GitLab urges self-managed users to patch a maximum severity code execution flaw

[Kieran_44]

GitLab has told users to patch a maximum severity vulnerability straight away. BleepingComputer reports that the flaw sits in the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration files. The root cause is an integer overflow, and under certain conditions it lets an unauthenticated remote attacker run arbitrary code on a GitLab server using a specially crafted regular expression

The bug was reported through GitLab's HackerOne bug bounty programme by a researcher known as joaxcar. Affected Community and Enterprise Edition versions are 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. GitLab.com is already patched, and GitLab Dedicated customers do not need to do anything

Self managed installations are the ones at risk, and GitLab strongly recommends upgrading them at once. Anyone running their own GitLab instance should check their version today. A remote code execution flaw that needs no login is about as serious as vulnerabilities get

There is a pattern worth noting. Last month GitLab fixed another maximum severity flaw, a path traversal bug that CISA added to its catalogue of exploited vulnerabilities only a day later. BleepingComputer says CISA has flagged five GitLab flaws as exploited in attacks since November 2021. Attackers clearly watch GitLab advisories closely

GitLab says it has more than 30 million registered users, and more than half of Fortune 100 companies use its platform. That makes it a valuable target. The good news is that the fix is available and the bug came through responsible disclosure rather than an active attack

Do you run a self managed GitLab instance? And how quickly does your team usually apply critical patches like this?

GitLab warns of max severity code execution vulnerabilitywww.bleepingcomputer.com