Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2740
GitLab Security Release: 13.2.3, 13.1.6 and 13.0.12
10 August 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Gitlab Enterprise Edition (EE)
GitLab Community Edition (CE)
Publisher: Gitlab
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Virtualisation
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Access Confidential Data -- Remote/Unauthenticated
Unauthorised Access -- Existing Account
Reduced Security -- Unknown/Unspecified
Resolution: Patch/Upgrade
CVE Names: CVE-2020-14001 CVE-2020-13295 CVE-2020-13294
CVE-2020-13293 CVE-2020-13292 CVE-2020-13291
CVE-2020-13290 CVE-2020-13288 CVE-2020-13286
CVE-2020-13285 CVE-2020-13283 CVE-2020-13282
CVE-2020-13281 CVE-2020-13280 CVE-2020-10977
Reference: ESB-2020.2731
Original Bulletin:
https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/
- --------------------------BEGIN INCLUDED TEXT--------------------
Aug 5, 2020 - Andrew Kelly
GitLab Security Release: 13.2.3, 13.1.6 and 13.0.12
Today we are releasing versions 13.2.3, 13.1.6 and 13.0.12 for GitLab Community
Edition (CE) and Enterprise Edition (EE).
These versions contain important security fixes, and we strongly recommend that
all GitLab installations be upgraded to one of these versions immediately.
GitLab releases patches for vulnerabilities in dedicated security releases.
There are two types of security releases: a monthly, scheduled security
release, released a week after the feature release (which deploys on the 22nd
of each month), and ad-hoc security releases for critical vulnerabilities. You
can see all of our regular and security release blog posts here. In addition,
the issues detailing each vulnerability are made public on our issue tracker 30
days after the release in which they were patched.
We are dedicated to ensuring all aspects of GitLab that are exposed to
customers or that host customer data are held to the highest security
standards. As part of maintaining good security hygiene, it is highly
recommended that all customers upgrade to the latest security release for their
supported version. You can read more best practices in securing your GitLab
instance in our blog post.
Previously fixed (in 12.9.1): Arbitrary File Read when Moving an Issue
Recently, a GitLab user posted a blog about the exploitation of a known
vulnerability which has been previously disclosed and assigned CVE-2020-10977.
GitLab EE/CE 8.5 to 12.9 is vulnerable to a path traversal when moving an issue
between projects.
This issue was remediated and patched in the 12.9.1 release in March 2020.
We strongly recommend that all users confirm they are running the latest
version of GitLab to ensure they are up-to-date with current security releases.
Users should update immediately if possible. If upgrading immediately is not
possible for some reason, public registration should be disabled.
Memory Exhaustion via Excessive Logging of Invite Email Error
Excessive error logging related to an invitation email being sent to members of
a deleted group could potentially cause memory exhaustion on lower resource
machines. This issue is now mitigated in the latest release and is assigned
CVE-2020-13280.
Versions Affected
Affects all previous GitLab versions.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
Denial of Service Through Project Import Feature
The project import feature did not perform size checks before decompressing
data, potentially resulting in a denial of service. This issue is now mitigated
in the latest release and is assigned CVE-2020-13281.
Thanks @u3mur4 for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab 8.9 and later.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
User Controlled Git Configuration Settings Resulting in SSRF
When importing a repository via URL, the git http.<url>.proxy setting could be
changed and lead to server-side request forgery. This issue is now mitigated in
the latest release and is assigned CVE-2020-13286.
Thanks @vakzz for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab 12.7 and later.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
Stored XSS in Issue Reference Number Tooltip
For some browsers, the tooltip for issue reference numbers could result in
stored XSS on mouseover. This issue is now mitigated in the latest release and
is assigned CVE-2020-13285.
Thanks @yvvdwf for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab EE 12.9 and later.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
Stored XSS in Issues List via Milestone Title
The milestone title field can lead to stored XSS when viewed under certain
conditions on the issue list. This issue is now mitigated in the latest release
and is assigned CVE-2020-13283.
Thanks @mike12 for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab 10.8 and later.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
Improper Access Control After Group Transfer
Members of a parent group silently and unexpectedly maintained their access
levels when a subgroup is transferred. This issue is now mitigated in the
latest release and is assigned CVE-2020-13282.
Thanks @kryword for responsibly reporting this vulnerability to us.
Versions Affected
Affects all previous GitLab versions.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
Bypass Email Verification Required for OAuth Flow
The required email verification for the OAuth authorization code flow could be
bypassed, which potentially could affect third party applications that use
GitLab as an identity provider. This issue is now mitigated in the latest
release and is assigned CVE-2020-13292.
