GitLab Security Release: 16.3.1, 16.2.5, and 16.1.5

Today we are releasing versions 16.3.1, 16.2.5 and 16.1.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.

GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our security FAQ. You can see all of our regular and security release blog posts here. In addition, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Table of Fixes

Title	Severity
Privilege escalation of "external user" to internal access through group service account	medium
Maintainer can leak sentry token by changing the configured URL (fix bypass)	medium
Google Cloud Logging private key showed in plain text in GitLab UI leaking to other group owners	medium
Information disclosure via project import endpoint	medium
Developer can leak DAST scanners "Site Profile" request headers and auth password	medium
Project forking outside current group	medium
User is capable of creating Model experiment and updating existing run's status in public project	medium
ReDoS in bulk import API	medium
Pagination for Branches and Tags can be skipped leading to DoS	medium
Internal Open Redirection Due to Improper handling of "../" characters	low
Subgroup Member With Reporter Role Can Edit Group Labels	low
Banned user can delete package registries	low

Privilege escalation of "external user" to internal access through group service account

An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified as external and may be used to access internal projects. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, 6.5). It is now mitigated in the latest release and is assigned CVE-2023-3915.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Maintainer can leak sentry token by changing the configured URL (fix bypass)

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, 5.5). It is now mitigated in the latest release and is assigned [CVE-2023-4378](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4378.

Thanks 70rpedo for reporting this vulnerability through our HackerOne bug bounty program.

Google Cloud Logging private key showed in plain text in GitLab UI leaking to other group owners

An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, 5.5), and affects only GitLab EE. It is now mitigated in the latest release and is assigned [CVE-2023-3950](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3950.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Information disclosure via project import endpoint

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, 5.0). It is now mitigated in the latest release and is assigned CVE-2023-4630.

This vulnerability was found internally by a GitLab team member Rodrigo Tomonari.

Developer can leak DAST scanners "Site Profile" request headers and auth password

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site profile. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, 5.0), and only affects GitLab EE. It is now mitigated in the latest release and is assigned CVE-2022-4343.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Project forking outside current group

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.3 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to fork a project outside of current group by an unauthorised user. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2023-4638.

Thanks theluci for reporting this vulnerability through our HackerOne bug bounty program.

User is capable of creating Model experiment and updating existing run's status in public project

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2023-4018.

Thanks ricardobrito for reporting this vulnerability through our HackerOne bug bounty program

ReDoS in bulk import API

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,6.5). It is now mitigated in the latest release and is assigned CVE-2023-3205.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

Pagination for Branches and Tags can be skipped leading to DoS

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.3). It is now mitigated in the latest release and is assigned CVE-2023-4647.

This vulnerability has been discovered internally by GitLab team member Vasilii Iakliushin

Internal Open Redirection Due to Improper handling of "../" characters

An issue has been discovered in GitLab CE/EE affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, 3.5). It is now mitigated in the latest release and is assigned CVE-2023-1279.

Thanks akadrian for reporting this vulnerability through our HackerOne bug bounty program.

Subgroup Member With Reporter Role Can Edit Group Labels

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, 3.5). It is now mitigated in the latest release and is assigned CVE-2023-0120.

Thanks drjgouveia for reporting this vulnerability through our HackerOne bug bounty program.

Banned user can delete package registries

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N, 2.7). It is now mitigated in the latest release and is assigned CVE-2023-1555.

Thanks ali_shehab for reporting this vulnerability through our HackerOne bug bounty program.

Update commonmarker

Commonmarker has been updated to version 0.23.10 in order to mitigate security issues.

Update openssl

Openssl has been updated to version to 1.1.1u in order to mitigate security issues.

Non Security Patches

This security release also includes the following non-security patches.

16.3.1

• Remove unified URL limitation for GitLab chart (16.3 backport)
• Revert migration to backfill archived in wikis
• Add .net to context selector to skip live envs
• Backport "Geo: Resync direct upload object stored artifacts" to 16.3
• CSP: disable LFS url when not using object storage
• Backport LicenseScanning fix for AutoDevOps

16.2.5

• Backport "cgroup: using a noop manager on linux without cgroup" fix to 16.2
• Adjust Danger logic for stable branches
• Backport "Geo: Resync direct upload object stored artifacts" to 16.2

16.1.5

• Revert "Log rails response length" - 16.1 Backport
• Adjust Danger logic for stable branches
• Backport "Geo: Resync direct upload object stored artifacts" to 16.1

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Security Release Notifications

To receive security release blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our security release RSS feed or our RSS feed for all releases.