GitLab Critical Patch Release

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

It's CVSS 10.0! There are some more details there:

• https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md?ref_type=heads#technical-detailsimpact
• https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md?ref_type=heads#technical-detailsimpact

It seems like an unauthenticated user can somehow get GitLab to render an untrusted .org file, but I don't really understand how that would happen?

We just had a musl CVE regarding an integer overflow parsing untrusted regular expressions earlier today too.

Thankfully I'm no longer responsible for any GitLab instances. I think it's funny we've gotten another RCE today, but I don't envy you if you have to deal with this. I wonder if there are any public exploits out there already

previous pre-announcement (4 comments)