CSIRT Italia confirms GitLab regex flaws reach server code
On Sept. 24, CSIRT Italia joined INCIBE-CERT in confirming 11 vulnerabilities in GitLab Community and Enterprise editions, including two critical and two high-severity flaws. Affected self-managed versions range from 13.11 to releases before 19.2.7, 19.3.3, or 19.4.1; those versions contain the fixes. The update adds no new exploitation evidence or change in affected scope.
Both critical flaws involve regular expressions in CI/CD configuration. An authenticated user can place a specially crafted pattern in pipeline settings; a memory-handling error or a number overflow while GitLab processes the pattern can make it run code on the server instead of simply evaluating it. Other flaws in the batch could expose confidential information or bypass security controls.
For self-managed teams, CI/CD configuration is part of the server’s execution boundary, not just build metadata. GitLab says its Dedicated service already runs a fixed version, leaving the update exposure with customer-operated CE/EE.
Rilasciati aggiornamenti di sicurezza che risolvono 11 vulnerabilità, di cui 2 con gravità “critica” e 2 con gravità “alta”, in GitLab Community Edition (CE) ed Enterprise Edition (EE).