alert to the appropriate people at your
organization and have them subscribe to &lt;a href=&quot;&#x2F;company&#x2F;contact&#x2F;#security-notices&quot;&gt;Security Notices&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;


&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 10.5.3, 10.4.5, 10.3.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/03/06/security-10-5-3-plus-10-4-5-plus-10-3-8-1st-blog-post/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/03/06/security-10-5-3-plus-10-4-5-plus-10-3-8-1st-blog-post/</id>
<published>2018-03-06T00:00:00+00:00</published>
<updated>2018-03-06T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 10.5.3, 10.4.5, and 10.3.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;


&lt;p&gt;This security release blog post is the first part of two. The second blog will be posted in approximately 30 days, and it will detail the vulnerability findings.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more details regarding this release.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;2fa-weakness&quot;&gt;2FA weakness&lt;&#x2F;h2&gt;

&lt;p&gt;The two factor authentication feature contained a security weakness
potentially resulting in abuse of recovery codes.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 7.4.0 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;geo-failover-weak-file-permissions&quot;&gt;Geo: failover weak file permissions&lt;&#x2F;h2&gt;

&lt;p&gt;A weak file permissions issue affecting the GitLab Geo feature was discovered which could potentially result in low-privileged users triggering a failover.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab EE 8.7.0 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;For existing installations, you will need to edit the PostgreSQL &lt;code&gt;recovery.conf&lt;&#x2F;code&gt; file (in Omnibus GitLab it&#x27;s located at &lt;code&gt;&#x2F;var&#x2F;opt&#x2F;gitlab&#x2F;postgresql&#x2F;data&#x2F;recovery.conf&lt;&#x2F;code&gt;) for all Geo secondary nodes:&lt;&#x2F;p&gt;

&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight ruby&quot;&gt;&lt;code&gt;&lt;span class=&quot;n&quot;&gt;trigger_file&lt;&#x2F;span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;&#x2F;span&gt; &lt;span class=&quot;s1&quot;&gt;&#x27;&#x2F;tmp&#x2F;postgresql.trigger&#x27;&lt;&#x2F;span&gt; &lt;span class=&quot;c1&quot;&gt;# &amp;lt;- remove this line&lt;&#x2F;span&gt;
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;p&gt;We strongly recommend that all installations running an affected version above be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;open-redirect-gitlab-pages&quot;&gt;Open redirect GitLab Pages&lt;&#x2F;h2&gt;

&lt;p&gt;An open redirect issue was discovered on GitLab Pages which could result in assisting phishing campaigns to have a more trustworthy appearance.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;pankajj736&quot;&gt;pankajj736&lt;&#x2F;a&gt; on HackerOne for reporting this issue.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 10.3 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-authorization-group-lock&quot;&gt;Improper authorization group lock&lt;&#x2F;h2&gt;

&lt;p&gt;The group lock feature contained an improper authorization issue which could result in accidental sharing of a project.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 9.5 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;push-rules-denial-of-service&quot;&gt;Push rules denial of service&lt;&#x2F;h2&gt;

&lt;p&gt;A lack of input validation issue was discovered in the push rules feature which could result in a denial of service of the platform.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab EE 9.1 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-barometer&quot;&gt;Upgrade barometer&lt;&#x2F;h2&gt;

&lt;p&gt;Please be aware that by default the Omnibus packages will stop, run migrations,
and start again, no matter how “big” or “small” the upgrade is. This behavior
can be changed by adding a &lt;a href=&quot;http:&#x2F;&#x2F;doc.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;&lt;code&gt;&#x2F;etc&#x2F;gitlab&#x2F;skip-auto-migrations&lt;&#x2F;code&gt; file&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-ids&quot;&gt;CVE IDs&lt;&#x2F;h3&gt;

&lt;p&gt;We are working on obtaining CVE numbers for these vulnerabilities and will update the blog post accordingly when we&#x27;ve obtained that information.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Pages Security Fix Notification</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/02/21/pages-security-fix-rollout/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/02/21/pages-security-fix-rollout/</id>
<published>2018-02-21T00:00:00+00:00</published>
<updated>2018-02-21T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;On February 5, we disabled the ability to add custom domains in GitLab Pages due to security concerns. Today, we have re-enabled that ability after deploying a feature that requires GitLab.com users to verify ownership of the domains. Users can now once again configure domains and update TLS certificates.&lt;&#x2F;p&gt;


&lt;p&gt;To learn more about the original issue please view the &lt;a href=&quot;&#x2F;releases&#x2F;2018&#x2F;02&#x2F;05&#x2F;gitlab-pages-custom-domain-validation&#x2F;&quot;&gt;previous post&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h1 id=&quot;user-impact&quot;&gt;User impact&lt;&#x2F;h1&gt;

&lt;p&gt;Upon adding a custom domain to their Pages site, users are now &lt;strong&gt;required&lt;&#x2F;strong&gt; to verify domain ownership by adding a DNS TXT record containing a token generated by GitLab. This ensures the domain is controlled by that user when GitLab Pages checks for the existence of that TXT record containing the token. When updating DNS records, it may take time for it to fully propagate (sometimes up to 24-48 hours).&lt;&#x2F;p&gt;

&lt;p&gt;Once a custom domain has been added and verified, GitLab Pages will periodically need to re-verify these TXT records. This is handled automatically and is necessary for validating the user maintains ownership of that domain.&lt;&#x2F;p&gt;

&lt;p&gt;Current custom domain users will be &lt;strong&gt;required&lt;&#x2F;strong&gt; to verify ownership of their existing domain within a 30-day grace period.&lt;&#x2F;p&gt;

&lt;p&gt;Unverified custom domains cannot be claimed by a repository. If previously claimed and unable to be re-verified within 7 days, the custom domain will be relinquished.&lt;&#x2F;p&gt;

&lt;h1 id=&quot;timeline-of-issues-and-mitigation&quot;&gt;Timeline of issues and mitigation&lt;&#x2F;h1&gt;

