Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2025/VULN355 _____________________________________________________________________ DATE : 12/06/2025 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running GitLab versions prior to 18.0.2, 17.11.4, 17.10.8. ===================================================================== https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/ _____________________________________________________________________ GitLab Patch Release: 18.0.2, 17.11.4, 17.10.8 Learn more about GitLab Patch Release: 18.0.2, 17.11.4, 17.10.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). Today, we are releasing versions 18.0.2, 17.11.4, 17.10.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook page and security FAQ. You can see all of GitLab’s release blog posts here. For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched. We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post. Recommended Action We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible. When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected. Security fixes Table of security fixes Title Severity HTML injection impacts GitLab CE/EE High Cross-site scripting issue impacts GitLab CE/EE High Missing authorization issue impacts GitLab Ultimate EE High Denial of Service impacts GitLab CE/EE High Denial of Service via unbounded Webhook token names impacts GitLab CE/EE Medium Denial of Service via unbounded Board Names impacts GitLab CE/EE Medium Information disclosure issue impacts GitLab CE/EE Medium Denial of Service (DoS) via uncontrolled HTTP Response Processing impacts GitLab CE/EE Medium Information disclosure via authorization bypass impacts GitLab CE/EE Medium Sensitive information disclosure via Group IP restriction bypass Low CVE-2025-4278 - HTML injection impacts GitLab CE/EE GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to achieve account takeover by injecting code into the search page. Impacted versions GitLab CE/EE: all versions starting with 18.0 before 18.0.2. CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program. CVE-2025-2254 - Cross-site scripting issue impacts GitLab CE/EE GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to act in the context of a legitimate user by injecting a malicious script into the snippet viewer. Impacted versions GitLab CE/EE: all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2 CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program. CVE-2025-5121 - Missing authorization issue impacts GitLab Ultimate EE GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker with authenticated access to a GitLab instance with a GitLab Ultimate license applied (paid customer or trial) to inject a malicious CI/CD job into all future CI/CD pipelines of any project. Impacted versions GitLab Ultimate EE from 17.11 before 17.11.4 and 18.0 before 18.0.2. CVSS 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Thanks jean_d-ou for reporting this vulnerability through our HackerOne bug bounty program. CVE-2025-0673 - Denial of Service impacts GitLab CE/EE GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by triggering an infinite redirect loop causing memory exhaustion on the server. Impacted versions GitLab CE/EE: all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2 CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program. CVE-2025-1516 - Denial of Service via unbounded Webhook token names impacts GitLab CE/EE GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by generating tokens with sufficiently large names. Impacted versions GitLab CE/EE: all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2 CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program. CVE-2025-1478 - Denial of Service via unbounded Board Names impacts GitLab CE/EE GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by crafting Board Names with sufficiently large sizes. Impacted versions GitLab CE/EE: all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1 CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program. CVE-2024-9512 - Information disclosure issue impacts GitLab CE/EE GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to clone a legitimate user’s private repository by sending a timed clone request when a secondary node is out of sync. Impacted versions GitLab CE/EE: all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2 CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Thanks hdtran for reporting this vulnerability through our HackerOne bug bounty program. CVE-2025-5996 - Denial of Service (DoS) via uncontrolled HTTP Response Processing impacts GitLab CE/EE GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by integrating a malicious third-party component into a GitLab project. Impacted versions GitLab CE/EE: versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2 CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program. CVE-2025-5195 - Information disclosure via authorization bypass impacts GitLab CE/EE GitLab has remediated an issue that could have allowed authenticated users to gain access to data beyond their privilege boundaries by accessing arbitrary compliance frameworks. Impacted versions GitLab CE/EE: all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1 CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) This vulnerability has been discovered internally by a member of the GitLab team. CVE-2025-5982 - Sensitive information disclosure via Group IP restriction bypass GitLab has remediated an issue that could have allowed a successful attacker to bypass IP access restrictions and view sensitive group information. Impacted versions GitLab EE: versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) This vulnerability has been discovered internally by GitLab team member @joernchen. Bug fixes 18.0.2 Move fork_networks organization_id NOT NULL to post-migrate [Backport] Zoekt: Only enable search when nodes are online 18-0-stable-ee: Trim pages deployment file name to 60 characters Fix gitpod button is missing in the edit dropdown [Backport] Elastic::MigrationWorker should not create migrations index Backport operational data_category for duo_core_features_enabled metric on service ping [Backport] Fix IDE links returns about:blank in old code dropdow Fix the title/body issue for todo apis when it is a duo todo Add 18.0 "What's New" entries [Backport] mark_all_as_completed! method should drop halted cache & save halted: false Fix "No such column: geo_nodes.verification_max_capacity" [backport] 18.0: Merge branch 'dj-stable-branch-dont-fail-e2e' into 'master' [backport] 18.0: Merge branch 'dj-refactor-semgrep-ci' into 'master' [backport] 18.0: Remove e2e:test-on-omnibus-ee from tier 1 backport MRs Fix libarchive checksum script (Backport 18.0) Warn on changes to tag only CI job definitions Backport postponing deprecation to 19.0 17.11.4 [backport] 17.11: Remove jest vue3 check quarantine jobs from backport MR pipelines 17-11-stable-ee: Trim pages deployment file name to 60 characters Fix gitpod button is missing in the edit dropdown [backport] 17.11: Merge branch 'dj-stable-branch-dont-fail-e2e' into 'master' Merge '535187-fix-console-errors' into '17-11-stable-ee' Attempt to migrate ci_runner_taggings table (try 2) [backport] 17.11: Remove e2e:test-on-omnibus-ee from tier 1 backport MRs [backport] 17.11: Merge branch 'dj-refactor-semgrep-ci' into 'master' Fix libarchive checksum script (Backport 17.11) 17.10.8 [backport] 17.10: Remove jest vue3 check quarantine jobs from backport MR pipelines Fix gitpod button is missing in the edit dropdown [backport] 17.10: Merge branch 'dj-stable-branch-dont-fail-e2e' into 'master' Attempt to migrate ci_runner_taggings table (try 2) [backport] 17.10: Merge branch 'dj-refactor-semgrep-ci' into 'master' [backport] 17.10: Remove e2e:test-on-omnibus-ee from tier 1 backport MRs Fix libarchive checksum script (Backport 17.10) Updating To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page. Receive Patch Notifications To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases. ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================