Alert GCSA-26262 - Aggiornamento di sicurezza per GitLab

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ****************************************************************** alert ID: GCSA-26262 data: 12 ottobre 2026 titolo: Aggiornamento di sicurezza per GitLab ****************************************************************** :: Descrizione del problema GitLab ha rilasciato nuove versioni della propria piattaforma con le quali risolve 24 vulnerabilita', delle quali una di livello "critico, e 5 di livello "alto". CVE-2026-97229 (CVSS score 10.0) Riguarda il compilatore di espressioni regolari CI/CD. La convalida debole delle espressioni regolari, potrebbe consentire ad un aggressore non autenticato, di eseguire codice arbitrario sul server. Maggiori informazioni sono disponibili alla sezione "Riferimenti". :: Software interessato GitLab Community Edition (CE) GitLab Enterprise Edition (EE) versioni precedenti alla 19.4.2, 19.3.4 and 19.2.8 :: Impatto Cross-site Scripting (XSS) Server-side request forgery (SSRF) Esecuzione remota di codice arbitrario (RCE) Bypass delle funzionalita' di sicurezza (SFB) Attacco alla confidenzialita' dei dati (ID) :: Soluzioni Aggiornare alle ultime versioni https://about.gitlab.com/update https://docs.gitlab.com/update/ :: Riferimenti GitLab Security Release https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ GitLab - security best practices https://about.gitlab.com/blog/security-hygiene-best-practices-for-gitlab-users/ https://about.gitlab.com/blog/gitlab-instance-security-best-practices/ https://about.gitlab.com/security/hardening/ https://about.gitlab.com/it-it/the-source/security/how-to-implement-secret-management-best-practices-with-gitlab/ https://about.gitlab.com/it-it/the-source/security/enterprise-scale-security-and-compliance-policy-management-in-the-ai-era/ https://thehackernews.com/2026/09/a-leaked-gitlab-issue-email-address.html Bleeping Computer https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/ CVE ID https://www.cve.org/CVERecord?id=CVE-2026-100104 https://www.cve.org/CVERecord?id=CVE-2026-100755 https://www.cve.org/CVERecord?id=CVE-2026-101168 https://www.cve.org/CVERecord?id=CVE-2026-103549 https://www.cve.org/CVERecord?id=CVE-2026-104661 https://www.cve.org/CVERecord?id=CVE-2026-105458 https://www.cve.org/CVERecord?id=CVE-2026-14210 https://www.cve.org/CVERecord?id=CVE-2026-14552 https://www.cve.org/CVERecord?id=CVE-2026-14814 https://www.cve.org/CVERecord?id=CVE-2026-16275 https://www.cve.org/CVERecord?id=CVE-2026-16301 https://www.cve.org/CVERecord?id=CVE-2026-5954 https://www.cve.org/CVERecord?id=CVE-2026-6567 https://www.cve.org/CVERecord?id=CVE-2026-7767 https://www.cve.org/CVERecord?id=CVE-2026-78335 https://www.cve.org/CVERecord?id=CVE-2026-81839 https://www.cve.org/CVERecord?id=CVE-2026-82632 https://www.cve.org/CVERecord?id=CVE-2026-84284 https://www.cve.org/CVERecord?id=CVE-2026-85529 https://www.cve.org/CVERecord?id=CVE-2026-92528 https://www.cve.org/CVERecord?id=CVE-2026-9268 https://www.cve.org/CVERecord?id=CVE-2026-92883 https://www.cve.org/CVERecord?id=CVE-2026-96893 https://www.cve.org/CVERecord?id=CVE-2026-97229 GARR CERT Security Alert - subscribe/unsubscribe: http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert -----BEGIN PGP SIGNATURE----- iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCas0D+QAKCRDBnEyTZRJg QnKFAJ9NKodZJFFADExQFKS4R0wcAzFhowCffOobXMA0WhRYAahGo0pi29d1csg= =gSLf -----END PGP SIGNATURE-----