&lt;ul&gt;
  &lt;li&gt;
    &lt;p&gt;2017-12-11 - HackerOne Researcher bnchandrapal discloses &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;reports&#x2F;296907&quot;&gt;first report&lt;&#x2F;a&gt;, we decide not to fix anything at this time.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;2018-02-01 - GitLab and HackerOne Researcher bnchandrapal agree to publicly disclose the &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;reports&#x2F;296907&quot;&gt;first report&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;2018-02-04 - HackerOne Researcher &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;edoverflow&quot;&gt;edoverflow&lt;&#x2F;a&gt; submits &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;reports&#x2F;312118&quot;&gt;second report&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;2018-02-05 - GitLab posts &lt;a href=&quot;&#x2F;releases&#x2F;2018&#x2F;02&#x2F;05&#x2F;gitlab-pages-custom-domain-validation&#x2F;&quot;&gt;blog post&lt;&#x2F;a&gt; to inform customers of the &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;reports&#x2F;296907&quot;&gt;security issue and current plan&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;2018-02-08 - GitLab awards HackerOne researcher &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;edoverflow&quot;&gt;edoverflow&lt;&#x2F;a&gt; a high severity bounty for the &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;reports&#x2F;312118&quot;&gt;second report&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;2018-02-12 - &lt;a href=&quot;https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=16358544&quot;&gt;HackerNews reports&lt;&#x2F;a&gt; on the GitLab blog post.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;2018-02-12 - GitLab awards HackerOne researcher bnchandrapal a high severity bounty for the &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;reports&#x2F;296907&quot;&gt;first report&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;2018-02-20 - Per blog post, GitLab planned to roll out the domain ownership verification mechanism to mitigate the &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;reports&#x2F;296907&quot;&gt;first report&lt;&#x2F;a&gt;; however, the fix requires additional testing&#x2F;verification.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;2018-02-21 - GitLab makes &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;reports&#x2F;312118&quot;&gt;second report&lt;&#x2F;a&gt; by researcher &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;edoverflow&quot;&gt;edoverflow&lt;&#x2F;a&gt; public.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;2018-02-21 - GitLab begins phased rollout of domain ownership verification mechanism.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
  &lt;li&gt;
    &lt;p&gt;2018-03-01 - Estimated date of completion for the domain ownership verification mechanism rollout.&lt;&#x2F;p&gt;
  &lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 10.4.3, 10.3.7, and 10.2.8</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/</id>
<published>2018-02-07T00:00:00+00:00</published>
<updated>2018-02-07T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 10.4.3, 10.3.7, and 10.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;This security release blog post is the first part of two. The second blog will be posted in approximately 30 days, and it will detail the vulnerability findings.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more details regarding this release.&lt;&#x2F;p&gt;


&lt;h2 id=&quot;snippetfinder-information-disclosure&quot;&gt;SnippetFinder information disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab SnippetFinder component contained an information disclosure which allowed access to snippets restricted to &lt;code&gt;Only team members&lt;&#x2F;code&gt; or configured as &lt;code&gt;disabled&lt;&#x2F;code&gt;. The issue is now resolved in the latest version.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 7.4.0 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;ldap-api-authorization-issue&quot;&gt;LDAP API authorization issue&lt;&#x2F;h2&gt;

&lt;p&gt;An LDAP API endpoint contained an authorization vulnerability which unintentionally disclosed bulk LDAP groups data. This issue is now fixed in the latest release.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;jobertabma&quot;&gt;Jobert Abma&lt;&#x2F;a&gt; of &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;HackerOne&lt;&#x2F;a&gt; for responsibly disclosing this issue to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 6.1.0 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;persistent-xss-mermaid-markdown&quot;&gt;Persistent XSS mermaid markdown&lt;&#x2F;h2&gt;

&lt;p&gt;The mermaid markdown feature contained a persistent XSS issue that is now resolved in the latest release.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;totally_unknown&quot;&gt;Nils Juenemann&lt;&#x2F;a&gt; for responsibly disclosing this issue to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 10.3 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;insecure-direct-object-reference-todo-api&quot;&gt;Insecure direct object reference Todo API&lt;&#x2F;h2&gt;

&lt;p&gt;The Todo API was vulnerable to an insecure direct object reference issue which resulted in an information disclosure of confidential data.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;jobertabma&quot;&gt;Jobert Abma&lt;&#x2F;a&gt; of &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;HackerOne&lt;&#x2F;a&gt; for responsibly disclosing this issue to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 9.5 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;github-import-access-control-issue&quot;&gt;GitHub import access control issue&lt;&#x2F;h2&gt;

&lt;p&gt;An improper access control weakness issue was discovered in the GitHub import feature. The issue allowed an attacker to create projects under other accounts which they shouldn&#x27;t have access to. The issue is now resolved in the latest version.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;jobertabma&quot;&gt;Jobert Abma&lt;&#x2F;a&gt; of &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;HackerOne&lt;&#x2F;a&gt; for responsibly disclosing this issue to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 9.1 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;protected-variables-information-disclosure&quot;&gt;Protected variables information disclosure&lt;&#x2F;h2&gt;

&lt;p&gt;The CI jobs protected tag feature contained a vulnerability which resulted in an information disclosure of protected variables. The issue is now resolved in the latest release.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to Wes Cossick of &lt;a href=&quot;https:&#x2F;&#x2F;www.sparksuite.com&#x2F;&quot;&gt;Sparksuite&lt;&#x2F;a&gt; for responsibly disclosing this issue to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 9.1 and up&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-barometer&quot;&gt;Upgrade barometer&lt;&#x2F;h2&gt;

&lt;p&gt;Please be aware that by default the Omnibus packages will stop, run migrations,
and start again, no matter how “big” or “small” the upgrade is. This behavior
can be changed by adding a &lt;a href=&quot;http:&#x2F;&#x2F;doc.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;&lt;code&gt;&#x2F;etc&#x2F;gitlab&#x2F;skip-auto-migrations&lt;&#x2F;code&gt; file&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;cve-ids&quot;&gt;CVE IDs&lt;&#x2F;h3&gt;

&lt;p&gt;We are working on obtaining CVE numbers for these vulnerabilities and will update the blog post accordingly when we&#x27;ve obtained that information.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;enterprise-edition&quot;&gt;Enterprise Edition&lt;&#x2F;h2&gt;

&lt;p&gt;Interested in GitLab Enterprise Edition? Check out the &lt;a href=&quot;&#x2F;pricing&#x2F;feature-comparison&#x2F;&quot;&gt;features exclusive to
EE&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Access to GitLab Enterprise Edition is included with a
&lt;a href=&quot;&#x2F;pricing&#x2F;&quot;&gt;subscription&lt;&#x2F;a&gt;. No time to upgrade GitLab
yourself? Subscribers receive upgrade and installation services.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Pages Security Issue Notification</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/02/05/gitlab-pages-custom-domain-validation/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/02/05/gitlab-pages-custom-domain-validation/</id>
<published>2018-02-05T00:00:00+00:00</published>
<updated>2018-02-05T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;h2 id=&quot;issue-summary&quot;&gt;Issue Summary&lt;&#x2F;h2&gt;

&lt;p&gt;When a user adds a &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;user&#x2F;project&#x2F;pages&#x2F;custom_domains_ssl_tls_certification&#x2F;index.html#adding-your-custom-domain-to-gitlab-pages&quot;&gt;custom domain&lt;&#x2F;a&gt; to their Pages site, no validation was being performed to ensure the domain was owned by that user. This issue allows an attacker to discover DNS records already pointing to the GitLab Page IP address which haven&#x27;t been claimed and potentially hijack them. This issue impacts all users who have created and then deleted custom domains using GitLab Pages, but still have the DNS records active.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;customer-remediation-steps&quot;&gt;Customer Remediation Steps&lt;&#x2F;h2&gt;

&lt;p&gt;Our customers should check if they are using the GitLab Pages service with a custom domain and review their DNS records which point to the GitLab Pages IP &lt;code&gt;52.167.214.135&lt;&#x2F;code&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;If you notice any of your DNS records pointing to that IP address and you&#x27;re no longer using or intending to use the Gitlab Pages service, please remove those specific DNS records.&lt;&#x2F;p&gt;

