GitLab Critical Patch Release (docs.gitlab.com)
129 points by artooro 3 hours ago
jimmyl02 an hour ago
Awesome find by https://hackerone.com/joaxcar and it's a little bit frightening that this severe of a bug isn't the biggest security vulnerability of today
hobofan 6 minutes ago
This is shaping up to be the single worst security news day ever. Given the role that AI played in some of the discoveries, one has to wonder if this marks the start of some dark age of IT security.
Thaxll an hour ago
What a great week security wise!
minimaxir 30 minutes ago
And Fable 5.5 isn't even out yet!
miduil 23 minutes ago
At least second regex related CVE in GitLab in the past few weeks. Awful to see that the endpoint is reachable unauthenticated, but I'm glad that they provide guidance in how to check the logs for attempts of exploitation
dvdkon 16 minutes ago
As far as I can tell, it requires forcing GitLab to render a malicious org-mode file. I don't really see a way to do that without authenticating and uploading one. Am I missing something?
ezekg an hour ago
Is this a bug in GitLab or in Ruby? It's hard to tell from the report and the patch...
pqdbr 32 minutes ago
Or Rails...
perlgeek an hour ago
Back in perl 5.8 and older, the regex engine worked by recusing at the level of C functions, and so you could trigger stack overflows by giving it large strings.
Is this similar?
I wonder why gitlab even has its own regex compiler. Or is this a vulnerability in an underlying library or programming language?
wiml an hour ago
Looks like Gitlab ships its own forked copy of the Ruby Onigmo regex engine.
beaconflint 2 hours ago
If you're patching a fleet, gitlab-rake gitlab:env:info gives you the exact version per node, faster than guessing from the omnibus package name.
bon0r an hour ago
possible bug? or too soon to check? :)
after updating a pop-up still shows:
"You are currently on version 19.5.1! We strongly recommend upgrading your GitLab installation immediately."
while 19.5.1 should be the latest and fixed version
artooro an hour ago
Their update checker has never worked very well. It takes hours to stop getting the upgrade warning inside of the GitLab dashboard.
merb an hour ago
I have that aswell…
But I also updated pretty early.
minraws an hour ago
I am concerned for my self hosted servers, well only hope is tailscale should be entirely secure, and egress is filtered heavily... If that doesn't work my home lab is fucked.
Any suggestions folks, not even my terminally online self can handle all of these.
tptacek 2 hours ago
"CVSS 10.0" isn't in the headline here and a CVSS of 10 doesn't actually mean anything.
phoe-krk 2 hours ago
Deeper in the article: https://docs.gitlab.com/releases/patches/patch-release-gitla...
GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression. (...)
CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Here, CVSS 10.0 means arbitrary remote code execution.
tptacek 2 hours ago
"Arbitrary RCE" does mean something. "CVSS 10.0" does not. We should be using the article headline here.
phoe-krk 2 hours ago
artooro an hour ago
ivanjermakov 2 hours ago
Because "10 out of 10" is a better headline for the average reader than "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H".
Retr0id 2 hours ago
Sometimes CVSS 10 "oversells" the true severity of a bug but this doesn't seem to be one of those cases.
TZubiri 2 hours ago
>CVSS of 10 doesn't actually mean anything.
Might you perchance be exaggerating?
tptacek 2 hours ago
No? CVSS is a Ouija board. Citrix directory traversal got scored 10.0. So did a Cisco Broadworks SSO bypass. Meanwhile, Shellshock did not.
CVSS is like the Pitchfork Music ratings scale. It communicates false precision, and it's easy to point to places where that precision misleads (D-plan's "Emergency & I" is not better than every Yo La Tengo album).