GitLab patches flaws including arbitrary-user pipeline execution in self-managed instances

GitLab released security updates for Community Edition and Enterprise Edition to fix multiple vulnerabilities in versions 16.2.2, 16.1.3, and 16.0.8, and urged self-managed customers to upgrade immediately. The fixes addressed two high-severity Regular Expression Denial of Service (ReDoS) flaws in Markdown processing, along with several medium- and low-severity issues involving cross-site scripting, denial of service, token exposure, authorization weaknesses, and information disclosure. GitLab.com was already running the patched version when the notice was issued, and the release also updated bundled Mattermost to 7.10.4 and Redis to 6.2.13 to mitigate additional security issues.

One of the patched flaws, tracked as CVE-2023-3932, affected GitLab Enterprise Edition and could allow an attacker to run pipeline jobs as an arbitrary user through scheduled security scan policies because of incorrect user management. The issue affected GitLab EE versions from 13.12 before 16.0.8, from 16.1.0 before 16.1.3, and from 16.2.0 before 16.2.2; it was later assigned a CVSS v3.1 score of 5.3 and credited to a HackerOne report submitted by researcher vaib25vicky.