The OpenSSL developers released a security advisory yesterday advising all users of OpenSSL 1.0.1 to upgrade to version 1.0.1h in light of vulnerabilities CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298and CVE-2010-5298. This affects users of omnibus-gitlab because omnibus-gitlab packages contain their own copy of OpenSSL 1.0.1. Today we are releasing new omnibus packages for GitLab 6.9.2 CE and GitLab 6.9.3 EE which contain OpenSSL 1.0.1h.
Versions affected: omnibus-gitlab 6.9.2.omnibus and older, omnibus-gitlab 6.9.3-ee.omnibus and older.
Versions fixed: omnibus-gitlab 6.9.2.omnibus.1, omnibus-gitlab 6.9.3-ee.omnibus.1.
Checking your omnibus-gitlab OpenSSL version
You can check the version of OpenSSL in your omnibus-gitlab installation by running the following command.
grep openssl /opt/gitlab/version-manifest.txt
If the OpenSSL version is 1.0.1g or lower you need to update omnibus-gitlab to the latest version.
Please contact us at support.gitlab.comif you have any questions.