Page MenuHomePhabricator
Create Task
Maniphest T396701

GitLab Security Release: 18.0.2, 17.11.4, 17.10.8
Closed, ResolvedPublicSecurity
Actions

Description

Blog post: https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/

Includes the following fixes:

HTML injection impacts GitLab CE/EE 	High
Cross-site scripting issue impacts GitLab CE/EE 	High
Missing authorization issue impacts GitLab Ultimate EE 	High
Denial of Service impacts GitLab CE/EE 	High
Denial of Service via unbounded Webhook token names impacts GitLab CE/EE 	Medium
Denial of Service via unbounded Board Names impacts GitLab CE/EE 	Medium
Information disclosure issue impacts GitLab CE/EE 	Medium
Denial of Service (DoS) via uncontrolled HTTP Response Processing impacts GitLab CE/EE 	Medium
Information disclosure via authorization bypass impacts GitLab CE/EE 	Medium
Sensitive information disclosure via Group IP restriction bypass 	Low

docs
[version specific upgrade docs]()
[deprecations]()
[changelog]()

Test instance:

  • gitlab-prod-1002.devtools.eqiad1.wikimedia.cloud (currenlty broken T396622: Re-create GitLab test instance)
  • gitlab-runner-1008.devtools.eqiad1.wikimedia.cloud
  • gitlab-runner-1006.devtools.eqiad1.wikimedia.cloud

Replicas:

  • gitlab1003.wikimedia.org
  • gitlab1004.wikimedia.org

Production:

  • gitlab2002.wikimedia.org
  • Trusted runners
  • Shared runners
  • Cloud runners MR created

Details

Risk Rating
High
Author Affiliation
WMF Technology
Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
apt: remove 718C1F180B5A84A3 ceph-octopus packageJeltooperations/puppetproduction+0 -50
Customize query in gerrit
Related Changes in GitLab:
TitleReferenceAuthorSource BranchDest Branch
gitlab-runner: bump image version to alpine-v17.10.2repos/releng/gitlab-cloud-runner!475jeltogitlab-runner-17-10-2main
Customize query in GitLab

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedSecurityJeltoT396701 GitLab Security Release: 18.0.2, 17.11.4, 17.10.8
ResolvedJeltoT396760 SystemdUnitFailed - gitlab1003

Event Timeline

Jelto created this task.Jun 12 2025, 6:26 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 12 2025, 6:26 AM
Jelto claimed this task.Jun 12 2025, 6:27 AM
Jelto triaged this task as High priority.
Jelto added projects: collaboration-services, GitLab (Infrastructure).

I can take care of the upgrade soon. I'll update the apt packages first.

Jelto moved this task from Incoming to Work in Progress on the collaboration-services board.Jun 12 2025, 6:27 AM
Jelto added a comment.Jun 12 2025, 7:22 AM

this is blocked by an expired apt key, see https://gerrit.wikimedia.org/r/c/operations/puppet/+/1156121

VerifyRelease condition '718C1F180B5A84A3' lists expired key '718C1F180B5A84A3'.
(To use it anyway, append it with a '!' to force usage).
There have been errors!
Jelto added a comment.Jun 12 2025, 8:37 AM

Packages are updated on the apt host, I'll proceed with the test runers and the replicas. The test instance is blocked because of T396622: Re-create GitLab test instance unfortunately.

Jelto updated the task description. (Show Details)Jun 12 2025, 8:38 AM
Jelto updated the task description. (Show Details)Jun 12 2025, 8:57 AM
Jelto updated the task description. (Show Details)Jun 12 2025, 9:08 AM
ABran-WMF mentioned this in T396746: SystemdUnitFailed.Jun 12 2025, 12:12 PM
Jelto updated the task description. (Show Details)Jun 12 2025, 1:04 PM
Jelto closed this task as Resolved.Jun 12 2025, 1:07 PM
Jelto updated the task description. (Show Details)

All hosts updated, I'll resolve the task.

It looks like https://gerrit.wikimedia.org/r/c/operations/cookbooks/+/1149363 prevented the typical ProbeDown alert. So one step less of cleanup needed for the upgrade.

sbassett edited projects, added: SecTeam Discussion, Vuln-VulnComponent; removed: Security-Team.Jun 12 2025, 3:15 PM
sbassett changed Author Affiliation from N/A to WMF Technology.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to High.
Stashbot added a comment.Jun 12 2025, 3:23 PM

Mentioned in SAL (#wikimedia-releng) [2025-06-12T15:23:16Z] <dancy> Upgraded gitlab-cloud-runners to v17.10.2 (T396701)

Dzahn added a subtask: T396760: SystemdUnitFailed - gitlab1003.Jun 12 2025, 4:45 PM
Jelto closed subtask T396760: SystemdUnitFailed - gitlab1003 as Resolved.Jun 13 2025, 6:38 AM
Jelto mentioned this in T396760: SystemdUnitFailed - gitlab1003.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits