Yesterday, a critical security vulnerability was discovered in GitLab (scoring a maximum severity rating of 10/10!).
This flaw allows unauthenticated remote code execution on a GitLab server without requiring login credentials.
It impacts every release since version 7.0 launched in 2014 – affecting versions spanning 12 years back!
The vulnerability affects both Community Edition (CE) and Enterprise Edition (EE) instances and is linked to Onigmo (a Ruby regular expression engine component embedded in GitLab).
The vulnerability impacts the server side, GitLab CI runners, as well as the GitLab Duo CLI (AI).
Emergency Patch Released:
An emergency security patch has been released for the following versions:
19.5, 19.4, 19.3, 19.2, 19.1, 19.0, 18.11
In an unusual move, GitLab released patches going back 7 versions (though they typically support only the last 3 versions).
However, it is vital to note that earlier releases remain exposed without an official vendor patch—meaning upgrading immediately is highly recommended!
Technical details about the vulnerability can be found here.
Finally, we help organizations plan and execute smart, efficient, automated, or AI-integrated upgrades with minimal downtime.
With over 10 years of hands-on experience, official certifications, and deep expertise across DevOps, DevSecOps, Git, and all GitLab editions, we are here to help.
For details, contact us: gitlab@almtoolbox.com or 866-503-1471 (USA / Canada) or +31 85 064 4633 (International)
