| ▲ | GitLab Critical Patch Release(docs.gitlab.com) |
| 183 points by artooro 4 hours ago | 43 comments |
| |
|
| ▲ | jimmyl02 2 hours ago | parent | next [-] |
| Awesome find by https://hackerone.com/joaxcar and it's a little bit frightening that this severe of a bug isn't the biggest security vulnerability of today |
|
| ▲ | Thaxll 2 hours ago | parent | prev | next [-] |
| What a great week security wise! |
| |
|
| ▲ | ezekg 2 hours ago | parent | prev | next [-] |
| Is this a bug in GitLab or in Ruby? It's hard to tell from the report and the patch... |
| |
|
| ▲ | miduil an hour ago | parent | prev | next [-] |
| At least second regex related CVE in GitLab in the past few weeks. Awful to see that the endpoint is reachable unauthenticated, but I'm glad that they provide guidance in how to check the logs for attempts of exploitation |
| |
| ▲ | dvdkon an hour ago | parent [-] | | As far as I can tell, it requires forcing GitLab to render a malicious org-mode file. I don't really see a way to do that without authenticating and uploading one. Am I missing something? | | |
| ▲ | merb 40 minutes ago | parent [-] | | The attack needs no authentication — only one public project that can hold the .org payload.
So probably not vulnerable if no public projects exist - ie self hosted has an needs auth for everything mode. |
|
|
|
| ▲ | perlgeek 2 hours ago | parent | prev | next [-] |
| Back in perl 5.8 and older, the regex engine worked by recusing at the level of C functions, and so you could trigger stack overflows by giving it large strings. Is this similar? I wonder why gitlab even has its own regex compiler. Or is this a vulnerability in an underlying library or programming language? |
| |
| ▲ | wiml 2 hours ago | parent [-] | | Looks like Gitlab ships its own forked copy of the Ruby Onigmo regex engine. |
|
|
| ▲ | beaconflint 3 hours ago | parent | prev | next [-] |
| If you're patching a fleet, gitlab-rake gitlab:env:info gives you the exact version per node, faster than guessing from the omnibus package name. |
|
| ▲ | bon0r 2 hours ago | parent | prev | next [-] |
| possible bug? or too soon to check? :) after updating a pop-up still shows: "You are currently on version 19.5.1! We strongly recommend upgrading your GitLab installation immediately." while 19.5.1 should be the latest and fixed version |
| |
| ▲ | artooro 2 hours ago | parent | next [-] | | Their update checker has never worked very well. It takes hours to stop getting the upgrade warning inside of the GitLab dashboard. | |
| ▲ | merb 2 hours ago | parent | prev [-] | | I have that aswell… But I also updated pretty early. |
|
|
| ▲ | hobofan an hour ago | parent | prev | next [-] |
| This is shaping up to be the single worst security news day ever. Given the role that AI played in some of the discoveries, one has to wonder if this marks the start of some dark age of IT security. |
| |
| ▲ | smashed an hour ago | parent | next [-] | | This has been going on for months actually with no end in sight. | | |
| ▲ | hobofan 29 minutes ago | parent [-] | | Maybe I'm not enough in the weeds to see it as much, but the last few months seem to have been a much slower trickle of "how did we not catch this" exploits, while they are now appearing with much more sophisticated (though still usable in practice) exploit chains on much larger target codebases. The last few months seem to have been a lot more imunder control with also the frontier labs more warning of "what happens when Mythos-class model get in the hands of everyone" than that actually becoming reality. Now, it appears to be actuually turning into reality. |
| |
| ▲ | choilive an hour ago | parent | prev | next [-] | | I think this marks the beginning of the golden age. Investments in automated agent driven security scans on all software is coming to every business. Software and infrastructure will become more secure than ever before. | | |
| ▲ | hobofan 35 minutes ago | parent | next [-] | | I also hope that we come out in a golden age, but we are very much in for a rough few months/years where all the low hanging fruit is being picked up until we end up with much more hardened systems. | |
| ▲ | vee-kay 12 minutes ago | parent | prev [-] | | [dead] |
| |
| ▲ | esseph 15 minutes ago | parent | prev | next [-] | | Did you go to sleep in 2015 and then wake up just now in 2026? | |
