Nov 25, 2015 - Jacob Vosmaer  

GitLab 8.2.1 security release

Learn more about GitLab Release 8.2.1 for GitLab Community Edition (CE) and Enterprise Edition (EE)

We have found a remote code execution vulnerability in gitlab-shell 2.6.6 and 2.6.7. This affects GitLab Community Edition 8.2.0 and GitLab Enterprise Edition 8.2.0. GitLab 8.1.4 and earlier versions are not affected by this vulnerability.

This release also contains a number of other fixes, please see below for details.

GitLab allows users to push and pull Git data over SSH. To prevent full system access via SSH we use gitlab-shell, a program that sanitizes and validates SSH commands that run on the GitLab server to send and receive Git data. Due to a change in gitlab-shell 2.6.6-2.6.7, an attacker who has a user account on a GitLab server can bypass the sanitization in gitlab-shell and run arbitrary commands on the GitLab server.

The only versions of GitLab that include a vulnerable version of gitlab-shell are GitLab Community Edition 8.2.0 and GitLab Enterprise Edition 8.2.0. If you are still running GitLab 8.1 or earlier then you are not affected by this vulnerability. As an administrator you can check your gitlab-shell version by going to and looking in the upper right corner in the 'Components' section. Only gitlab-shell versions 2.6.6 and 2.6.7 are affected.

If you installed GitLab 8.2.0 on your server then you should upgrade immediately.

Other changes in 8.2.1

  • Fix saving GitLabCiService as Admin Template
  • Fix the artifacts storage path
  • Update required version of LFS client and separate the docs for users and admins
  • Omnibus: create directories for artifacts and lfs-objects
  • Omnibus: Make deploy page show on all pages when up

See the CHANGELOG for more information.

We want to hear from you

Enjoyed reading this blog post or have questions or feedback? Share your thoughts by creating a new topic in the GitLab community forum.

Share your feedback

Take GitLab for a spin

See what your team could do with The DevSecOps Platform.

Get free trial

Have a question? We're here to help.

Talk to an expert
Edit this page View source