Oct 31, 2014 - Jacob Vosmaer

GitLab not affected by Rails vulnerability CVE-2014-7818

Ruby on Rails released a security advisory for file existence disclosure vulnerability CVE-2014-7818. GitLab is not affected.

Yesterday the developers of Ruby on Rails released a security advisory for file existence disclosure vulnerability CVE-2014-7818. GitLab is not affected by this vulnerability.

Background

CVE-2014-7818 affects Rails applications which have the config.serve_static_assets = true setting. GitLab is shipped with config.serve_static_assets set to false in config/environments/production.rb because it lets NGINX (or Apache) serve static files.

Please contact us at support@gitlab.com if you have any questions about this issue.

GitLab not affected by Rails vulnerability CVE-2014-7818 Click to tweet!

Try all GitLab features - free for 30 days

GitLab is more than just source code management or CI/CD. It is a full software development lifecycle & DevOps tool in a single application.

Try GitLab Free

Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license

View page source — Edit in Web IDE — please contribute.

GitLab not affected by Rails vulnerability CVE-2014-7818

Background

More Posts Like This:

We're working to empower Minorities in Tech with a new employee resource group

How diversity, inclusion, and belonging looks in the tech industry

Our journey to a more diverse and inclusive workplace

Simple deployment to Amazon EKS

How GitLab boosts collaboration through visibility, accountability, and measurement

GitLab 8.7 Release Webcast Recording and Slides

Try all GitLab features - free for 30 days