===================================================================== CERT-Renater Note d'Information No. 2023/VULN283 _____________________________________________________________________ DATE : 01/09/2023 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running GitLab versions prior to 16.3.1, 16.2.5, 16.1.5. ===================================================================== https://about.gitlab.com/releases/2023/08/31/security-release-gitlab-16-3-1-released/ _____________________________________________________________________ GitLab Security Release: 16.3.1, 16.2.5, and 16.1.5 Learn more about GitLab Security Release: 16.3.1, 16.2.5, and 16.1.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). Today we are releasing versions 16.3.1, 16.2.5 and 16.1.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our security FAQ. You can see all of our regular and security release blog posts here. In addition, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched. We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more best practices in securing your GitLab instance in our blog post. Recommended Action We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible. When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected. Table of Fixes Title Severity Privilege escalation of "external user" to internal access through group service account medium Maintainer can leak sentry token by changing the configured URL (fix bypass) medium Google Cloud Logging private key showed in plain text in GitLab UI leaking to other group owners medium Information disclosure via project import endpoint medium Developer can leak DAST scanners "Site Profile" request headers and auth password medium Project forking outside current group medium User is capable of creating Model experiment and updating existing run's status in public project medium ReDoS in bulk import API medium Pagination for Branches and Tags can be skipped leading to DoS medium Internal Open Redirection Due to Improper handling of "../" characters low Subgroup Member With Reporter Role Can Edit Group Labels low Banned user can delete package registries low Privilege escalation of "external user" to internal access through group service account An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified as external and may be used to access internal projects. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, 6.5). It is now mitigated in the latest release and is assigned CVE-2023-3915. Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program. Maintainer can leak sentry token by changing the configured URL (fix bypass) An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, 5.5). It is now mitigated in the latest release and is assigned [CVE-2023-4378](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4378. Thanks 70rpedo for reporting this vulnerability through our HackerOne bug bounty program. Google Cloud Logging private key showed in plain text in GitLab UI leaking to other group owners An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, 5.5), and affects only GitLab EE. It is now mitigated in the latest release and is assigned [CVE-2023-3950] (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3950. Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program. Information disclosure via project import endpoint An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, 5.0). It is now mitigated in the latest release and is assigned CVE-2023-4630. This vulnerability was found internally by a GitLab team member Rodrigo Tomonari. Developer can leak DAST scanners "Site Profile" request headers and auth password An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site profile. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, 5.0), and only affects GitLab EE. It is now mitigated in the latest release and is assigned CVE-2022-4343. Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program. Project forking outside current group An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.3 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to fork a project outside of current group by an unauthorised user. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2023-4638. Thanks theluci for reporting this vulnerability through our HackerOne bug bounty program. User is capable of creating Model experiment and updating existing run's status in public project An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2023-4018. Thanks ricardobrito for reporting this vulnerability through our HackerOne bug bounty program ReDoS in bulk import API An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,6.5). It is now mitigated in the latest release and is assigned CVE-2023-3205. Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program Pagination for Branches and Tags can be skipped leading to DoS An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.3). It is now mitigated in the latest release and is assigned CVE-2023-4647. This vulnerability has been discovered internally by GitLab team member Vasilii Iakliushin Internal Open Redirection Due to Improper handling of "../" characters An issue has been discovered in GitLab CE/EE affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, 3.5). It is now mitigated in the latest release and is assigned CVE-2023-1279. Thanks akadrian for reporting this vulnerability through our HackerOne bug bounty program. Subgroup Member With Reporter Role Can Edit Group Labels An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, 3.5). It is now mitigated in the latest release and is assigned CVE-2023-0120. Thanks drjgouveia for reporting this vulnerability through our HackerOne bug bounty program. Banned user can delete package registries An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N, 2.7). It is now mitigated in the latest release and is assigned CVE-2023-1555. Thanks ali_shehab for reporting this vulnerability through our HackerOne bug bounty program. Update commonmarker Commonmarker has been updated to version 0.23.10 in order to mitigate security issues. Update openssl Openssl has been updated to version to 1.1.1u in order to mitigate security issues. Non Security Patches This security release also includes the following non-security patches. 16.3.1 Remove unified URL limitation for GitLab chart (16.3 backport) Revert migration to backfill archived in wikis Add .net to context selector to skip live envs Backport "Geo: Resync direct upload object stored artifacts" to 16.3 CSP: disable LFS url when not using object storage Backport LicenseScanning fix for AutoDevOps 16.2.5 Backport "cgroup: using a noop manager on linux without cgroup" fix to 16.2 Adjust Danger logic for stable branches Backport "Geo: Resync direct upload object stored artifacts" to 16.2 16.1.5 Revert "Log rails response length" - 16.1 Backport Adjust Danger logic for stable branches Backport "Geo: Resync direct upload object stored artifacts" to 16.1 Updating To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page. Receive Security Release Notifications ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================