GitLab Security Release: 11.3.1, 11.2.4, and 11.1.7

Note: 11.1.7 is still vulnerable to these issues because of a mistake tagging the release. Please upgrade to 11.1.8.

Today we are releasing versions 11.3.1, 11.2.4, and 11.1.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain a number of important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.

The vulnerability details will be made public on our issue tracker in approximately 30 days.

Please read on for more information regarding this release.

SSRF GCP access token disclosure

The GitLab Kubernetes integration was vulnerable to a SSRF issue which allowed for access to any URL accessible from the GitLab server. For example, for users which run GitLab on GCP, an attacker with access to use the GitLab instance would have been able to determine the GCP service token for the GitLab host. The issue is now mitigated in the latest release and is assigned CVE-2018-17450.

Thanks to @ngalog for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 10.2 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Persistent XSS on issue details

The issue details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned CVE-2018-17454.

Thanks to @8ayac for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 9.3 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Diff formatter DoS in Sidekiq jobs

The diff formatter using rouge lacks timeout in Sidekiq jobs which can result in a denial of service. The issue is now mitigated in the latest release and is assigned CVE-2018-15472.

Thanks to Bastian Blank for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 7.6 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Confidential information disclosure in events API endpoint

The events API contained insecure direct object reference issue which resulted in disclosure of confidential issues, comments, and titles of public projects. The issue is now mitigated in the latest release and is assigned CVE-2018-17449.

Thanks to @ngalog for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 9.3 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

validate_localhost function in url_blocker.rb could be bypassed

The validate_localhost function was missing a check for loopback addresses which could result in SSRF issues. The issue is now mitigated in the latest release and is assigned CVE-2018-17452.

Thanks to @math1as for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 8.3 and up.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Slack integration CSRF Oauth2

The Slack integration contained a CSRF issue which could allow an attacker to issue slash commands on behalf of the victim. The issue is now mitigated in the latest release and is assigned CVE-2018-17451.

Thanks to @ngalog for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 9.4 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

GRPC::Unknown logging token disclosure

The GRPC::Unknown exception was disclosing access tokens in Sentry logs. The issue is now mitigated in the latest release and is assigned CVE-2018-17453.

Versions Affected

Affects GitLab CE/EE 10.4 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

IDOR merge request approvals

The merge request approvals component contained an insecure direct object reference vulnerability which resulted in disclosure of private group names, avatars, LDAP settings, and descriptions. The issue is now mitigated in the latest release and is assigned CVE-2018-17455.

Thanks to @jobert for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab EE 8.13 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Persistent XSS package.json

When a package.json file is present, the blog-viewer will display a notice when browsing the repository which lacks input validation and output encoding which can result in a persistent XSS. The issue is now mitigated in the latest release and is assigned CVE-2018-17537.

Thanks to @fransrosen for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 10.4 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Persistent XSS merge request project import

The merge request page contained a lack of input validation and output encoding issue which resulted in a persistent XSS. The issue is now mitigated in the latest release and is assigned CVE-2018-17536.

Thanks to @isra17 for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 10.4 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Updating

To update, check out our update page.