GitLab Critical Security Release: 15.11.2, 15.10.6, and 15.9.7
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	Jelto
	May 5 2023, 9:15 PM

Description

Includes one fix, for:

Table of Fixes
Title 	Severity
Malicious Runner Attachment via GraphQL 	critical

Test instance:

Replicas:

Production:

Mentioned In: T333347: Phabricator does not degrade properly when GitLab is unavailable
Mentioned Here: T335855: Cookbook sre.gitlab.upgrade fails when unpausing runners

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 5 2023, 9:15 PM

I updated gitlab-ce to 15.9.7-ce.0 and proceed with updating the test instance.

Only the gitlab server instances need a upgrade, runners don't need a upgrade.

I updated the test instance to 15.9.7-ce.0

I'll proceed with replicas and production tomorrow morning. There are no suspicious runners registered and I disabled registration of new runners temporarily under https://gitlab.wikimedia.org/admin/application_settings/ci_cd.

All hosts upgraded. I enabled registration of new runners again.

Cookbooks failed due to T335855.

sbassett awarded a token.

sbassett changed Author Affiliation from N/A to WMF Technology Dept.

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".

sbassett changed the edit policy from "Custom Policy" to "All Users".

sbassett changed Risk Rating from N/A to High.