Today we are releasing versions 9.1.3, 9.0.7, and 8.17.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).
These versions contain several security fixes, including security upgrades for Mattermost, fixes for several persistent Cross-site Scripting (XSS) vulnerabilities, and fixes for several information disclosure vulnerabilities. We recommend that all GitLab installations be upgraded to one of these versions.
Please read on for more details.
Security upgrade for Mattermost versions 3.7 and 3.6
Mattermost has not yet released full details, however an important security release was published and Mattermost has advised all users to upgrade immediately. GitLab Omnibus CE+EE versions 9.1 and 9.0 have been upgraded to Mattermost 3.7.5 and GitLab Omnibus CE+EE version 8.17 has been upgraded to Mattermost 3.6.7. #2282
This upgrade also required the addition of a new Mattermost setting in
Security upgrade for MySQL client libraries
The MySQL client library included with GitLab Omnibus packages has been upgraded to 5.5.56 to patch CVE-2017-3305, a potential man-in-the-middle vulnerability for installations using MySQL over the network. #2311
Cross-Site Scripting (XSS) vulnerability in project import file names for gitlab_project import types
Timo Schmid from ERNW reported a persistent Cross-Site Scripting vulnerability in the new
project import view for gitlab_project import types. This XSS vulnerability was
caused by the use of Hamlit filters inside HAML views without manually escaping
HTML. Unlike content outside of a filter, content inside Hamlit filters (
:plain) is not automatically escaped. #28325
Cross-Site Scripting (XSS) vulnerability in git submodule support
Cross-Site Scripting (XSS) vulnerability in repository "new branch" view
A GitLab user reported a persistent XSS vulnerability in the repository new
branch view that allowed malicious branch names or
git references to execute
Cross-Site Scripting (XSS) vulnerability in mirror errors display
While investigating Timo Schmid's previously reported XSS vulnerability in import filenames another persistent XSS vulnerability was discovered in the GitLab Enterprise Edition's (EE) mirror view. This vulnerability was also caused by the misuse of Hamlit filters. #28325
Potential XSS vulnerability in DropLab
An internal code audit disclosed a vulnerability in DropLab's templating that, while not currently exploitable, could become exploitable depending on how the templates were used in the future. This is a preventative patch. #30761
Tab Nabbing vulnerabilities in mardown link filter, Asciidoc files, and other markup files
edio via HackerOne reported two tab nabbing vulnerabilities. The first tab nabbing vulnerability was caused by improper hostname filtering when identifying user-supplied external links. GitLab did not properly filter usernames from the URL. An attacker could construct a specially crafted link including a username to bypass GitLab's external link filter. This allowed an attacker to post links in Markdown that did not include the appropriate "noreferrer noopener" options, allowing tab nabbing attacks.
The second vulnerability was in the AsciiDoctor markup library. AsciiDoctor was not properly including the "noreferrer noopener" options with external links. An internal investigation discovered other markup libraries that were also vulnerable. #29413 / #29374
Unauthorized disclosure of wiki pages in search
M. Hasbini reported a flaw in the project search feature that allowed authenticated users to disclose the contents of private wiki pages inside public projects. #31157
External users can view internal snippets
Christian Kühn discovered a vulnerability in GitLab snippets that allowed an external user to view the contents of internal snippets. #30487
Subgroup visibility for private subgroups under a public parent group
Matt Harrison discovered a vulnerability with subgroups that allowed private subgroup names to be disclosed when they belong to a parent group that is public. #31068
- GitLab CE+EE Omnibus (with Mattermost enabled) 7.14-8.17.5, 9.0.0-9.0.6, 9.1.0-9.1.2
Update mysql to 5.5.56 for CVE-2017-3305:
- GitLab CE+EE Omnibus (with MySQL enabled) All versions up to and including 8.17.5, 9.0.0-9.0.6, 9.1.0-9.1.2
Cross-Site Scripting (XSS) vulnerability in mirror errors display:
- GitLab EE 9.0.0-9.0.6, 9.1.0-9.1.2
Cross-Site Scripting (XSS) vulnerability in project import via GitLab export (file names):
- GitLab CE+EE 8.3.0-8.17.5, 9.0.0-9.0.6, 9.1.0-9.1.2
Cross-Site Scripting (XSS) vulnerability in repository "new branch" view:
- GitLab CE+EE 8.13.0-8.17.5, 9.0.0-9.0.6, 9.1.0-9.1.2
Persistent XSS in git submodule support:
- GitLab CE+EE 6.6.0-8.17.5, 9.0.0-9.0.6, 9.1.0-9.1.2
Potential XSS vulnerability in DropLab:
- GitLab CE+EE 9.1.0-9.1.2
Subgroup visibility for private subgroups under a public parent group:
- GitLab CE+EE 9.0.0-9.0.6,9.1.0-9.1.2
Tab Nabbing vulnerabilities in mardown link filter, Asciidoc files, and other markup files:
- AsciiDoctor: GitLab CE+EE 7.12.0-8.17.5, 9.0.0-9.0.6, 9.1.0-9.1.2
- Markdown links: GitLab CE+EE 8.14.0-8.17.5, 9.0.0-9.0.6, 9.1.0-9.1.2
Unauthorized disclosure of wiki pages in search:
- GitLab CE+EE 8.14.0-8.17.5, 9.0.0-9.0.6, 9.1.0-9.1.2
External Users can view internal snippets:
- GitLab CE+EE 7.4.0-8.17.5, 9.0.0-9.0.6, 9.1.0-9.1.2
We recommend that all installations running a version mentioned above be upgraded as soon as possible. No workarounds are available for these vulnerabilities.
These versions do not include any migrations and will not require downtime.
Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-migrations file.
To update, check out our update page.
Interested in GitLab Enterprise Edition? Check out the features exclusive to EE.
Access to GitLab Enterprise Edition is included with a subscription. No time to upgrade GitLab yourself? Subscribers receive upgrade and installation services.