Today we are releasing versions 16.3.1, 16.2.5 and 16.1.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).
These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.
GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our security FAQ. You can see all of our regular and security release blog posts here. In addition, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.
We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.
Recommended Action
We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.
When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.
Table of Fixes
Privilege escalation of "external user" to internal access through group service account
An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified as external and may be used to access internal projects. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
, 6.5). It is now mitigated in the latest release and is assigned CVE-2023-3915.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Maintainer can leak sentry token by changing the configured URL (fix bypass)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
, 5.5). It is now mitigated in the latest release and is assigned [CVE-2023-4378](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4378.
Thanks 70rpedo for reporting this vulnerability through our HackerOne bug bounty program.
Google Cloud Logging private key showed in plain text in GitLab UI leaking to other group owners
An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
, 5.5), and affects only GitLab EE. It is now mitigated in the latest release and is assigned [CVE-2023-3950](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3950.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Information disclosure via project import endpoint
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
, 5.0). It is now mitigated in the latest release and is assigned CVE-2023-4630.
This vulnerability was found internally by a GitLab team member Rodrigo Tomonari.
Developer can leak DAST scanners "Site Profile" request headers and auth password
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site profile. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
, 5.0), and only affects GitLab EE. It is now mitigated in the latest release and is assigned CVE-2022-4343.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Project forking outside current group
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.3 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to fork a project outside of current group by an unauthorised user. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
, 4.3). It is now mitigated in the latest release and is assigned CVE-2023-4638.
Thanks theluci for reporting this vulnerability through our HackerOne bug bounty program.
User is capable of creating Model experiment and updating existing run's status in public project
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
, 4.3). It is now mitigated in the latest release and is assigned CVE-2023-4018.
Thanks ricardobrito for reporting this vulnerability through our HackerOne bug bounty program
ReDoS in bulk import API
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
,6.5). It is now mitigated in the latest release and is assigned CVE-2023-3205.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program
Pagination for Branches and Tags can be skipped leading to DoS
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
, 5.3). It is now mitigated in the latest release and is assigned CVE-2023-4647.
This vulnerability has been discovered internally by GitLab team member Vasilii Iakliushin
Internal Open Redirection Due to Improper handling of "../" characters
An issue has been discovered in GitLab CE/EE affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
, 3.5). It is now mitigated in the latest release and is assigned CVE-2023-1279.
Thanks akadrian for reporting this vulnerability through our HackerOne bug bounty program.
Subgroup Member With Reporter Role Can Edit Group Labels
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
, 3.5). It is now mitigated in the latest release and is assigned CVE-2023-0120.
Thanks drjgouveia for reporting this vulnerability through our HackerOne bug bounty program.
Banned user can delete package registries
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
, 2.7). It is now mitigated in the latest release and is assigned CVE-2023-1555.
Thanks ali_shehab for reporting this vulnerability through our HackerOne bug bounty program.
Update commonmarker
Commonmarker has been updated to version 0.23.10 in order to mitigate security issues.
Update openssl
Openssl has been updated to version to 1.1.1u in order to mitigate security issues.
Non Security Patches
This security release also includes the following non-security patches.
16.3.1
- Remove unified URL limitation for GitLab chart (16.3 backport)
- Revert migration to backfill archived in wikis
- Add .net to context selector to skip live envs
- Backport "Geo: Resync direct upload object stored artifacts" to 16.3
- CSP: disable LFS url when not using object storage
- Backport LicenseScanning fix for AutoDevOps
16.2.5
- Backport "cgroup: using a noop manager on linux without cgroup" fix to 16.2
- Adjust Danger logic for stable branches
- Backport "Geo: Resync direct upload object stored artifacts" to 16.2
16.1.5
- Revert "Log rails response length" - 16.1 Backport
- Adjust Danger logic for stable branches
- Backport "Geo: Resync direct upload object stored artifacts" to 16.1
Updating
To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.
Receive Security Release Notifications
To receive security release blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our security release RSS feed or our RSS feed for all releases.
We want to hear from you
Enjoyed reading this blog post or have questions or feedback? Share your thoughts by creating a new topic in the GitLab community forum.
Share your feedback