2024/6/26 アナウンスされたセキュリティリリース情報。クリティカルバグが発見されているためできるだけ早くパッチ適用されることが推奨されています。
以下 GitLab Critical Patch Release: 17.1.1, 17.0.3, 16.11.5 冒頭部分翻訳および原文を掲載します。
///////////////////////////////////////////////////////////////
（翻訳）
GitLabクリティカルパッチリリースの詳細はこちら： 17.1.1, 17.0.3, 16.11.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).
本日、GitLab Community Edition (CE)とEnterprise Edition (EE)のバージョン17.1.1、17.0.3、16.11.5をリリースします。
これらのバージョンには重要なバグとセキュリティの修正が含まれていますので、インストールされているすべてのGitLabを直ちにこれらのバージョンにアップグレードすることを強くお勧めします。 GitLab.comはすでにパッチが適用されたバージョンを実行しています。 GitLabは専用のパッチリリースで脆弱性の修正をリリースしています。
パッチリリースには2種類あります：スケジュールされたリリースと、深刻度の高い脆弱性に対する臨時のクリティカルパッチです。 スケジュールされたリリースは、月に2回、第2水曜日と第4水曜日にリリースされます。 詳しくはリリースハンドブックとセキュリティFAQをご覧ください。 GitLabリリースのすべてのブログ投稿はこちらでご覧いただけます。
セキュリティ修正については、各脆弱性の詳細は、パッチが適用されたリリースから30日後に、私たちの課題追跡で公開されます。
私たちは、顧客に公開される、または顧客データをホストするGitLabのすべての側面が最高のセキュリティ標準に保持されることを保証することに専念しています。 適切なセキュリティ衛生を維持する一環として、すべてのお客様には、サポートされているバージョンの最新のパッチリリースにアップグレードすることを強くお勧めします。 GitLabインスタンスを保護するためのベストプラクティスについては、私たちのブログポストをご覧ください。
推奨される行動
以下に説明する問題の影響を受けるバージョンを実行しているすべてのインストールを、できるだけ早く最新バージョンにアップグレードすることを強くお勧めします。
製品の特定のデプロイメント タイプ (オムニバス、ソース コード、Helm チャートなど) が指定されていない場合は、すべてのタイプが影響を受けることを意味します。
修正パッチリスト、詳細、対応などについては以下原文、もしくは引用元をご参照ください。
GitLab Critical Patch Release: 17.1.1, 17.0.3, 16.11.5
https://about.gitlab.com/releases/2024/06/26/patch-release-gitlab-17-1-1-released/
—————————————————————-
（原文）
Learn more about GitLab Critical Patch Release: 17.1.1, 17.0.3, 16.11.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).
Today we are releasing versions 17.1.1, 17.0.3, 16.11.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).
These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.
GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.
For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.
We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.
Recommended Action
We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.
When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.
Security fixes
Table of security fixes
Run pipelines as any user
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which could allow an attacker to trigger a pipeline as another user under certain circumstances. This is a critical severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 9.6). It is now resolved in the latest release and is assigned CVE-2024-5655.
Thanks to ahacker1 for reporting this vulnerability through our HackerOne bug bounty program.
Breaking changes:
- This fix changes the MR re-targeting workflow so that a pipeline will not automatically run when a merge request is automatically re-targeted due to its previous target branch being merged. Users will need to manually start a pipeline to have CI execute for their changes.
- GraphQL authentication using CI_JOB_TOKEN is disabled by default from 17.0.0, and back ported to 17.0.3, 16.11.5 in the current patch release. If access to the GraphQL API is required, please configure one of the several supported token types for authentication.
At this time, we have not found evidence of abuse of this vulnerability on the platforms managed by GitLab, including GitLab.com and GitLab Dedicated instances.
Stored XSS injected in imported project’s commit notes
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7). It is now mitigated in the latest release and is assigned CVE-2024-4901.
Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.
CSRF on GraphQL API IntrospectionQuery
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab’s GraphQL API leading to the execution of arbitrary GraphQL mutations. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1). It is now mitigated in the latest release and is assigned CVE-2024-4994.
