Patches close RCE, XSS, and SSRF security loopholes
GitLab users have been urged to update to the latest free and commercial versions of the repository manager, which include fixes for more than a dozen security issues.
In a security advisory issued this week, GitLab said versions 11.11.1, 11.10.5, and 11.9.12 of the Community Edition (CE) and Enterprise Edition (EE) include mitigations against a range of vulnerabilities.
The advisory includes only basic vulnerability information, with GitLab stating that full details will be made public on its issue tracker in approximately 30 days.
Counted among the now-patched security flaws is a remote command execution bug within GitLab’s repository download feature, where a specially crafted payload could allow a malicious user to execute commands remotely.
According to the company, multiple GitLab features contained server-side request forgery (SSRF) vulnerabilities caused by an insufficient validation to prevent DNS rebinding attacks.
Two stored cross-site scripting (XSS) vulnerabilities, along with a bug that could allow non-member users to access the title of confidential issues, have also been addressed in the latest releases.
“These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately,” GitLab said.