&lt;p&gt;If you are intending to use the GitLab Pages service and notice that your custom domain has already been claimed or &quot;hijacked&quot;, please contact us at security@gitlab.com.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;gitlab-remediation-strategy&quot;&gt;GitLab Remediation Strategy&lt;&#x2F;h2&gt;

&lt;p&gt;We&#x27;ve currently disabled the feature to add custom domains until we&#x27;ve deployed the patch. In the meantime, the GitLab team is working to provide a more complete &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues&#x2F;29497&quot;&gt;validation&lt;&#x2F;a&gt; of custom domains in the GitLab Pages service as soon as possible.&lt;&#x2F;p&gt;

&lt;p&gt;Our mitigation strategy will consist of implementing domain verification mechanisms on all new and existing GitLab Pages domains, utilizing checks on customer DNS TXT records. This mechanism will be detailed in GitLab Pages documentation when implemented.&lt;&#x2F;p&gt;

&lt;p&gt;There will be a transition plan for current customers once the domain verification mechanisms are active. Stay tuned for further details.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;update-2018-02-07-1000pm-utc&quot;&gt;Update (2018-02-07 10:00PM UTC)&lt;&#x2F;h4&gt;

&lt;p&gt;The &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues&#x2F;29497&quot;&gt;issue&lt;&#x2F;a&gt; referenced above is currently confidential and will be made public after the fix is implemented in 10.5.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;update-2018-02-14-700pm-utc&quot;&gt;Update (2018-02-14 7:00PM UTC)&lt;&#x2F;h4&gt;

&lt;p&gt;The domain verification mechanism will be deployed by the 20th of February in the 10.4 security release. The feature to add custom domains will be re-enabled, and once again users will be able to configure domains and update TLS certificates.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;update-2018-02-21-1200am-utc&quot;&gt;Update (2018-02-21 12:00AM UTC)&lt;&#x2F;h4&gt;

&lt;p&gt;The domain verification mechanism rollout will be phased, starting with GitLab.com, beginning on 2&#x2F;21. We expect that rollout will be completed end of week 2&#x2F;26, based on current projections.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Security Release: 10.3.4, 10.2.6, and 10.1.6</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/01/16/gitlab-10-dot-3-dot-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/01/16/gitlab-10-dot-3-dot-4-released/</id>
<published>2018-01-16T00:00:00+00:00</published>
<updated>2018-01-16T00:00:00+00:00</updated>
<author>
<name>James Ritchey</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 10.3.4, 10.2.6, and 10.1.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain a number of important security fixes, including two
that prevent remote code execution, and we strongly recommend that all GitLab
installations be upgraded to one of these versions immediately.&lt;&#x2F;p&gt;

&lt;p&gt;This security release blog post is the first part of two. The second blog will
be posted in approximately 30 days, and it will detail the vulnerability
findings.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more details regarding this release.&lt;&#x2F;p&gt;


&lt;h2 id=&quot;remote-code-execution-vulnerability-in-gitlab-projects-import&quot;&gt;Remote Code Execution Vulnerability in GitLab Projects Import&lt;&#x2F;h2&gt;

&lt;p&gt;The GitLab projects import component contained a vulnerability which allowed
an attacker to write files to arbitrary directories on the server and that
could result in remote code execution. The vulnerability has now been
mitigated and is assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0915&quot;&gt;CVE-2017-0915&lt;&#x2F;a&gt; and &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2018-3710&quot;&gt;CVE-2018-3710&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;jobertabma&quot;&gt;Jobert Abma&lt;&#x2F;a&gt; of &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;HackerOne&lt;&#x2F;a&gt; and &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;b0bby_tables&quot;&gt;Brian Neel&lt;&#x2F;a&gt;
for responsibly disclosing these issues to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 8.9.0 - 9.5.10&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.0.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;additional-workarounds&quot;&gt;Additional Workarounds&lt;&#x2F;h4&gt;

&lt;ol&gt;
  &lt;li&gt;Go to &lt;code&gt;&#x2F;admin&#x2F;application_settings&lt;&#x2F;code&gt; of your GitLab instance.&lt;&#x2F;li&gt;
  &lt;li&gt;Under &quot;Import sources&quot;, uncheck the &quot;GitLab export&quot; checkbox.&lt;&#x2F;li&gt;
  &lt;li&gt;Click &lt;code&gt;Save&lt;&#x2F;code&gt;.&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h2 id=&quot;gitlab-ci-runner-can-read-and-poison-cache-of-all-other-projects&quot;&gt;GitLab CI Runner Can Read and Poison Cache of All Other Projects&lt;&#x2F;h2&gt;

&lt;p&gt;A path traversal vulnerability was found in the CI runner, which allowed a
malicious user to read and poison other project caches. The issue is now
remediated and has been assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0918&quot;&gt;CVE-2017-0918&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;jobertabma&quot;&gt;Jobert Abma&lt;&#x2F;a&gt; of &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;HackerOne&lt;&#x2F;a&gt; for responsibly disclosing this issue to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 8.4.0 - 9.5.10&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.0.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-1&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;jupyter-notebook-xss&quot;&gt;Jupyter Notebook XSS&lt;&#x2F;h2&gt;

&lt;p&gt;Projects that have Jupyter Notebooks could execute external JavaScript. This XSS
vulnerability was caused by unsanitized output in Jupyter Notebooks. The output
is now correctly sanitized before being rendered. This issue has been assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0923&quot;&gt;CVE-2017-0923&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-2&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 9.1.0 - 9.5.10&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.0.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-2&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;sensitive-fields-exposed-to-admins--masters-in-the-services-api&quot;&gt;Sensitive Fields Exposed to Admins &#x2F; Masters in the Services API&lt;&#x2F;h2&gt;

&lt;p&gt;The &lt;a href=&quot;https:&#x2F;&#x2F;docs.gitlab.com&#x2F;ee&#x2F;api&#x2F;services.html&quot;&gt;Services API&lt;&#x2F;a&gt; responses
were exposing sensitive fields to the Admins and Masters of the service&#x27;s
project. We now filter out those sensitive fields from the Services API
responses. This issue has been assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0925&quot;&gt;CVE-2017-0925&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;WarX&quot;&gt;Artur Jan Fijałkowski&lt;&#x2F;a&gt; for responsibly
disclosing this issue to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-3&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 8.0.0 - 9.5.10&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.0.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-3&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;login-with-disabled-oauth-provider-via-post&quot;&gt;Login with Disabled OAuth Provider via POST&lt;&#x2F;h2&gt;

&lt;p&gt;OAauth providers are configured per instance and can be disabled from the Admin settings page under &quot;Sign-in Restrictions&quot;.&lt;&#x2F;p&gt;

