GitLab users warned of flaw that allows file overwrite — so update now
New flaw with a severity score of 9.9 found in GitLab
This patch is a week old, so hopefully you have already updated.
GitLab seems to have glaring security holes quite often. Surely this is in part because of the open source codebase and their bug bounty program, which incentivizes researchers to look for these flaws. I'm still baffled sometimes. I've read about a lot of > 9.0 CVEs while maintaining our GitLab instance, there was a 10 only three weeks ago. Thankfully our instance isn't public.
Ehh their engineering simply seems to be subpar. I've read some of the CVEs and if they followed best practices the issues should've never happened. It doesn't inspire confidence.
I read some of the discussion over CVE-2023-7028. It sounds like they were reading a list of emails for password reset and if one matched the account they sent the reset email to all of them.
In my mind it is an extremely low bar that programmers not mix unauthorized input with account data. It simply should not have been possible to send an account secret to anything other than emails present in the database, full stop.
IDK, I appreciate the transparency and I would have been safe from that attack because I always use 2FA. But this is not a viable product for hosting code if their coding practices allow something like that through.
This patch is a week old, so hopefully you have already updated.
Via cron. \yawn
It's because ruby is terrible
