Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.6260
GitLab Security Release: 15.6.1, 15.5.5 and 15.4.6
1 December 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: GitLab Community Edition (CE)
GitLab Enterprise Edition (EE)
Publisher: GitLab
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Resolution: Patch/Upgrade
CVE Names: CVE-2022-4206 CVE-2022-4205 CVE-2022-4201
CVE-2022-4054 CVE-2022-3902 CVE-2022-3820
CVE-2022-3740 CVE-2022-3572 CVE-2022-3482
CVE-2022-3478
Original Bulletin:
https://about.gitlab.com/releases/2022/11/30/security-release-gitlab-15-6-1-released/
Comment: CVSS (Max): 7.7 CVE-2022-4206 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
CVSS Source: GitLab
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- --------------------------BEGIN INCLUDED TEXT--------------------
GitLab Security Release: 15.6.1, 15.5.5 and 15.4.6
Learn more about GitLab Security Release: 15.6.1, 15.5.5 and 15.4.6 for GitLab
Community Edition (CE) and Enterprise Edition (EE).
Today we are releasing versions 15.6.1, 15.5.5 and 15.4.6 for GitLab Community
Edition (CE) and Enterprise Edition (EE).
These versions contain important security fixes, and we strongly recommend that
all GitLab installations be upgraded to one of these versions immediately.
GitLab.com is already running the patched version.
GitLab releases patches for vulnerabilities in dedicated security releases.
There are two types of security releases: a monthly, scheduled security
release, released a week after the feature release (which deploys on the 22nd
of each month), and ad-hoc security releases for critical vulnerabilities. For
more information, you can visit our security FAQ. You can see all of our
regular and security release blog posts here. In addition, the issues detailing
each vulnerability are made public on our issue tracker 30 days after the
release in which they were patched.
We are dedicated to ensuring all aspects of GitLab that are exposed to
customers or that host customer data are held to the highest security
standards. As part of maintaining good security hygiene, it is highly
recommended that all customers upgrade to the latest security release for their
supported version. You can read more best practices in securing your GitLab
instance in our blog post.
Recommended Action
We strongly recommend that all installations running a version affected by the
issues described below are upgraded to the latest version as soon as possible.
When no specific deployment type (omnibus, source code, helm chart, etc.) of a
product is mentioned, this means all types are affected.
Table of Fixes
Title Severity
DAST API scanner exposes Authorization headers in vulnerabilities high
Group IP allow-list not fully respected by the Package Registry medium
Deploy keys and tokens may bypass External Authorization service if it medium
is enabled
Repository import still allows to import 40 hexadecimal branches medium
Webhook secret tokens leaked in webhook logs medium
Maintainer can leak webhook secret token by changing the webhook URL medium
Cross-site scripting in Jira Integration affecting self-hosted medium
instances without strict CSP
Release names visible in public projects despite release set as medium
project members only
Sidekiq background job DoS by uploading malicious NuGet packages medium
SSRF in Web Terminal advertise_address low
DAST API scanner exposes Authorization headers in vulnerabilities
A sensitive information leak issue has been discovered in all versions of DAST
API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in
the vulnerability report. This is a high severity issue (CVSS:3.1/AV:N/AC:L/
PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7). It is now mitigated in the latest release of
DAST API scanner and is assigned CVE-2022-4206.
This vulnerability has been discovered internally by the GitLab team.
Group IP allow-list not fully respected by the Package Registry
An issue has been discovered in GitLab affecting all versions starting from
15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing
correct authentication with some Package Registries when IP address
restrictions were configured, allowing an attacker already in possession of a
valid Deploy Token to misuse it from any location. This is a medium severity
issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, 6.5). It is now mitigated
in the latest release and is assigned CVE-2022-3820.
This vulnerability has been discovered internally by the GitLab team.
Deploy keys and tokens may bypass External Authorization service if it is
enabled
An issue has been discovered in GitLab CE/EE affecting all versions starting
from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A
group owner may be able to bypass External Authorization check, if it is
enabled, to access git repositories and package registries by using Deploy
tokens or Deploy keys. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H
/UI:N/S:U/C:H/I:H/A:N, 6.5). It is now mitigated in the latest release and is
assigned CVE-2022-3740.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug
bounty program.
Repository import still allows to import 40 hexadecimal branches
In GitLab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a
hexadecimal name could override an existing hash. This is a medium severity
issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L, 6.3). It is now mitigated
in the latest release and is assigned CVE-2022-4205.
This vulnerability has been discovered internally by the GitLab team.
Webhook secret tokens leaked in webhook logs
An issue has been discovered in GitLab affecting all versions starting from 9.3
before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions
starting from 15.6 before 15.6.1. It was possible for a project maintainer to
unmask webhook secret tokens by reviewing the logs after testing webhooks. This
is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, 5.5).
It is now mitigated in the latest release and is assigned CVE-2022-3902.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug
bounty program.
Maintainer can leak webhook secret token by changing the webhook URL
An issue has been discovered in GitLab affecting all versions starting from 9.3
before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions
starting from 15.6 before 15.6.1. It was possible for a project maintainer to
leak a webhook secret token by changing the webhook URL to an endpoint that
allows them to capture request headers. This is a medium severity issue
(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, 5.5). It is now mitigated in the
latest release and is assigned CVE-2022-4054.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug
bounty program.
Cross-site scripting in Jira Integration affecting self-hosted instances
without strict CSP
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all
versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to
15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect
integration which could lead to a reflected XSS that allowed attackers to
perform arbitrary actions on behalf of victims. This is a medium severity issue
(CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4). It is now mitigated in the
latest release and is assigned CVE-2022-3572.