&lt;p&gt;It was possible to login with a disabled OAuth provider when bypassing the form with a malicious request.
A check has been added to prevent this. This issue has been assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0926&quot;&gt;CVE-2017-0926&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;stevenorman&quot;&gt;Steve Norman&lt;&#x2F;a&gt; for responsibly
disclosing this issue to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-4&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 8.8.0 - 9.5.10&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.0.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-4&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;xss-in-label-dropdown&quot;&gt;XSS in Label Dropdown&lt;&#x2F;h2&gt;

&lt;p&gt;A persistent XSS vulnerability was discovered in the issue&#x2F;merge request sidebar label dropdown. Label names inside the sidebar label dropdown are now escaped. This issue has been assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0924&quot;&gt;CVE-2017-0924&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;c05m0ch405&quot;&gt;c05m0ch405&lt;&#x2F;a&gt; for responsibly disclosing this issue to us through HackerOne.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-5&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 9.0.0 - 9.5.10&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.0.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-5&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;critical-sql-injection-in-milestonefinder&quot;&gt;Critical SQL Injection in MilestoneFinder&lt;&#x2F;h2&gt;

&lt;p&gt;A SQL injection vulnerability was discovered in the MilestoneFinder component. The affected SQL query has now been mitigated. This issue has been assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0914&quot;&gt;CVE-2017-0914&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-6&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 9.4.0 - 9.5.10&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.0.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-6&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;critical-vulnerability-with-command-injection-via-webhooks&quot;&gt;Critical Vulnerability with Command Injection via Webhooks&lt;&#x2F;h2&gt;

&lt;p&gt;A new line injection vulnerability was discovered in the Webhook component that allowed an attacker to inject non-HTTP commands in a TCP stream. The issue has now been mitigated and assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0916&quot;&gt;CVE-2017-0916&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-7&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 8.8.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-7&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;cross-site-scripting-xss-vulnerability-in-ci-job-output&quot;&gt;Cross-site scripting (XSS) vulnerability in CI job output&lt;&#x2F;h2&gt;

&lt;p&gt;A persistent XSS vulnerability was discovered in the CI job component, and the issue has now been resolved by performing stricter input validation. This issue has been assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0917&quot;&gt;CVE-2017-0917&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;jobertabma&quot;&gt;Jobert Abma&lt;&#x2F;a&gt; of &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;HackerOne&lt;&#x2F;a&gt; for
responsibly disclosing this issue to us.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-8&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 10.1.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-8&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;guest-users-can-give-deploy-keys-in-other-projects-write-access&quot;&gt;Guest Users Can Give Deploy Keys in Other Projects Write Access&lt;&#x2F;h2&gt;

&lt;p&gt;An improper authorization vulnerability was discovered in the deployment keys component which resulted in unauthorized use of deployment keys by guest users. The issue has now been resolved and is assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0927&quot;&gt;CVE-2017-0927&lt;&#x2F;a&gt;.
This change altered the &lt;code&gt;&#x2F;deploy_keys&lt;&#x2F;code&gt; API endpoint, which no longer returns &lt;code&gt;can_push&lt;&#x2F;code&gt; attribute. See &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ee&#x2F;blob&#x2F;v10.3.4-ee&#x2F;doc&#x2F;api&#x2F;deploy_keys.md&quot;&gt;our updated documentation&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-9&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 8.16.0 - 9.5.10&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.0.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-9&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;milestone-authorization-issue-on-boards&quot;&gt;Milestone Authorization Issue on Boards&lt;&#x2F;h2&gt;

&lt;p&gt;An authorization bypass vulnerability was discovered in the Boards component which resulted in an information disclosure. The issue has now been resolved and is assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0922&quot;&gt;CVE-2017-0922&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-10&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab EE 9.1.0 - 9.5.10&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab EE 10.0.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-10&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;authorization-issue-when-creating-merge-requests&quot;&gt;Authorization Issue When Creating Merge Requests&lt;&#x2F;h2&gt;

&lt;p&gt;A vulnerability regarding authorization to create merge requests allowed users to see names of private projects, which also extended to already forked projects. The issue is now mitigated and is assigned to &lt;a href=&quot;http:&#x2F;&#x2F;www.cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=2017-0920&quot;&gt;CVE-2017-0920&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-11&quot;&gt;Versions Affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;GitLab CE and EE 8.8.0 - 10.1.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.2.0 - 10.2.5&lt;&#x2F;li&gt;
  &lt;li&gt;GitLab CE and EE 10.3.0 - 10.3.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;h3 id=&quot;remediation-11&quot;&gt;Remediation&lt;&#x2F;h3&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running an affected version above to be upgraded to the latest version as soon as possible.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;upgrade-barometer&quot;&gt;Upgrade Barometer&lt;&#x2F;h2&gt;

&lt;p&gt;These versions include a migration to add a column to &lt;code&gt;deploy_keys&lt;&#x2F;code&gt; table and
a post-deploy migration to populate it. No downtime is required.&lt;&#x2F;p&gt;

&lt;p&gt;Please be aware that by default the Omnibus packages will stop, run migrations,
and start again, no matter how “big” or “small” the upgrade is. This behavior
can be changed by adding a &lt;a href=&quot;http:&#x2F;&#x2F;doc.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;&lt;code&gt;&#x2F;etc&#x2F;gitlab&#x2F;skip-auto-migrations&lt;&#x2F;code&gt; file&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;enterprise-edition&quot;&gt;Enterprise Edition&lt;&#x2F;h2&gt;

&lt;p&gt;Interested in GitLab Enterprise Edition? Check out the &lt;a href=&quot;&#x2F;pricing&#x2F;feature-comparison&#x2F;&quot;&gt;features exclusive to
EE&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Access to GitLab Enterprise Edition is included with a
&lt;a href=&quot;&#x2F;pricing&#x2F;&quot;&gt;subscription&lt;&#x2F;a&gt;. No time to upgrade GitLab
yourself? Subscribers receive upgrade and installation services.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>Announcing January 16, 2018 Critical Security Update</title>
<release></release>
<link href='https://about.gitlab.com/releases/2018/01/12/gitlab-critical-release-preannouncement/' rel='alternate' />
<id>https://about.gitlab.com/releases/2018/01/12/gitlab-critical-release-preannouncement/</id>
<published>2018-01-12T00:00:00+00:00</published>
<updated>2018-01-12T00:00:00+00:00</updated>
<author>
<name>Stan Hu</name>
</author>
<content type='html'>&lt;p&gt;On Tuesday, January 16th, 2018 at 23:59 UTC, we will publish a critical GitLab
security update. More details will be forthcoming on &lt;a href=&quot;&#x2F;blog&#x2F;&quot;&gt;our blog&lt;&#x2F;a&gt;, including which
versions of GitLab are affected.&lt;&#x2F;p&gt;

&lt;p&gt;We recommend installations running affected versions to upgrade
immediately. Please forward this alert to the appropriate people at your
organization and have them subscribe to &lt;a href=&quot;&#x2F;company&#x2F;contact&#x2F;#security-notices&quot;&gt;Security Notices&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;


