Gitlab Critical Security Release: 16.3.4 and 16.2.7

https://about.gitlab.com/releases/2023/09/18/security-release-gitlab-16-3-4-released/

by mirzap • 3 years ago

96 42 3 years ago

about.gitlab.com

decasia• 3 years ago

It's always a little unexpected when the security vulnerabilities are in the tools we use to build software instead of just in the software. I suppose it's a class of supply chain vulnerability.

In this particular class of impersonation problem (the Gitlab issue is about running a pipeline as another user), sometimes I find it unnerving how much an attacker could accomplish in a software company by being able to impersonate an arbitrary Slack user. We are taught to be cautious around incoming email, but I've yet to see a security training around "how do you know that your instant messages are genuine."

thejosh• 3 years ago

session tokens are a fun one, that's how Linus Tech Tips (tech Youtuber) and other Youtubers got their accounts yoinked.

zx80802• 3 years ago

Mind sharing links on what's happened?

kawsper• 3 years ago

This happened to us using Flowdock (a Slack competitor), they had a main DB failure, and when a new one was promoted the state was bad, and so "new" employees from another company started appearing in our organisation replacing our own employees, they could then read our private messages and access our rooms.

https://web.archive.org/web/20220704223244/https://flowdock-...

It was really hard for me to find a responsible from Flowdock/Broadcom/Rally Software/CA Technologies to report the leak, but in the end they killed the servers until they got the issues under control.

Because of this I mostly share encrypted files over chat, using OpenPGP, but the user experience is terrible for most :(

wiktor-k• 3 years ago

Wow, that's really disturbing.

Because of this I mostly share encrypted files over chat, using OpenPGP, but the user experience is terrible for most :(

Agreed. Even with builtin OpenPGP support in Thunderbird the UX is still bad for regular users (well, for technical ones too).

infocollector• 3 years ago

Not sure if anyone here is hanging out from Gitlab. One request, and one question:

Request: The new UI has "Admin" link hidden which is hard to find. I liked the old UI better (explicit is better than implicit).

Question: Is the open source code the same as the Enterprise versions of the code? (how do you implement feature differences?)

roblabla• 3 years ago

There's now a single codebase containing both enterprise and FOSS. Enterprise features live in the `ee/` subfolder of the repository. This allows them to share code. (EE used to be a (visible-source) fork of CE, but the repos got merged like a year or so ago).

dnsmichi3• 3 years ago

GitLab team member here. Thanks for your feedback.

Request: The new UI has "Admin" link hidden which is hard to find. I liked the old UI better (explicit is better than implicit).

This was reported in the new navigation feedback issue [0] and is being worked on in [1]. Suggest adding your comment/upvote there too.

Question: Is the open source code the same as the Enterprise versions of the code? (how do you implement feature differences?)

The source code for GitLab is located in a single repository. The change was proposed and introduced in 2019 for efficiency reasons [2] [3] [4]

You can learn more about the stewardship of GitLab, and the promises in [5] - point 11) links to the enterprise code location, and the free open source location.

This workflow also ensures that everyone can contribute to GitLab [6] - free users, and customers [7], using the same code base.

[0] https://gitlab.com/gitlab-org/gitlab/-/issues/409005#what-we...

[1] https://gitlab.com/gitlab-org/gitlab/-/issues/415854

[2] https://about.gitlab.com/blog/2019/02/21/merging-ce-and-ee-c...

[3] https://about.gitlab.com/blog/2019/08/23/a-single-codebase-f...

[4] https://about.gitlab.com/blog/2019/10/02/contributor-after-s...

[5] https://handbook.gitlab.com/handbook/company/stewardship/#pr...

[6] https://about.gitlab.com/community/contribute/

[7] https://docs.gitlab.com/ee/development/contributing/#contrib...

remram2• 3 years ago

It boggles my mind that you direct customers to your issue tracker. With over 50,000 open issue, it is where requests go to die. It is not a place of honor.

gizmo• 3 years ago

This is the original issue thread from two months ago:

https://gitlab.com/gitlab-org/gitlab/-/issues/417594

And the root cause seems to be...

Change your git config and include username of the your victim that is,
git config --global user.name "victim"

Oops.

prmoustache• 3 years ago

This is not the root cause but the way to exploit it imho. The root cause was that the pipeline process would reuse CI tokens that gives access to other repos/projects just by being added as member on someone else's repo and being formally marked as user in a commit.

plagiarist2• 3 years ago

Wow. That kind of decision does not inspire confidence in the product.

glintik2• 3 years ago

Oh, critical issue again. Looks like Gitlab needs security officer to help to prevent this.

rtev2• 3 years ago

The reason you see so many critical Gitlab security fixes is because they take security so seriously.

They pay huge bounties for security vulnerabilities in their products, so they get the best researchers responsibly disclosing bugs.

skc• 3 years ago

This sounds like bias. Replace "Gitlab" with "Microsoft" or "Oracle" in your comment and I'd wager you'd feel differently.

glintik2• 3 years ago

Nice hypothesis, but far away from the reality

mattl• 3 years ago

GitLab also releases very frequently, minimum once a month with a whole new release. Between releases usually two or three updates but occasionally more.

yellowsir• 3 years ago

I wonder why is this on HN. Gitlab has like 10 Security releases/year, this is the first i see on HN. If you self host gitlab you should be subscribed to the security newsletter.

It would save a lot of time on my end, if gitlab had a :stable release tag for docker.

remram2• 3 years ago

Direct link: https://about.gitlab.com/company/contact/

Scroll down to "Sign up for security notices"

Gitlab Critical Security Release: 16.3.4 and 16.2.7

Related Stories