Today we are releasing versions 12.7.4, 12.6.6, and 12.5.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).
The vulnerability details will be made public on our issue tracker in approximately 30 days.
Please read on for more information regarding this release.
Path Traversal to Arbitrary File Read
The dependency proxy was found to have a path traversal vulnerability that if combined with an arbitrary file read vulnerability could potentially result in access to files and user data. The issue is now mitigated in the latest release and is assigned CVE-2020-7966.
Thanks to @nyangawa of Chaitin Tech for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab EE 11.11 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
User Permissions Not Validated in ProjectExportWorker
An internal investigation revealed that permissions were not being validated in the ProjectExportWorker for the user scheduling exports. The issue is now mitigated in the latest release and is assigned CVE-2020-8114.
Versions Affected
Affects GitLab EE 8.9 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
XSS Vulnerability in File API
Under certain conditions, requests involving the file API could result in an XSS vulnerability. The issue is now mitigated in the latest release and is assigned CVE-2020-7973.
Thanks to @rpadovani for responsibly reporting this vulnerability to us.
Versions Affected
Affects all previous GitLab versions.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Package and File Disclosure through GitLab Workhorse
An internal investigation revealed that a particular header could be used to override restrictions and result in the GitLab Workhorse disclosing packages and files in the /tmp
directory. The issue is now mitigated in the latest release and is assigned CVE-2020-6833.
Versions Affected
Affects GitLab EE 11.3 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
XSS Vulnerability in Create Groups
A stored XSS vulnerability was discovered using the create group functionality. The issue is now mitigated in the latest release and is assigned CVE-2020-7971.
Thanks to @rioncool22 for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab EE 11.0 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Issue and Merge Request Activity Counts Exposed
Despite project settings otherwise, non-members were able to view activity counts of issues and merge requests. The issue is now mitigated in the latest release and is assigned CVE-2020-7967.
Thanks to @ashish_r_padelkar for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab EE 12.0 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Email Confirmation Bypass Using API
It was discovered that a certain API endpoint could be used to bypass email verification requirements. The issue is now mitigated in the latest release and is assigned CVE-2020-7972.
Thanks to @whitehattushu for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab EE 12.0 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Disclosure of Forked Private Project Source Code
Authorization checks were not being applied in some cases for public repositories with merge request visibility set to members only, resulting in source code potentially being disclosed. The issue is now mitigated in the latest release and is assigned CVE-2020-7968.
Thanks to @ngalog for responsibly reporting this vulnerability to us.
Versions Affected
Affects all previous GitLab versions.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Private Project Names Exposed in GraphQL queries
Under certain conditions, particularly crafted GraphQL queries could expose private project names. The issue is now mitigated in the latest release and is assigned CVE-2020-7979.
Thanks to @ashish_r_padelkar for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab EE 12.0 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Disclosure of Issues and Merge Requests via Todos
Unexpired Todos could be leveraged to disclose (potentially confidential) issues and merge requests. The issue is now mitigated in the latest release and is assigned CVE-2020-7969.
Thanks to @xanbanx for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab EE 8.0 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Denial of Service via AsciiDoc
Certain payloads could result in a denial of service due to abuse of AsciiDoc includes. The issue is now mitigated in the latest release and is assigned CVE-2020-7978.
Thanks to @kgadyrka for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab EE 12.6 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Last Pipeline Status Exposed
Despite restrictions in place, the last pipeline status was visible via the commits API. The issue is now mitigated in the latest release and is assigned CVE-2020-7974.
Thanks to @ashish_r_padelkar for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab EE 10.1 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Arbitrary Change of Pipeline Status
Under certain conditions, a developer of a project can change the pipeline status of a protected branch to any value. The issue is now mitigated in the latest release and is assigned CVE-2020-7977.
Thanks to @rpadovani for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab EE 8.8 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Grafana Token Displayed in Plaintext
The Grafana token was displayed in plaintext on the settings page, but is now being masked. The issue is now mitigated in the latest release and is assigned CVE-2020-7976.
Thanks to @xanbanx for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab EE 12.4 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Update excon gem
The excon gem was updated to address a flaw within that library, identified as CVE-2019-16779.
Versions Affected
Affects GitLab 5.3 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Update rdoc gem
The rdoc gem was updated, which removed an older version of the jQuery library that had several known security vulnerabilities.
Versions Affected
Affects GitLab EE 12.6 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Update rack-cors gem
The rack-cors gem was updated to address a vulnerability in that library, CVE-2019-18978.
Versions Affected
Affects GitLab 6.4 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Update rubyzip gem
The rubyzip gem was updated to address a vulnerability in that library, CVE-2019-16892.
Versions Affected
Affects GitLab EE 8.3 and later.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Apply January Mattermost Security Updates (GitLab Omnibus)
The January Mattermost Security Updates were applied.
Remediation
We strongly recommend that all installations running an affected version above are upgraded to the latest version as soon as possible.
Updating
To update GitLab, see the Update page.
Receive Security Release Notifications
To receive security release blog notifications delivered to your inbox, visit our contact us page. To receive security release blog notifications via RSS, subscribe to our RSS feed.
We want to hear from you
Enjoyed reading this blog post or have questions or feedback? Share your thoughts by creating a new topic in the GitLab community forum.
Share your feedback