GitLab Security Release: 16.1.1, 16.0.6, and 15.11.10

criticalCVE-2023-3424 CVE-2023-2190 CVE-2023-3444 CVE-2023-0838 CVE-2023-2620 CVE-2023-3362

On June 29, 2023, we released versions 16.1.1, 16.0.6, and 15.11.10 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab releases patches for vulnerabilities in dedicated security releases. There are two types of security releases: a monthly, scheduled security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our security FAQ . You can see all of our regular and security release blog posts here . In addition, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched. We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest security release for their supported version. You can read more best practices in securing your GitLab instance in our blog post. Recommended Action We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible . When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected. Table of Fixes Title Severity ReDoS via EpicReferenceFilter in any Markdown fields high New commits to private projects visible in forks created while project was public medium Code Owners approvals are not removed allowing merge into protected branches medium Maintainer can leak masked webhook secrets by manipulating URL masking medium Information disclosure of project import error

CSIRTS triage

vendor: GitLab product: GitLab Community Edition and Enterprise EditionOtheraffected: 16.1.1, 16.0.6, 15.11.10

What: These versions contain important security fixes.
Who is affected: All GitLab installations.
Urgency: Immediate upgrade is strongly recommended due to critical vulnerabilities.
Action: Upgrade to one of the patched versions.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch GitLab Community Edition and Enterprise Edition

Get an email when a new GitLab Community Edition and Enterprise Edition advisory drops — max one per day, one-click unsubscribe.

Details

Source: GitLab Security Releases (INTL · vendor-psirt · site)
Severity: critical
Published: 2023-06-29
Exploitation: Not in CISA KEV at last sync

Original advisory: https://docs.gitlab.com/releases/patches/patch-release-gitlab-16-1-1-released/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2023-34240.91% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 57% of all EPSS-scored CVEs.
Low exploitation riskCVE-2023-21900.66% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.
Low exploitation riskCVE-2023-34440.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
Low exploitation riskCVE-2023-08380.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all EPSS-scored CVEs.
Low exploitation riskCVE-2023-26200.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all EPSS-scored CVEs.
Low exploitation riskCVE-2023-33620.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
Low exploitation riskCVE-2023-31020.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
Low exploitation riskCVE-2023-25760.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
Low exploitation riskCVE-2023-22000.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
Low exploitation riskCVE-2023-33630.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2023-3424	coverage & exploitation status	NVD · CVE.org
CVE-2023-2190	coverage & exploitation status	NVD · CVE.org
CVE-2023-3444	coverage & exploitation status	NVD · CVE.org
CVE-2023-0838	coverage & exploitation status	NVD · CVE.org
CVE-2023-2620	coverage & exploitation status	NVD · CVE.org
CVE-2023-3362	coverage & exploitation status	NVD · CVE.org
CVE-2023-3102	coverage & exploitation status	NVD · CVE.org
CVE-2023-2576	coverage & exploitation status	NVD · CVE.org
CVE-2023-2200	coverage & exploitation status	NVD · CVE.org
CVE-2023-3363	coverage & exploitation status	NVD · CVE.org
CVE-2023-1936	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

criticalGitLab Security Release: 16.1.1, 16.0.6, and 15.11.10gitlab