&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab 9.4.4, 9.3.10, 9.2.10, 9.1.10, 9.0.13, and 8.17.8 Critical Security Release</title>
<release></release>
<link href='https://about.gitlab.com/releases/2017/08/10/gitlab-9-dot-4-dot-4-released/' rel='alternate' />
<id>https://about.gitlab.com/releases/2017/08/10/gitlab-9-dot-4-dot-4-released/</id>
<published>2017-08-10T18:00:00+00:00</published>
<updated>2017-08-10T18:00:00+00:00</updated>
<author>
<name>GitLab</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 9.4.4, 9.3.10, 9.2.10, 9.1.10, 9.0.13, and 8.17.8
for GitLab Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain two critical security fixes. The first is a security fix
for a vulnerability in &lt;code&gt;git&lt;&#x2F;code&gt; that can be exploited in GitLab to execute arbitrary
shell commands. The second security fix addresses the usage of symlinks inside
GitLab Export files that could be used to copy the contents of arbitrary
repositories.&lt;&#x2F;p&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all affected GitLab installations
be upgraded to one of these versions &lt;strong&gt;immediately&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;em&gt;Note: This is a coordinated release with several other companies and projects,
including &lt;code&gt;git&lt;&#x2F;code&gt; itself, which is why it is occurring at 18:00 UTC. As those
projects release their updates this release post will be updated with more
information.&lt;&#x2F;em&gt;&lt;&#x2F;p&gt;

&lt;h2 id=&quot;other-announcements&quot;&gt;Other Announcements&lt;&#x2F;h2&gt;
&lt;ul&gt;
  &lt;li&gt;Git: &lt;a href=&quot;https:&#x2F;&#x2F;www.mail-archive.com&#x2F;linux-kernel@vger.kernel.org&#x2F;msg1466490.html&quot;&gt;CVE-2017-1000117&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;Apache Subversion: &lt;a href=&quot;https:&#x2F;&#x2F;subversion.apache.org&#x2F;security&#x2F;CVE-2017-9800-advisory.txt&quot;&gt;CVE-2017-9800&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;Mercurial: &lt;a href=&quot;https:&#x2F;&#x2F;www.mercurial-scm.org&#x2F;wiki&#x2F;WhatsNew#Mercurial_4.3_.282017-08-10.29&quot;&gt;CVE-2017-1000116&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
  &lt;li&gt;Recurity Labs: &lt;a href=&quot;http:&#x2F;&#x2F;blog.recurity-labs.com&#x2F;2017-08-10&#x2F;scm-vulns&quot;&gt;SCM Vulnerabilities&lt;&#x2F;a&gt;&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;Please read on for more details.&lt;&#x2F;p&gt;


&lt;h2 id=&quot;remote-command-execution-in-git-client-cve-2017-12426&quot;&gt;Remote Command Execution in &lt;code&gt;git&lt;&#x2F;code&gt; client (CVE-2017-12426)&lt;&#x2F;h2&gt;

&lt;p&gt;An external code review performed by Recurity Labs identified a remote command
execution vulnerability in &lt;code&gt;git&lt;&#x2F;code&gt; that could be exploited via the &quot;Repo by URL&quot;
import option in GitLab. The command line &lt;code&gt;git&lt;&#x2F;code&gt; client was not properly escaping
command line arguments in URLs using the SSH protocol before invoking the SSH client. A
specially crafted URL could be used to execute arbitrary shell commands on the
GitLab server.&lt;&#x2F;p&gt;

&lt;p&gt;To fully patch this vulnerability two fixes were needed. The Omnibus versions
of GitLab contain a patched &lt;code&gt;git&lt;&#x2F;code&gt; client. For source users who may still be
running an older version of &lt;code&gt;git&lt;&#x2F;code&gt;, GitLab now also blocks import URLs containing
invalid host and usernames. &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues&#x2F;35212&quot;&gt;35212&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;This issue has been assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2017-12426&quot;&gt;CVE-2017-12426&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;http:&#x2F;&#x2F;twitter.com&#x2F;joernchen&quot;&gt;Joern Schneeweisz&lt;&#x2F;a&gt; and &lt;a href=&quot;http:&#x2F;&#x2F;www.recurity-labs.com&#x2F;&quot;&gt;Recurity Labs&lt;&#x2F;a&gt; for discovering this vulnerability, providing
immediate notification, and helping us coordinate a release across several projects.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;7.9.0 through 8.17.7&lt;&#x2F;li&gt;
  &lt;li&gt;9.0.0 through 9.0.12&lt;&#x2F;li&gt;
  &lt;li&gt;9.1.0 through 9.1.9&lt;&#x2F;li&gt;
  &lt;li&gt;9.2.0 through 9.2.9&lt;&#x2F;li&gt;
  &lt;li&gt;9.3.0 through 9.3.9&lt;&#x2F;li&gt;
  &lt;li&gt;9.4.0 through 9.4.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version mentioned
above be upgraded as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;&#x2F;h3&gt;

&lt;p&gt;If you&#x27;re unable to upgrade right away, you can secure your GitLab installation
against this vulnerability using the workaround outlined below until you
have time to upgrade.&lt;&#x2F;p&gt;

&lt;p&gt;Note: Disabling the &quot;Repo by URL&quot; import option does not fully mitigate this
vulnerability as existing projects will still be able to change their import URLs.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;removing-support-for-ssh-urls&quot;&gt;Removing support for SSH URLs&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab CE+EE instances that cannot be patched immediately can disable support
for SSH URLs in project imports and mirrors by editing the GitLab source code
and removing &lt;code&gt;ssh&lt;&#x2F;code&gt; from the list of valid protocols.&lt;&#x2F;p&gt;

&lt;p&gt;For source users edit: &lt;code&gt;&#x2F;app&#x2F;validators&#x2F;addressable_url_validator.rb&lt;&#x2F;code&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;For Omnibus users edit: &lt;code&gt;&#x2F;opt&#x2F;gitlab&#x2F;embedded&#x2F;service&#x2F;gitlab-rails&#x2F;app&#x2F;validators&#x2F;addressable_url_validator.rb&lt;&#x2F;code&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Change:&lt;&#x2F;p&gt;
&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight plaintext&quot;&gt;&lt;code&gt;DEFAULT_OPTIONS = { protocols: %w(http https ssh git) }.freeze
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;
&lt;p&gt;To:&lt;&#x2F;p&gt;
&lt;div class=&quot;highlight&quot;&gt;&lt;pre class=&quot;highlight plaintext&quot;&gt;&lt;code&gt;DEFAULT_OPTIONS = { protocols: %w(http https git) }.freeze
&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;&lt;&#x2F;div&gt;&lt;p&gt;Then restart GitLab.&lt;&#x2F;p&gt;

&lt;p&gt;For Omnibus users: &lt;code&gt;gitlab-ctl restart&lt;&#x2F;code&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;verifying-the-workaround&quot;&gt;Verifying the workaround&lt;&#x2F;h3&gt;

