GitLab Patch Release: 17.2.1, 17.1.3, 17.0.5

Today we are releasing versions 17.2.1, 17.1.3, 17.0.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.

GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

Title	Severity
XSS via the Maven Dependency Proxy	High
Project level analytics settings leaked in DOM	Medium
Reports can access and download job artifacts despite use of settings to prevent it	Medium
Direct Transfer - Authorised project/group exports are accessible to other users	Medium
Bypassing tag check and branch check through imports	Low
Project Import/Export - Make project/group export files hidden to everyone except user who initiated it	Low

XSS via the Maven Dependency Proxy

A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user. This is a high severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.7)

This vulnerability has been discovered internally by GitLab team member Joern Schneeweisz.

Project level analytics settings leaked in DOM

An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N , 4.4). It is now mitigated in the latest release and is assigned CVE-2024-5067.

Thanks yvvdwf and zebraman for reporting this vulnerability through our HackerOne bug bounty program.

Reports can access and download job artifacts despite use of settings to prevent it

An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where job artifacts can be inappropriately exposed to users lacking the proper authorization level. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-7057.

Thanks ricardobrito for reporting this vulnerability through our HackerOne bug bounty program.

Direct Transfer - Authorised project/group exports are accessible to other users

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where it was possible to disclose limited information of an exported group or project to another user.

This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N, 4.1 ).

This vulnerability was found internally by a GitLab team member James Nutt.

Bypassing tag check and branch check through imports

A resource misdirection vulnerability in GitLab CE/EE affecting all versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft a repository import in such a way as to misdirect commits. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N, 2.7). It is now mitigated in the latest release and is assigned CVE-2024-0231.

Thanks aaron_dewes for reporting this vulnerability through our HackerOne bug bounty program.

Project Import/Export - Make project/group export files hidden to everyone except user who initiated it

An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export. This is a low severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N, 2.6).

This vulnerability has been discovered internally by GitLab team member Martin Wortschack

Bug fixes

17.2.1

• Revert "Ensure page token is for the same tree"
• Fix order-dependent Elasticsearch spec failure
• Backport to run Release Environments on RC tag into '17-2-stable-ee'
• Fix state leak in cluster_util_spec.rb
• Ensure rspec helpers call curl with –fail
• Run e2e:package-and-test-ee for MR targeting stable branches
• Remove build-gdk-image, e2e:test-on-gdk, and retag-gdk-image jobs (17.2)
• 17.2 backport for fix PEP when SEC is available
• bugfix: Only run advanced SAST job when Ultimate license present
• Backport pipeline fixes for 17.2
• Private dotenv artifacts not accessible to downstream jobs

17.1.3

• Backport mock tag cleanup related fixes
• Multiarch fixes backport (17.1)
• Backport release-environments pipeline in security repo to 17.1
• Backport [17.1] Fix empty minimum_should_match in query
• Fix wildcard search for package.json in npm upload
• NPM registry: replace the saj parser (17.1 backport)
• Fix Content-Disposition header for Azure in API download (17.1 Backport)
• Fix order-dependent Elasticsearch spec failure
• Backport to run Release Environments on RC tag into '17-1-stable-ee'
• Fix state leak in cluster_util_spec.rb
• Merge branch 'sh-curl-fail-ci' into 'master' - 17.1
• Ignore object pool already exists creation errors 17.1
• Backport token logging improvements
• Backport add Rake task to show token expiration info
• Remove build-gdk-image, e2e:test-on-gdk, and retag-gdk-image jobs (17.1)
• Backport pipeline fixes for 17.1
• Private dotenv artifacts not accessible to downstream jobs

17.0.5

• Backport mock tag cleanup related fixes
• Multiarch fixes backport (17.0)
• Backport to run Release Environments on RC tag into '17-0-stable-ee'
• Backport Resolve "Geo: JWT token expiration too short"
• Ignore object pool already exists creation errors 17.0
• Fix 500 error using a instance runner registration token
• Backport token logging improvements
• Drop migration that finalizes migration to add PAT expiration
• Update the token expiration banner
• Backport add Rake task to show token expiration info
• Fix order-dependent custom role definition spec failure
• Backport pipeline fixes for 17.0
• Private dotenv artifacts not accessible to downstream jobs

16.11.7

• Backport Resolve "Geo: JWT token expiration too short"
• Ignore object pool already exists creation errors 17.0
• Backport token logging improvements
• Drop migration that finalizes migration to add PAT expiration
• Update the token expiration banner
• Backport add Rake task to show token expiration info

16.10.9

• Backport token logging improvements
• Drop migration that finalizes migration to add PAT expiration
• Update the token expiration banner
• Backport add Rake task to show token expiration info

16.9.10

• Backport token logging improvements
• Drop migration that finalizes migration to add PAT expiration
• Update the token expiration banner
• Backport add Rake task to show token expiration info

16.8.9

• Backport token logging improvements
• Drop migration that finalizes migration to add PAT expiration
• Update the token expiration banner
• Backport add Rake task to show token expiration info

16.7.9

• Backport token logging improvements
• Drop migration that finalizes migration to add PAT expiration
• Update the token expiration banner
• Backport add Rake task to show token expiration info

16.6.9

• Backport token logging improvements
• Drop migration that finalizes migration to add PAT expiration
• Update the token expiration banner
• Backport add Rake task to show token expiration info

16.5.9

• Backport token logging improvements
• Drop migration that finalizes migration to add PAT expiration
• Add the token expiration banner
• Backport add Rake task to show token expiration info

16.4.6

• Drop migration that finalizes migration to add PAT expiration
• Add the token expiration banner
• Backport add Rake task to show token expiration info

16.3.8

• Drop migration that finalizes migration to add PAT expiration
• Add the token expiration banner
• Backport add Rake task to show token expiration info

16.2.10

• Drop migration that finalizes migration to add PAT expiration
• Add the token expiration banner
• Backport add Rake task to show token expiration info

16.1.7

• Drop migration that finalizes migration to add PAT expiration
• Add the token expiration banner
• Backport add Rake task to show token expiration info

16.0.9

• Drop migration that finalizes migration to add PAT expiration
• Add the token expiration banner
• Backport add Rake task to show token expiration info

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

We’re combining patch and security releases

This improvement in our release process matches the industry standard and will help GitLab users get information about security and bug fixes sooner, read the blog post here.