GitLab released security patches on October 21 to address a critical vulnerability affecting every version of the software since 2014. The flaw, rated 10.0 on the severity scale, allows unauthenticated attackers to execute arbitrary code on self-managed GitLab servers. The vulnerability stems from an integer overflow in the regular-expression compiler when processing specially crafted input. While GitLab has not disclosed the specific conditions required to exploit the flaw, the company reports no evidence of active attacks and notes the vulnerability does not yet appear on the U.S. CISA list of known exploited vulnerabilities.
Self-managed GitLab installations must apply updates immediately, as GitLab.com and GitLab Dedicated already run patched versions. The company extended patches to four older release versions beyond its standard support policy due to the severity. A researcher recently reported four code-execution flaws in GitLab’s regular-expression engine within one month, with this latest flaw reaching further back in version history than the previous three. The October 21 release also addressed ten additional security issues, including authentication-related vulnerabilities rated as high severity.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