&lt;ol&gt;
  &lt;li&gt;Choose to create a new project&lt;&#x2F;li&gt;
  &lt;li&gt;Choose &quot;Import by URL&quot;.&lt;&#x2F;li&gt;
  &lt;li&gt;Specify a URL such as &lt;code&gt;ssh:&#x2F;&#x2F;gitlab.com&#x2F;foo.git&lt;&#x2F;code&gt;.&lt;&#x2F;li&gt;
  &lt;li&gt;Verify that GitLab returns an invalid URL error.&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;p&gt;Be certain that you do not revert this patch until you have installed an updated
version of &lt;code&gt;git&lt;&#x2F;code&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;improper-sanitization-of-gitlab-export-files-on-import&quot;&gt;Improper sanitization of GitLab export files on import&lt;&#x2F;h2&gt;

&lt;p&gt;GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a patch
for a &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2016-9086&quot;&gt;critical directory traversal vulnerability&lt;&#x2F;a&gt; in the GitLab export feature
that could be exploited by including symlinks in the export file and then re-importing
it to a GitLab instance. This vulnerability was patched by checking for and removing
symlinks in these files on import.&lt;&#x2F;p&gt;

&lt;p&gt;&lt;a href=&quot;http:&#x2F;&#x2F;www.recurity-labs.com&#x2F;&quot;&gt;Recurity Labs&lt;&#x2F;a&gt; also determined that this fix did not properly remove symlinks for
hidden files. Though not as dangerous as the original vulnerability hidden file
symlinks could still be used to steal copies of &lt;code&gt;git&lt;&#x2F;code&gt; repositories belonging to
other users if the path to the &lt;code&gt;git&lt;&#x2F;code&gt; repository was known by the attacker. An
updated fix has been included in these releases that properly removes all symlinks. &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues&#x2F;36091&quot;&gt;36091&lt;&#x2F;a&gt;&lt;&#x2F;p&gt;

&lt;p&gt;This import option was not made available to non-admin users until GitLab 8.13.0.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected-1&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;8.9.0 through 8.17.7&lt;&#x2F;li&gt;
  &lt;li&gt;9.0.0 through 9.0.12&lt;&#x2F;li&gt;
  &lt;li&gt;9.1.0 through 9.1.9&lt;&#x2F;li&gt;
  &lt;li&gt;9.2.0 through 9.2.9&lt;&#x2F;li&gt;
  &lt;li&gt;9.3.0 through 9.3.9&lt;&#x2F;li&gt;
  &lt;li&gt;9.4.0 through 9.4.3&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version mentioned
above be upgraded as soon as possible.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;workarounds-1&quot;&gt;Workarounds&lt;&#x2F;h3&gt;

&lt;p&gt;GitLab instances that cannot be patched immediately can disable the &quot;GitLab export&quot;
option for project imports in their admin settings.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;verifying-the-workaround-1&quot;&gt;Verifying the workaround&lt;&#x2F;h3&gt;

&lt;ol&gt;
  &lt;li&gt;Choose to create a new project&lt;&#x2F;li&gt;
  &lt;li&gt;Verify that the &quot;GitLab export&quot; option is not available.&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h2 id=&quot;upgrade-barometer&quot;&gt;Upgrade barometer&lt;&#x2F;h2&gt;

&lt;p&gt;These versions do not include any migrations and will not require downtime.&lt;&#x2F;p&gt;

&lt;p&gt;Please be aware that by default the Omnibus packages will stop, run migrations,
and start again, no matter how “big” or “small” the upgrade is. This behavior
can be changed by adding a &lt;a href=&quot;http:&#x2F;&#x2F;doc.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;&lt;code&gt;&#x2F;etc&#x2F;gitlab&#x2F;skip-auto-migrations&lt;&#x2F;code&gt;
file&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;enterprise-edition&quot;&gt;Enterprise Edition&lt;&#x2F;h2&gt;

&lt;p&gt;Interested in GitLab Enterprise Edition? Check out the &lt;a href=&quot;&#x2F;pricing&#x2F;feature-comparison&#x2F;&quot;&gt;features exclusive to
EE&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Access to GitLab Enterprise Edition is included with a
&lt;a href=&quot;&#x2F;pricing&#x2F;&quot;&gt;subscription&lt;&#x2F;a&gt;. No time to upgrade GitLab
yourself? Subscribers receive upgrade and installation services.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>Announcing August 10, 2017 Critical Security Update</title>
<release></release>
<link href='https://about.gitlab.com/releases/2017/08/04/gitlab-critical-release-preannouncement/' rel='alternate' />
<id>https://about.gitlab.com/releases/2017/08/04/gitlab-critical-release-preannouncement/</id>
<published>2017-08-04T00:00:00+00:00</published>
<updated>2017-08-04T00:00:00+00:00</updated>
<author>
<name>Brian Neel</name>
</author>
<content type='html'>&lt;p&gt;On Thursday, August 10th, 2017 at 18:00 UTC, we will publish a critical GitLab
security update. More details will be forthcoming on &lt;a href=&quot;&#x2F;blog&#x2F;&quot;&gt;our blog&lt;&#x2F;a&gt;, including
which versions of GitLab are affected.&lt;&#x2F;p&gt;

&lt;p&gt;We recommend installations running affected versions to upgrade as soon as the
new releases are available. Please forward this alert to the appropriate people
at your organization and have them subscribe to &lt;a href=&quot;&#x2F;company&#x2F;contact&#x2F;#security-notices&quot;&gt;Security Notices&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Please note the 18:00 UTC release time. This is different from the 23:59 UTC
release time used for previous critical security releases. This change will be
explained in the release blog post.&lt;&#x2F;p&gt;


&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>9.3.7 Patch Release Update - Security Addendum</title>
<release></release>
<link href='https://about.gitlab.com/releases/2017/08/03/recent-bug-could-enable-signups/' rel='alternate' />
<id>https://about.gitlab.com/releases/2017/08/03/recent-bug-could-enable-signups/</id>
<published>2017-08-03T00:00:00+00:00</published>
<updated>2017-08-03T00:00:00+00:00</updated>
<author>
<name>Brian Neel</name>
</author>
<content type='html'>&lt;p&gt;GitLab 9.3.7 fixed a security problem that was not listed in the &lt;a href=&quot;&#x2F;releases&#x2F;2017&#x2F;07&#x2F;18&#x2F;gitlab-9-dot-3-dot-7-released&#x2F;&quot;&gt;patch release update&lt;&#x2F;a&gt;. We recommend users on GitLab 9.3.0 to 9.3.6 to upgrade to 9.3.9 or newer.&lt;&#x2F;p&gt;


&lt;p&gt;This bug was introduced in GitLab 9.3.0 and can be triggered when an instance loses connectivity to the Redis cluster. In this situation the server may create a new application settings entry in the database using the GitLab defaults. In a worst-case scenario an instance with sign-ups initially disabled may have that setting enabled, allowing users to register.&lt;&#x2F;p&gt;

