GitLab Security Release: 11.1.2, 11.0.5, and 10.8.7

Gitlab is an opensource software that can be installed into CVE-2018-14601.

Versions Affected

Affects GitLab CE/EE 11.1.0.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Information Disclosure Prometheus Metrics

GitLab Prometheus metrics was disclosing private project pathnames. This also affected the Prometheus instances on monitor.gitlab.net. The issue is now resolved in the latest release and is assigned to CVE-2018-14602.

Versions Affected

Affects GitLab CE/EE 9.0 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

CSRF in System Hooks

The “Test” feature of the System Hooks component contained low severity CSRF vulnerability. The issue is now resolved in the latest release and is assigned to CVE-2018-14603.

Thanks to @sql00 for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 2.7.0pre and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Persistent XSS Pipeline Tooltip

The tooltip of the job inside the CI/CD pipeline was not properly sanitized and resulted in a persistent XSS. The issue is now resolved in the latest release and is assigned to CVE-2018-14604.

Thanks to @fransrosen for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 10.7 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Persistent XSS in Branch Name via Web IDE

The branch name was not properly sanitized when committing a file via the Web IDE which resulted in a persistent XSS. The issue is now resolved in the latest release and is assigned to CVE-2018-14605.

Thanks to @fransrosen for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 10.7 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Persistent XSS Milestone Promotion

When promoting a Milestone, the name of the Milestone is not sanitized properly which results in the notification to trigger a persistent XSS. The issue is now resolved in the latest release and is assigned to CVE-2018-14606.

Thanks to @fransrosen for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 10.6 and later.

Remediation

We strongly recommend that all installations running an affected version above to be upgraded to the latest version as soon as possible.

Mattermost Updates

Mattermost has been updated to version 5.0.2, and it contains a security fix that’s also been backported to 4.10.2.

For more information, see Mattermost security updates page.

Updating

To update, check out our update page.

Gitlab is an opensource software that can be installed into
>
WhatsApp WhatsApp us