GitLab 8.8.5 released

Jun 15, 2016

Today we are releasing the versions 8.8.5, 8.7.7, 8.6.9, 8.5.13, 8.4.11, 8.3.10 and 8.2.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain a number of security fixes, and we recommend that all GitLab installations be upgraded to one of these versions.

Please read on for more details.

8.8.5 includes the following fixes:

In addition, 8.8.5, 8.7.7, 8.6.9, 8.5.13, 8.4.11, 8.3.10 and 8.2.6 include the following security fixes:

Unauthorized access to project build traces

It was possible for users to view build traces, possibly exposing sensitive information to other users. See the issue for more details.

Thanks to Madhu Akula for responsibly disclosing this issue to us.

Cross-site scripting (XSS) vulnerability in Wiki pages

It was possible for an attacker to inject malicious JavaScript code in a Wiki page. See the issue for more details

Thanks to Jobert Abma of HackerOne for responsibly disclosing this issue to us.

Unauthorized access to notes in confidential issues

Notes in confidential issues could be viewed in JSON form by unauthorized users. See the issue for more details.

Upgrade barometer

This version does not include any migrations, and should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-migrations file.

Updating

To update, check out our update page.

Enterprise Edition

Interested in GitLab Enterprise Edition? Check out the features exclusive to EE.

Access to GitLab Enterprise Edition is included with a subscription. No time to upgrade GitLab yourself? Subscribers receive upgrade and installation services.


Install GitLab on your own server in 2 minutes

Browse all posts

For the latest and most detailed news follow @gitlab on Twitter. Future blog posts suggestions.