&lt;p&gt;A fix for this bug was included with GitLab CE+EE versions 9.3.7 and 9.4.0. The fix &lt;em&gt;does not&lt;&#x2F;em&gt; restore any settings that have been reset to defaults. All users running GitLab instances versions 9.3.0 or newer should verify that their application settings are still correct. Users running instances with sign-ups disabled should verify that no unauthorized accounts have been created.&lt;&#x2F;p&gt;

&lt;p&gt;Users running GitLab CE+EE versions prior to 9.3.0 and users of GitLab.com are not affected.&lt;&#x2F;p&gt;

&lt;p&gt;More details can be found in &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues&#x2F;34728&quot;&gt;the issue&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Thanks to &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;ramonsmit94&quot;&gt;Ramon Smit&lt;&#x2F;a&gt; of &lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;DALTCORE&quot;&gt;DALTCORE&lt;&#x2F;a&gt; for reporting the full impact of this vulnerability to us.&lt;&#x2F;p&gt;
&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>Announcing July 19, 2017 Critical Security Update</title>
<release></release>
<link href='https://about.gitlab.com/releases/2017/07/14/gitlab-critical-release-preannouncement/' rel='alternate' />
<id>https://about.gitlab.com/releases/2017/07/14/gitlab-critical-release-preannouncement/</id>
<published>2017-07-14T00:00:00+00:00</published>
<updated>2017-07-14T00:00:00+00:00</updated>
<author>
<name>Brian Neel</name>
</author>
<content type='html'>&lt;p&gt;On Wednesday, July 19th, 2017 at 23:59 UTC, we will publish a critical GitLab
security update. More details will be forthcoming on &lt;a href=&quot;&#x2F;blog&#x2F;&quot;&gt;our blog&lt;&#x2F;a&gt;, including
which versions of GitLab are affected.&lt;&#x2F;p&gt;

&lt;p&gt;We recommend installations running affected versions to upgrade
immediately. Please forward this alert to the appropriate people at your
organization and have them subscribe to &lt;a href=&quot;&#x2F;company&#x2F;contact&#x2F;#security-notices&quot;&gt;Security Notices&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;


&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>Announcing March 20, 2017 Critical Security Update</title>
<release></release>
<link href='https://about.gitlab.com/releases/2017/03/17/gitlab-critical-release-preannouncement/' rel='alternate' />
<id>https://about.gitlab.com/releases/2017/03/17/gitlab-critical-release-preannouncement/</id>
<published>2017-03-17T00:00:00+00:00</published>
<updated>2017-03-17T00:00:00+00:00</updated>
<author>
<name>Brian Neel</name>
</author>
<content type='html'>&lt;p&gt;On Monday, March 20th, 2017 at 23:59 UTC, we will publish a critical GitLab
security update. More details will be forthcoming on &lt;a href=&quot;&#x2F;blog&#x2F;&quot;&gt;our blog&lt;&#x2F;a&gt;, including
which versions of GitLab are affected.&lt;&#x2F;p&gt;

&lt;p&gt;We recommend installations running affected versions to upgrade
immediately. Please forward this alert to the appropriate people at your
organization and have them subscribe to &lt;a href=&quot;&#x2F;company&#x2F;contact&#x2F;#security-notices&quot;&gt;Security Notices&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;


&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Major Security Update for CVE-2016-9469</title>
<release></release>
<link href='https://about.gitlab.com/releases/2016/11/30/gitlab-major-security-update-for-cve-2016-9469/' rel='alternate' />
<id>https://about.gitlab.com/releases/2016/11/30/gitlab-major-security-update-for-cve-2016-9469/</id>
<published>2016-11-30T00:00:00+00:00</published>
<updated>2016-11-30T00:00:00+00:00</updated>
<author>
<name>Brian Neel</name>
</author>
<content type='html'>&lt;p&gt;On Monday, December 5th, 2016 at 3:59pm PST (23:59 UTC), we will publish a major
GitLab security update to address CVE-2016-9469, a denial-of-service and data
corruption vulnerability. More details will be forthcoming on &lt;a href=&quot;&#x2F;blog&#x2F;&quot;&gt;our blog&lt;&#x2F;a&gt;,
including which versions of GitLab are affected.&lt;&#x2F;p&gt;

&lt;p&gt;We recommend installations running affected versions to upgrade
immediately. Please forward this alert to the appropriate people at your
organization and have them subscribe to &lt;a href=&quot;&#x2F;company&#x2F;contact&#x2F;#security-notices&quot;&gt;Security Notices&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;


&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab 8.13.3, 8.12.8, 8.11.10, and 8.10.13 Released</title>
<release></release>
<link href='https://about.gitlab.com/releases/2016/11/02/cve-2016-9086-patches/' rel='alternate' />
<id>https://about.gitlab.com/releases/2016/11/02/cve-2016-9086-patches/</id>
<published>2016-11-02T23:50:00+00:00</published>
<updated>2016-11-02T23:50:00+00:00</updated>
<author>
<name>GitLab</name>
</author>
<content type='html'>&lt;p&gt;Today we are releasing versions 8.13.3, 8.12.8, 8.11.10, and 8.10.13 for GitLab
Community Edition (CE) and Enterprise Edition (EE).&lt;&#x2F;p&gt;

&lt;p&gt;These versions contain an important security fix for a critical directory
traversal vulnerability, and we &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all GitLab
installations be upgraded to one of these versions &lt;strong&gt;immediately&lt;&#x2F;strong&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Please read on for more details.&lt;&#x2F;p&gt;


&lt;h2 id=&quot;directory-traversal-via-importexport-feature-cve-2016-9086&quot;&gt;Directory traversal via &quot;import&#x2F;export&quot; feature: &lt;code&gt;CVE-2016-9086&lt;&#x2F;code&gt;&lt;&#x2F;h2&gt;

&lt;p&gt;&lt;a href=&quot;https:&#x2F;&#x2F;twitter.com&#x2F;jobertabma&quot;&gt;Jobert Abma&lt;&#x2F;a&gt; from &lt;a href=&quot;https:&#x2F;&#x2F;hackerone.com&#x2F;jobert&quot;&gt;HackerOne&lt;&#x2F;a&gt; disclosed a critical security flaw in the &quot;import&#x2F;export
project&quot; feature of GitLab. Added in GitLab 8.9, this feature allows a user to
export and then re-import their projects as tape archive files (tar). All
GitLab versions prior to 8.13.0 restricted this feature to administrators only.
Starting with version 8.13.0 this feature was made available to all users.&lt;&#x2F;p&gt;

&lt;p&gt;This feature did not properly check for symbolic links in user-provided archives
and therefore it was possible for an authenticated user to retrieve the contents
of any file accessible to the GitLab service account. This included sensitive
files such as those that contain secret tokens used by the GitLab service to
authenticate users. Please see &lt;a href=&quot;https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-ce&#x2F;issues&#x2F;23822&quot;&gt;the issue&lt;&#x2F;a&gt; for more details.&lt;&#x2F;p&gt;

&lt;p&gt;This issue has been assigned &lt;a href=&quot;http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2016-9086&quot;&gt;CVE-2016-9086&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;versions-affected&quot;&gt;Versions affected&lt;&#x2F;h3&gt;

