{"id":2355,"date":"2024-01-12T22:30:00","date_gmt":"2024-01-12T22:30:00","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities-threats\/gitlab-releases-updates-to-address-critical-vulnerabilities-"},"modified":"2024-01-12T22:30:00","modified_gmt":"2024-01-12T22:30:00","slug":"gitlab-releases-updates-to-address-critical-vulnerabilities","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/01\/12\/gitlab-releases-updates-to-address-critical-vulnerabilities\/","title":{"rendered":"GitLab Releases Updates to Address Critical Vulnerabilities"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

In a newly released update, GitLab reports that it is releasing versions 16.7.2, 16.6.3, and 16.5.6 for GitLab Community Edition (CE) as well as Enterprise Edition (EE) in order to <\/span>address a series of critical vulnerabilities<\/a><\/span>.<\/span><\/p>\n

Two critical vulnerabilities, alongside one each for high, medium, and low, are listed as part of the fixes that the vendor is urgently recommending as soon as possible. <\/span><\/p>\n

The first critical vulnerability \u2014 tracked as CVE-2023-7028 \u2014 is an authentication issue that allows password resets to be sent to unverified email addresses and has a maximum severity score of 10. Threat actors don’t need interaction to successfully exploit this vulnerability, though <\/span>GitLab<\/a><\/span> noted that it has not detected any active exploitation.<\/span><\/p>\n

The versions affected are 16.1 prior to 16.1.5; 16.2 prior to 16.2.8; 16.3 prior to 16.3.6; 16.4 prior to 16.4.4; 16.5 prior to 16.5.6; 16.6 prior to 16.6.4; and 16.7 prior to 16.7.2.<\/span><\/p>\n

The second critical vulnerability \u2014 tracked as CVE-2023-5356 \u2014 can be used to impersonate another user to execute slash commands in order to abuse Slack\/Mattermost. There are incorrect authorization checks in all versions starting from 8.13 before 16.5.6, all versions from 16.6 before 16.6.4, and all versions from 16.7 before 16.7.2.<\/span><\/p>\n

The three other vulnerabilities mentioned in the report are related to bypass CODEOWNERS approval removal (<\/span>CVE-2023-4812<\/a><\/span>), workspaces created under different root namespace (<\/span>CVE-2023-6955<\/a><\/span>), and modification of the metadata of signed commits (<\/span>CVE-2023-2030<\/a><\/span>). <\/span><\/p>\n

GitLab recommends upgrading<\/a><\/span> and enabling two-factor authentication for all accounts.  <\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

In a newly released update, GitLab reports that it is<\/p>\n","protected":false},"author":12,"featured_media":2356,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-2355","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/gitlab-releases-updates-to-address-critical-vulnerabilities-scaled.jpg?fit=2560%2C1707&ssl=1",2560,1707,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/gitlab-releases-updates-to-address-critical-vulnerabilities-scaled.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/gitlab-releases-updates-to-address-critical-vulnerabilities-scaled.jpg?fit=300%2C200&ssl=1",300,200,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/gitlab-releases-updates-to-address-critical-vulnerabilities-scaled.jpg?fit=640%2C427&ssl=1",640,427,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/gitlab-releases-updates-to-address-critical-vulnerabilities-scaled.jpg?fit=640%2C427&ssl=1",640,427,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/gitlab-releases-updates-to-address-critical-vulnerabilities-scaled.jpg?fit=1536%2C1024&ssl=1",1536,1024,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/gitlab-releases-updates-to-address-critical-vulnerabilities-scaled.jpg?fit=2048%2C1365&ssl=1",2048,1365,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/gitlab-releases-updates-to-address-critical-vulnerabilities-scaled.jpg?fit=1024%2C683&ssl=1",1024,683,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/gitlab-releases-updates-to-address-critical-vulnerabilities-scaled.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/gitlab-releases-updates-to-address-critical-vulnerabilities-scaled.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/gitlab-releases-updates-to-address-critical-vulnerabilities-scaled.jpg?fit=2560%2C1707&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=2355"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2355\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/2356"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=2355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=2355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=2355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}