| ▲ | taspeotis an hour ago | parent | prev | next [-] | | What? More like a golden age of security. AI is ripping the bandaid off right now. At the end of this software is going to be a lot more secure. | |
| ▲ | cobzilla an hour ago | parent | prev [-] | | Buckle up |
|
|
| ▲ | minraws 2 hours ago | parent | prev | next [-] |
| I am concerned for my self hosted servers, well only hope is tailscale should be entirely secure, and egress is filtered heavily... If that doesn't work my home lab is fucked. Any suggestions folks, not even my terminally online self can handle all of these. |
| |
| ▲ | switchbak 36 minutes ago | parent | next [-] | | I recently jammed all my stuff behind Tailscale. I sure hope that doesn't burn me. But it's a lot better than having things live on the open internet! Also looking at those old C++ services a whole lot differently now. | |
| ▲ | freedomben 42 minutes ago | parent | prev [-] | | as a fellow self-hoster, this is a rough time to be us |
|
|
| ▲ | valiant-comma 3 hours ago | parent | prev | next [-] |
| [dead] |
|
| ▲ | murillojndem 2 hours ago | parent | prev | next [-] |
| [dead] |
|
| ▲ | tptacek 3 hours ago | parent | prev [-] |
| "CVSS 10.0" isn't in the headline here and a CVSS of 10 doesn't actually mean anything. |
| |
| ▲ | phoe-krk 3 hours ago | parent | next [-] | | Deeper in the article: https://docs.gitlab.com/releases/patches/patch-release-gitla... GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression. (...) CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Here, CVSS 10.0 means arbitrary remote code execution. | | |
| ▲ | tptacek 3 hours ago | parent [-] | | "Arbitrary RCE" does mean something. "CVSS 10.0" does not. We should be using the article headline here. | | |
| ▲ | phoe-krk 3 hours ago | parent | next [-] | | Truth be told, I don't think that "GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13" is a more descriptive title, even taking the HN guidelines into account. It could be better, sure, but it's not horrible (IMO). | | |
| ▲ | tptacek 3 hours ago | parent [-] | | It's an editorialization. The submitter is saying something about the importance of CVSS that the article does not. A better title would say "Remote Code Execution" where it says "CVSS 10.0" now. |
| |
| ▲ | artooro 2 hours ago | parent | prev [-] | | Good point guys, I've updated the title. |
|
| |
| ▲ | ivanjermakov 3 hours ago | parent | prev | next [-] | | Because "10 out of 10" is a better headline for the average reader than "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H". | |
| ▲ | Retr0id 3 hours ago | parent | prev | next [-] | | Sometimes CVSS 10 "oversells" the true severity of a bug but this doesn't seem to be one of those cases. | |
| ▲ | TZubiri 3 hours ago | parent | prev [-] | | >CVSS of 10 doesn't actually mean anything. Might you perchance be exaggerating? | | |
| ▲ | tptacek 3 hours ago | parent [-] | | No? CVSS is a Ouija board. Citrix directory traversal got scored 10.0. So did a Cisco Broadworks SSO bypass. Meanwhile, Shellshock did not. CVSS is like the Pitchfork Music ratings scale. It communicates false precision, and it's easy to point to places where that precision misleads (D-plan's "Emergency & I" is not better than every Yo La Tengo album). | | |
| ▲ | TZubiri 3 hours ago | parent [-] | | Have you read signal/noise theory? That a signal isn't perfect (that it contains false positives or positive falses in case of binary signals, or that it has a delta between the signal and the underlying phenomenon) doesn't mean that it carries no information. For example if I cry wolf 50% of the time, but 100% of the times there's a wolf I cry wolf. Then no matter what the frequency of wolf sightings are, my crying wolf carries some information (unless there's always a wolf). Assume there's a wolf 1% of the nights, then I will cry wolf 50% of the time, and you only need to check for a wolf 50% of the nights rather than 100%. It's worth noting that there's still technically signal even if I sometimes miss a wolf, even if you may choose to ignore that signal in order to pursue 100% accuracy yourself. | | |
| ▲ | nikanj 2 hours ago | parent [-] | | It's more like: you work as an animal spotter, and if you tell people you saw a hamster, you'll get no glory. So obviously you spotted a direwolf at least 12 feet tall. |
|
|
|
|
