GitLab Patch Release: 16.11.1, 16.10.4, 16.9.6

GitLab Security Advisory

Today we are releasing versions 16.11.1, 16.10.4, 16.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.

GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our releases handbook and security FAQ.
You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our
issue tracker
30 days after the release in which they were patched.

We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
best practices in securing your GitLab instance in our blog post.

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

TitleSeverity
GitLab account takeover, under certain conditions, when using Bitbucket as an OAuth providerHigh
Path Traversal leads to DoS and Restricted File ReadHigh
Unauthenticated ReDoS in FileFinder when using wildcard filters in project file searchHigh
Personal Access Token scopes not honoured by GraphQL subscriptionsMedium
Domain based restrictions bypass using a crafted email addressMedium

GitLab account takeover, under certain conditions, when using Bitbucket as an OAuth provider

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user’s Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab.
This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3).
It is now mitigated in the latest release and is assigned CVE-2024-4024.

This vulnerability has been discovered internally by GitLab team members Sam Word and Rodrigo Tomonari.

On 2024-04-24, GitLab changed the way Bitbucket authentication works with GitLab. To continue using Bitbucket Authentication, please sign in to GitLab with your Bitbucket account credentials, before 2024-05-16.

If you do not sign into GitLab using your Bitbucket account until after 2024-05-16, you will need to re-link your Bitbucket account to your GitLab account manually. For some users, signing in to GitLab using their Bitbucket account may not work after this fix is applied. If this happens to you, your Bitbucket and GitLab accounts have different email addresses. To resolve this, you must log in to your GitLab account with your GitLab username and password and re-link your Bitbucket account.

Path Traversal leads to DoS and Restricted File Read

An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H, 8.5). It is now mitigated in the latest release and is assigned CVE-2024-2434.

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service.
This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5).
It is now mitigated in the latest release and is assigned CVE-2024-2829.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Personal Access Token scopes not honoured by GraphQL subscriptions

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions.
This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3).
It is now mitigated in the latest release and is assigned CVE-2024-4006.

This vulnerability was internally discovered and reported by a GitLab team member, Dylan Griffith.

Domain based restrictions bypass using a crafted email address

An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group.
This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3).
It is now mitigated in the latest release and is assigned CVE-2024-1347.

Thanks garethheyes for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

16.11.1

16.10.4

16.9.6

Updating

To update GitLab, see the Update page.
To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page.
To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

We’re combining patch and security releases

This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, read the blog post here.

READ MORE

Leave a Reply

Your email address will not be published. Required fields are marked *