&lt;ul&gt;
  &lt;li&gt;8.13.0 through 8.13.2&lt;&#x2F;li&gt;
  &lt;li&gt;8.12.0 through 8.12.7&lt;&#x2F;li&gt;
  &lt;li&gt;8.11.0 through 8.11.9&lt;&#x2F;li&gt;
  &lt;li&gt;8.10.0 through 8.10.12&lt;&#x2F;li&gt;
  &lt;li&gt;8.9.0 through 8.9.11&lt;&#x2F;li&gt;
&lt;&#x2F;ul&gt;

&lt;p&gt;We &lt;strong&gt;strongly recommend&lt;&#x2F;strong&gt; that all installations running a version mentioned
above be upgraded as soon as possible. Please note that no patch is being
provided for GitLab versions 8.9.x. Those running versions 8.9.0 through
8.9.11 who cannot upgrade to a newer version should use the workaround listed
below.&lt;&#x2F;p&gt;

&lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;&#x2F;h3&gt;

&lt;p&gt;If you&#x27;re unable to upgrade right away, you can secure your GitLab installation
against this vulnerability using the workaround outlined below until you have
time to upgrade.&lt;&#x2F;p&gt;

&lt;h4 id=&quot;disable-project-importexport-via-tape-archive&quot;&gt;Disable Project Import&#x2F;Export via Tape Archive&lt;&#x2F;h4&gt;
&lt;p&gt;Login using an administrator account to your GitLab installation and perform the
following:&lt;&#x2F;p&gt;

&lt;ol&gt;
  &lt;li&gt;Choose &quot;Admin Area&quot;&lt;&#x2F;li&gt;
  &lt;li&gt;Click &quot;Settings&quot;&lt;&#x2F;li&gt;
  &lt;li&gt;Under &quot;Import Sources&quot; disable the &quot;GitLab export&quot; option.&lt;&#x2F;li&gt;
  &lt;li&gt;Click Save&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h3 id=&quot;verifying-the-workaround&quot;&gt;Verifying the workaround&lt;&#x2F;h3&gt;

&lt;ol&gt;
  &lt;li&gt;In a Browser Window, login as any user&lt;&#x2F;li&gt;
  &lt;li&gt;Click &quot;Projects&quot;&lt;&#x2F;li&gt;
  &lt;li&gt;Click &quot;New Project&quot;&lt;&#x2F;li&gt;
  &lt;li&gt;Enter a project name&lt;&#x2F;li&gt;
  &lt;li&gt;Verify that &quot;GitLab export&quot; does not appear as an import option&lt;&#x2F;li&gt;
&lt;&#x2F;ol&gt;

&lt;h2 id=&quot;upgrade-barometer&quot;&gt;Upgrade barometer&lt;&#x2F;h2&gt;

&lt;p&gt;These versions do not include any new migrations, and should not require any
downtime.&lt;&#x2F;p&gt;

&lt;p&gt;Please be aware that by default the Omnibus packages will stop, run migrations,
and start again, no matter how “big” or “small” the upgrade is. This behavior
can be changed by adding a &lt;a href=&quot;http:&#x2F;&#x2F;doc.gitlab.com&#x2F;omnibus&#x2F;update&#x2F;README.html&quot;&gt;&lt;code&gt;&#x2F;etc&#x2F;gitlab&#x2F;skip-auto-migrations&lt;&#x2F;code&gt;
file&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;updating&quot;&gt;Updating&lt;&#x2F;h2&gt;

&lt;p&gt;To update, check out our &lt;a href=&quot;&#x2F;update&#x2F;&quot;&gt;update page&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;h2 id=&quot;enterprise-edition&quot;&gt;Enterprise Edition&lt;&#x2F;h2&gt;

&lt;p&gt;Interested in GitLab Enterprise Edition? Check out the &lt;a href=&quot;&#x2F;pricing&#x2F;feature-comparison&#x2F;&quot;&gt;features exclusive to
EE&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;

&lt;p&gt;Access to GitLab Enterprise Edition is included with a
&lt;a href=&quot;&#x2F;pricing&#x2F;&quot;&gt;subscription&lt;&#x2F;a&gt;. No time to upgrade GitLab
yourself? Subscribers receive upgrade and installation services.&lt;&#x2F;p&gt;

&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Major Security Update for CVE-2016-9086</title>
<release></release>
<link href='https://about.gitlab.com/releases/2016/10/31/gitlab-major-security-update-for-cve-2016-9086/' rel='alternate' />
<id>https://about.gitlab.com/releases/2016/10/31/gitlab-major-security-update-for-cve-2016-9086/</id>
<published>2016-10-31T00:00:00+00:00</published>
<updated>2016-10-31T00:00:00+00:00</updated>
<author>
<name>Brian Neel</name>
</author>
<content type='html'>&lt;p&gt;On Wednesday November 2, 2016 at 4:59pm PDT (23:59 GMT), we will publish a major
GitLab security update to address CVE-2016-9086. More details will be
forthcoming on [our blog], including which versions of GitLab are affected.&lt;&#x2F;p&gt;

&lt;p&gt;We recommend installations running affected versions to upgrade
immediately. Please forward this alert to the appropriate people at your
organization and have them subscribe to [Security Notices].&lt;&#x2F;p&gt;

&lt;p&gt;&#x2F;
[Security Notices]: &#x2F;company&#x2F;contact&#x2F;#security-notices&lt;&#x2F;p&gt;


&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
<entry>
<title>GitLab Major Security Update for CVE-2016-4340</title>
<release></release>
<link href='https://about.gitlab.com/releases/2016/04/28/gitlab-major-security-update-for-cve-2016-4340/' rel='alternate' />
<id>https://about.gitlab.com/releases/2016/04/28/gitlab-major-security-update-for-cve-2016-4340/</id>
<published>2016-04-28T00:00:00+00:00</published>
<updated>2016-04-28T00:00:00+00:00</updated>
<author>
<name>Stan Hu</name>
</author>
<content type='html'>&lt;p&gt;On Monday May 2, 2016 at 4:59pm PDT (23:59 GMT), we will publish a major
GitLab security update to address CVE-2016-4340. More details will be
forthcoming on &lt;a href=&quot;&#x2F;blog&#x2F;&quot;&gt;our blog&lt;&#x2F;a&gt;, including which versions of GitLab are affected.&lt;&#x2F;p&gt;

&lt;p&gt;We recommend installations running affected versions to upgrade
immediately. Please forward this alert to the appropriate people at your
organization and have them subscribe to &lt;a href=&quot;&#x2F;company&#x2F;contact&#x2F;&quot;&gt;Security Notices&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;


&lt;img src=&#x27;https:&#x2F;&#x2F;about.gitlab.com&#x2F;images&#x2F;default-blog-image.png&#x27; class=&#x27;webfeedsFeaturedVisual&#x27; style=&#x27;display: none;&#x27; &#x2F;&gt;</content>
</entry>
</feed>