Upcoming critical Gitlab security issue

#1

Post by nerdbaggy » Thu, Jan 11, 2024, 12:24 AM UTC

I just got the following email. Security vulnerabilities have never been communicated like this before.

GitLab Security is writing to you to provide advanced notice of an upcoming critical security release scheduled for January 11, 2024. We highly recommend your team is prepared to immediately deploy the security upgrade to all affected self-hosted GitLab instances when the security release is available.

Please monitor the GitLab release page for security release details and upgrade instructions.

Affected GitLab versions:

16.1.0 - 16.5.4 16.6.0 - 16.6.2 16.7.0 Thank you,

The GitLab Security team

Re: Upcoming critical Gitlab security issue

#2

Post by mdaniel » Thu, Jan 11, 2024, 9:53 PM UTC

The tags are up for it, but no blog post yet: https://gitlab.com/gitlab-org/gitlab/-/tags https://about.gitlab.com/security-releases.xml

https://gitlab.com/gitlab-org/gitlab/-/blob/v16.7.2-ee/CHANG... seems to be the tl;dr although strangely I don't see a v16.7.1-ee tag

Re: Upcoming critical Gitlab security issue

#3

Post by nerdbaggy » Thu, Jan 11, 2024, 10:54 PM UTC

mdaniel wrote: post #2

The tags are up for it, but no blog post yet: https://gitlab.com/gitlab-org/gitlab/-/tags https://about.gitlab.com/security-releases.xml https://gitlab.com/gitlab-org/gitlab/-/blob/v16.7.2-ee/CHANG... seems to be the tl;dr although strangely I don't see a v16.7.1-ee tag

Ohh yup. Looking at the merge it allows people to reset other users passwords.

I was also able update my instance.

Re: Upcoming critical Gitlab security issue

#4

Post by nerdbaggy » Thu, Jan 11, 2024, 11:31 PM UTC

Blog post https://about.gitlab.com/releases/2024/01/11/critical-securi...