Alert GCSA-22043 - Aggiornamento di sicurezza per GitLab

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

******************************************************************

alert ID: GCSA-22043
data: 05 aprile 2022
titolo: Aggiornamento di sicurezza per GitLab

******************************************************************

:: Descrizione del problema

GitLab ha rilasciamo nuove versioni della propria piattaforma
con le quali risolve 17 vulnerabilita', la piu' grave (CVE-2022-1162)
e' di livello critico (CVSS 9.1), e potrebbe consentire ad
aggressori remoti di impossessarsi degli account utente
utilizzando password hardcoded.

Il produttore consiglia di aggiornare immediatamente
tutte le installazioni.

Il 4 aprile l'avviso ufficiale e' stato aggiornato
aggiungendo uno script per aiutare gli amministratori ad
identificare gli account utente potenzialmente interessati
dalla vulnerabilita' CVE-2022-1162.

Maggiori informazioni sono disponibili alla sezione "Riferimenti".


:: Software interessato

GitLab Community Edition (CE)
GitLab Enterprise Edition (EE)

versioni precedenti alla 14.9.2, 14.8.5 e 14.7.7


:: Impatto

Cross-Site Scripting (XSS)
Denial of Service (DoS)
Accesso a dati riservati (ID)
Bypass delle funzionalita' di sicurezza (SFB)
Acquisizione di privilegi piu' elevati (EoP)


:: Soluzioni

Aggiornare alle ultime versioni

GitLab 14.9.2, 14.8.5 e 14.7.7

https://about.gitlab.com/update
https://docs.gitlab.com/ee/update/
https://docs.gitlab.com/ee/update/package/


:: Riferimenti

GitLab Critical Security Release
https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/

GitLab instance: security best practices
https://about.gitlab.com/blog/2020/05/20/gitlab-instance-security-best-practices/

Bleeping Computer security news
https://www.bleepingcomputer.com/news/security/critical-gitlab-vulnerability-lets-attackers-take-over-accounts/

Mitre's CVE ID
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1193
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1190
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1189
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1188
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1185
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1175
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1174
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1162
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1157
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1148
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1121
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1120
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1111
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1105
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1100
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1099
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0740


GARR CERT Security Alert - subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----

iF0EARECAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCYkxFDgAKCRDBnEyTZRJg
Qh1NAJ0czFyviRme/sWEhbxaLt7A8O5xNgCgns8d2ZMQH7uBm2/PjMvddeb9pKo=
=iLUj
-----END PGP SIGNATURE-----