Thanks ahacker1 for reporting this vulnerability through our HackerOne bug bounty program
Remove search results from public projects with unauthorized repos
Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5). It is now mitigated in the latest release and is assigned CVE-2024-6323.
Thanks to GitLab Team Member, @joernchen for reporting this issue.
Cross window forgery in user application OAuth flow
A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, 6.8). It is now mitigated in the latest release and is assigned CVE-2024-2177.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Project maintainers can bypass group’s merge request approval policy
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via graphQL. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N, 6.8). It is now mitigated in the latest release and is assigned CVE-2024-5430.
Thanks js_noob for reporting this vulnerability through our HackerOne bug bounty program.
ReDoS via custom built markdown page
A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions from 7.10 prior before 16.11.5, version 17.0 before 17.0.3, and 17.1 before 17.1.1. It is possible for an attacker to cause a denial of service using a crafted markdown page. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2024-4025.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Private job artifacts can be accessed by any user
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5). It is now mitigated in the latest release and is assigned CVE-2024-3959.
Thanks js_noob for reporting this vulnerability through our HackerOne bug bounty program.
Security fixes for banzai pipeline
Multiple Denial of Service (DoS) issues has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1 which allowed an attacker to cause resource exhaustion via banzai pipeline. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2024-4557.
Thanks joaxcar and setiawan_ for reporting these vulnerability through our HackerOne bug bounty program
ReDoS in dependency linker
An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the server. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2024-1493.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Denial of service using a crafted OpenAPI file
An issue was discovered in GitLab CE/EE affecting all versions starting from 12.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows for an attacker to cause a denial of service using a crafted OpenAPI file. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.3). It is now mitigated in the latest release and is assigned CVE-2024-1816.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Merge request title disclosure
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). It is now mitigated in the latest release and is assigned CVE-2024-2191.
Thanks ashish_r_padelkar for reporting this vulnerability through our HackerOne bug bounty program.
Access issues and epics without having an SSO session
An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-3115.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Non project member can promote key results to objectives
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows non-project member to promote key results to objectives. This is a low severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N, 3.1). It is now mitigated in the latest release and is assigned CVE-2024-4011.
Thanks ashish_r_padelkar for reporting this vulnerability through our HackerOne bug bounty program.
Bug fixes
17.1.1
- Prevent cng e2e test from running in security fork
- Only enumerate commits in pre-receive check if push came from Web
- Revert “Allow
admin_runnerability to change shared runners setting”
17.0.3
- Fix missing filename when downloading generic package in release page
- Update an expired test certificate
- Prevent starting multiple Capybara proxy servers
- Backport 3 commits for Merge Train pipelines support in 17-0-stable-ee
- Fix error when calling GQL ciConfig endpoint with include:component
- Only allow documented token types for GraphQL authentication
- Add a banner informing about token expiration
- Only enumerate commits in pre-receive check if push came from Web
- Backport QA test fixes for stable branches
- Merge branch ‘sh-patch-inspec-gem’ into ‘master’
16.11.5
- Prevent starting multiple Capybara proxy servers
- Update an expired test certificate
- Enable invert_emails_disabled_to_emails_enabled by default
- Only allow documented token types for GraphQL authentication
- Add a banner informing about token expiration
- Backport QA test fixes for stable branches
16.10.8
16.9.9
16.8.8
16.7.8
16.6.8
Updating
To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.
Receive Patch Notifications
To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.
We’re combining patch and security releases
This improvement in our release process matches the industry standard and will help GitLab users get information about security and bug fixes sooner, read the blog post here.
///////////////////////////////////////////////////////////////
弊社パートナー様はNetworld Dev Portal アカウント（無料）登録いただくと、GitLabパートナー制度や DevSecOps関連提案資料などのパートナー限定コンテンツがご覧いただけます。
DevSecOps全般、GitLab製品または本サイトについては以下よりお問い合わせ下さい。