Thanks ryotak for reporting this vulnerability through our HackerOne bug bounty
program.
Release names visible in public projects despite release set as project members
only
An improper access control issue in GitLab CE/EE affecting all versions from
11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an
unauthorized user to see release names even when releases were set to be
restricted to project members only. This is a medium severity issue (CVSS:3.1/
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). It is now mitigated in the latest
release and is assigned CVE-2022-3482.
Thanks ashish_r_padelkar for reporting this vulnerability through our HackerOne
bug bounty program.
Sidekiq background job DoS by uploading malicious NuGet packages
An issue has been discovered in GitLab affecting all versions starting from
12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions
starting from 15.6 before 15.6.1. It was possible to trigger a DoS attack by
uploading a malicious NuGet package. This is a medium severity issue (CVSS:3.1/
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3). It is now mitigated in the latest
release and is assigned CVE-2022-3478.
Thanks luryus for reporting this vulnerability through our HackerOne bug bounty
program.
SSRF in Web Terminal advertise_address
A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5
prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to
local addresses when configuring a malicious GitLab Runner. This is a low
severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N, 3.5). It is now
mitigated in the latest release and is assigned CVE-2022-4201.
This vulnerability has been discovered internally by the GitLab team.
Update xmlsoft/libxml2
xmlsoft/libxml2 has been updated to version 2.10.3 in order to mitigate
security issues.
Versions affected
Affects all versions of GitLab Omnibus from 13.6.6.
Update haxx/curl
haxx/curl has been updated to version 7.86.0 in order to mitigate security
issues.
Versions affected
Affects all versions of GitLab Omnibus 15.4 and 15.6.
Update ruby
ruby has been updated to version 2.7.6 in order to mitigate security issues.
Versions affected
Affects all versions of GitLab Omnibus and GitLab Chart.
Update ncurses
ncurses has been updated to version 6.3-20220416 to mitigate security issues.
Versions affected
Affects all versions of GitLab Omnibus.
Update zlib
zlib has been updated to version 1.2.13 to mitigate security issues.
Versions affected
Affects all versions of GitLab Omnibus prior to 15.7.
Update rsync
rsync has been updated to version 3.2.6 to mitigate security issues.
Versions affected
Affects all versions of GitLab Omnibus 15.3, 15.4, and 15.5.
Update PostgreSQL
PostgreSQL has been updated to versions 12.12 and 13.8 to mitigate security
issues. By default Omnibus automatically restarts PostgreSQL after the update.
However, if automatic restart is disabled manual restarts would be required.
Versions affected
Affects all versions of GitLab Omnibus 15.3, 15.4, and 15.5.
Backport fix for Gitaly NTP request issue
A non-security issue in Gitaly is being backported to this release. Customers
that rely on public NTP services such as pool.ntp.org are at risk of receiving
rate limited responses due to increased NTP request volume. Every readiness
check results in each Praefect node making a request to the configured NTP
service. Failed NTP responses result in failed readiness check. If a NTP
service is not specified pool.ntp.org is used as the default. Deployments that
rely on healthy readiness checks can experience outages. Issue Link: Gitaly
15.4.3 spams NTP requests.
Backport fix for Watchdog RssMemoryLimit monitor
A non-security issue in Puma is being backported to this release. This affects
self-managed instances that uses PumaWorkerKiller. PumaWorkerKiller is disabled
by default on Gitlab.com and self-managed instances using helm charts. This
means that gitlab.com is not affected. It is enabled by default for omnibus
installations and installations from source. Issue Link: Convert memory_limit
to bytes for RssMemoryLimit.
Updating
To update GitLab, see the Update page. To update Gitlab Runner, see the
Updating the Runner page. To update DAST API scanner, self-managed customers
that are using our built-in DAST CI template after 15.0 can get the latest
release from registry.gitlab.com. If using the always pull policy the update
will occur automatically. GitLab.com is already running the updated DAST
scanner.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBY4f+zskNZI30y1K9AQhVJQ//TN5TBOIKD1To1gqtncR7FH/EYh25pvt/
KWWaRUgEj0BdzZtxoHhJGmkdVgq9/AEYdnABh6WW91j5c4VqPo8Wck9v+pneWlHt
xXizfZ/IXSgUuXaSBnZoado9aAJxf1/Fq7wtZv8XHKUV5cAOZgdb0O96Ssnco5Kj
chHfQD18i/60VAns8GQffAhYgmA2uDHwIoBuumvChQQVZzl2rWXczCcLg+AWV4Zc
xpfdMxFNV6eUBqrH5xJZSImUo/97edGtRi/rY+aG7f9JFmJl1NxnoJZaT4WtD6WT
YdLhWOiXNbjSjiPXIHOspYeOsxMDEyMRPYsrevLHRVbzyL31NZFFtJXd0BTEUAJ7
UosATKWdSAKapEoROcd7pLRFAZHwYVGPD/WRWNATOx6QxTmvkxIm8x06/HlPDb4N
atwmsVS3RehIKax6KkIJll49ATO3B0nSOZRvdW+Njh4cMN7s+lm05aFbDkpljZiS
w6w26RxprxAmDIGyfaV2Bso3QC2esdjuP5jT1HUSJMNsmTcdG8pVdQqUeNNcO9x5
taU3gyuKmSAmhdZiNW36S48Lw8l7vBfGQSmmRl7KgXqt8BOC9KOi+40QjPbq1Upl
sK585hDDvI//ud/6oQ+BY1sO1+4m0jyRxq+Gw02o0NT/agCegCXTMfAFUZ+qNCes
rsx7JgnKlZ0=
=uQ+W
-----END PGP SIGNATURE-----