Thanks @cache-money for responsibly reporting this vulnerability to us.
Versions Affected
Affects all previous GitLab versions.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
Confusion When Using Hexadecimal Branch Names
Using a branch with a hexadecimal name could override an existing hash. This
issue is now mitigated in the latest release and is assigned CVE-2020-13293.
Thanks @retroplasma for responsibly reporting this vulnerability to us.
Versions Affected
Affects all previous GitLab versions.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
Insufficient OAuth Revocation
Access grants were not revoked when a user revoked access to an application.
This issue is now mitigated in the latest release and is assigned
CVE-2020-13294.
Thanks @benaubin for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab 7.7 and later.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
Improper Access Control for Project Sharing
Project sharing could temporarily allow too permissive access. This issue is
now mitigated in the latest release and is assigned CVE-2020-13291.
Versions Affected
Affects GitLab 13.2 and later.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
Stored XSS in Jobs Page
A stored XSS was identified in the CI/CD Jobs page. This issue is now mitigated
in the latest release and is assigned CVE-2020-13288.
Thanks @mike12 for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab 13.0 and later.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
Improper Access Control of Applications Page
Users without two-factor authentication set up can still access the /profile/
applications page even when two-factor authentication is required. This issue
is now mitigated in the latest release and is assigned CVE-2020-13290.
Thanks @brdoors3 for responsibly reporting this vulnerability to us.
Versions Affected
Affects GitLab 8.4 and later.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
SSRF into Shared Runner
By replacing dockerd with a malicious server, a SSRF was possible into the
Shared Runner. This issue is now mitigated in the latest release and is
assigned CVE-2020-13295.
Thanks @lucash-dev for responsibly reporting this vulnerability to us.
Versions Affected
Affects all versions of GitLab Runner.
Remediation
We strongly recommend that all installations of GitLab Runner are upgraded to
the latest version as soon as possible.
Update Kramdown Gem
The kramdown gem has been upgraded to 2.3.0. This upgrade include a security
fix for CVE-2020-14001.
Versions Affected
Affects GitLab 13.2 and later.
Remediation
We strongly recommend that all installations running an affected version above
are upgraded to the latest version as soon as possible.
Updating
To update GitLab, see the Update page. To update Gitlab Runner, see the
Updating the Runner page.
Receive Security Release Notifications
To receive security release blog notifications delivered to your inbox, visit
our contact us page. To receive security release blog notifications via RSS,
subscribe to our RSS feed.
GitLab Security Release: 13.2.3, 13.1.6 and 13.0.12
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXzDxTeNLKJtyKPYoAQgQXw//cod8mN34B8gcrZn3tQ/elXvNwhpdDJcz
1ZwF7S38fqyHGDerWD+OmEtycGnOhaJHd5gqMTq85HeZzmZSlApXPoNXdy4QtX/s
mnQ+xJm0kYPAo5SUJEFb7NHNcQis2j4+XaptY9fCtNdU1M72kAbNQR5oo+uaXAAe
00P4vhvkcMSZ3Nf2cYyVgo3nmYd3ldEP3C6N+xNqGwrbNVyRvCxLO4HqwYLYhi5x
gfPKKUzqFMYMl/Pzf+qvBQCilpPW9gm7yTRvV9aYyGXGgy0nvlJ1wQRYiHou8Qj6
EP2RgX9XTIyjb4fZxu+cEnA79i/oRlcv+nA9oB40aZs0tqE6DiuOXXJcl6/QyxhB
Kv9Wlf+iH3LSDQVMkYGjGeyJFDqeVTG+E1eYs1n1BzKxCMKc84ejMinN0knUkkcw
JmyB+u0NrdP5N7AZInJ+sGVatY4cL6SD6IjUDOMRrnr3/RrDO+aolKrjDrGBcgI8
uFfqTq5QX4krISL389WS5aAwQm9wDBM5TGwO4FS8VspqhbMYl9gBir1atPmqt5di
zvWFGcpzhhSzLsoRDjhQ/4m6vFkcDSF4YuWWy6NKsQypxGnYiYA2T8L7yLYv7psM
xVI1kMwZTFcCi0+IRIZUh90SqDGiE7qNbseZCEuoA1ClldngPVmwmsfr7cQzSEwR
T92k05Nk5SA=
=/5Hn
-----END PGP SIGNATURE-----