GitLab Patch Release: 16.11.1, 16.10.4, 16.9.6

Today we are releasing versions 16.11.1, 16.10.4, 16.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.

GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Accidental breaking changes in KAS configuration

The following KAS patch releases contain breaking changes from the %17.0 revision, because they were tagged from the wrong source (master instead of stable branches):

• v16.11.1
• v16.10.4
• v16.9.6

The next GitLab patch release will fix those changes. Issue 458462 provides more information.

As a workaround KAS can be downgraded to the last release. Working KAS versions are:

• v16.11.0
• v16.10.1
• v16.9.3

Security fixes

Table of security fixes

Title	Severity
GitLab account takeover, under certain conditions, when using Bitbucket as an OAuth provider	High
Path Traversal leads to DoS and Restricted File Read	High
Unauthenticated ReDoS in FileFinder when using wildcard filters in project file search	High
Personal Access Token scopes not honoured by GraphQL subscriptions	Medium
Domain based restrictions bypass using a crafted email address	Medium

GitLab account takeover, under certain conditions, when using Bitbucket as an OAuth provider

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3). It is now mitigated in the latest release and is assigned CVE-2024-4024.

This vulnerability has been discovered internally by GitLab team members Sam Word and Rodrigo Tomonari.

On 2024-04-24, GitLab changed the way Bitbucket authentication works with GitLab. To continue using Bitbucket Authentication, please sign in to GitLab with your Bitbucket account credentials, before 2024-05-16.

If you do not sign into GitLab using your Bitbucket account until after 2024-05-16, you will need to re-link your Bitbucket account to your GitLab account manually. For some users, signing in to GitLab using their Bitbucket account may not work after this fix is applied. If this happens to you, your Bitbucket and GitLab accounts have different email addresses. To resolve this, you must log in to your GitLab account with your GitLab username and password and re-link your Bitbucket account.

Path Traversal leads to DoS and Restricted File Read

An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H, 8.5). It is now mitigated in the latest release and is assigned CVE-2024-2434.

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

Unauthenticated ReDoS in FileFinder when using wildcard filters in project file search

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). It is now mitigated in the latest release and is assigned CVE-2024-2829.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Personal Access Token scopes not honoured by GraphQL subscriptions

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-4006.

This vulnerability was internally discovered and reported by a GitLab team member, Dylan Griffith.

Domain based restrictions bypass using a crafted email address

An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-1347.

Thanks garethheyes for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

16.11.1

• Backport fixing release environment pipeline triggering rule to 16.11
• Fix for missing branch_build_package_download_url
• Fix missing arguments when PostgreSQL upgrade times out

16.10.4

• go.mod: Update golang.org/x/net dependency
• Update vulnerability_reads scanner in the ingestion pipeline
• Fix migration error when updating from GitLab 16.x to 16.10
• Backport fixing release environment pipeline triggering rule to 16.10

16.9.6

• Backport fixing release environment pipeline triggering rule to 16.9

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

We’re combining patch and security releases

This improvement in our release process matches the industry standard and will help GitLab users get information about security and bug fixes sooner, read the blog post here.