GitLab Security Release: 11.11.1, 11.10.5, and 11.9.12

Today we are releasing versions 11.11.1, 11.10.5, and 11.9.12 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.

The vulnerability details will be made public on our issue tracker in approximately 30 days.

Please read on for more information regarding this release.

Remote Command Execution Vulnerability on Repository Download Feature

A specially crafted payload would allow an authenticated malicious user to execute commands remotely through the repository download feature. The issue is now mitigated in the latest release and is assigned CVE-2019-12430.

Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 11.11.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Confidential Issue Titles Revealed to Restricted Users on Unsubscribe

Non-member users who subscribed to issue notifications could access the title of confidential issues through the unsubscription page. The issue is now mitigated in the latest release and is assigned CVE-2019-12432.

Thanks to @skavans for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 8.13 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Disclosure of Milestone Metadata through the Search API

Restricted users could access the metadata of private milestones through the Search API. The issue is now mitigated in the latest release and is assigned CVE-2019-12431.

Thanks to @xanbanx for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 8.13 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Private Project Discovery via Comment Links

Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. The issue is now mitigated in the latest release and is assigned CVE-2019-12434.

Thanks to @ashish_r_padelkar for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 10.6 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Metadata of Confidential Issues Disclosed to Restricted Users

Unprivileged users were able to access labels, status and merge request counts of confidential issues via the milestone details page. The issue is now mitigated in the latest release and is assigned CVE-2019-12429.

Thanks to @ashish_r_padelkar for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 11.9 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Mandatory External Authentication Provider Sign-In Restrictions Bypass

Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. The issue is now mitigated in the latest release and is assigned CVE-2019-12428.

Thanks to @ngalog for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 6.8 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Internal Projects Allowed to Be Created on in Private Groups

Restricted visibility settings allow creating internal projects in private groups, leading to multiple permission issues. The issue is now mitigated in the latest release and is assigned CVE-2019-12433.

Thanks to Peter Marko for contributing with a fix for this issue.

Versions Affected

Affects GitLab CE/EE 11.7 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Server-Side Request Forgery Through DNS Rebinding

Multiple features contained Server-Side Request Forgery (SSRF) vulnerabilities caused by an insufficient validation to prevent DNS rebinding attacks. The issue is now mitigated in the latest release and is assigned CVE-2019-12443.

Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 10.2 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Note: The protection against DNS rebinding attacks can be disabled by unmarking the "Enforce DNS rebinding attack protection" checkbox under Admin Area > Settings > Network > Outbound requests

Stored Cross-Site Scripting on Wiki Pages

Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability. The issue is now mitigated in the latest release and is assigned CVE-2019-12444.

Thanks to @ryhmnlfj for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 8.9 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Stored Cross-Site Scripting on Notes

A malicious user could execute JavaScript code on notes by importing a specially crafted project file. The issue is now mitigated in the latest release and is assigned CVE-2019-12445.

Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 8.4 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Repository Password Disclosed on Import Error Page

A failure while importing a repository by URL would render an error page containing the plaintext password of the repository to import. The issue is now mitigated in the latest release and is assigned CVE-2019-12446.

Thanks to @vandebrj for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 8.3 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Protected Branches Restriction Rules Bypass

The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. The issue is now mitigated in the latest release and is assigned CVE-2019-12441.

Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab CE/EE 8.4 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Stored Cross-Site Scripting Vulnerability on Child Epics

The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics. The issue is now mitigated in the latest release and is assigned CVE-2019-12442.

Thanks to @near_ for responsibly reporting this vulnerability to us.

Versions Affected

Affects GitLab EE 11.7 and later.

Remediation

We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.

Upgrade to Knative 0.5

Knative was upgraded to version 0.5 for the GitLab 11.11, 11.10 and 11.9 packages. This Knative release contains several security fixes.

Updating

To update GitLab, see the update page.