GitLab patched a flaw that could let outsiders with no login run code on company servers. Software back to 2014 is affected.
GitLab fixed the bug on Wednesday and "strongly recommends" that every organisation running an affected version upgrade "as soon as possible", The Register reported.
The flaw is rated 10 out of 10 on the industry severity scale. GitLab says it works only under certain conditions.
It affects the Community and Enterprise editions that companies run on their own servers. Affected versions go back to 7.0, released in June 2014. GitLab.com and GitLab Dedicated are already patched.
GitLab repositories often hold source code, deployment settings and access keys, the security firm SOC Prime warned. GitLab says it has 50 million registered users and serves more than half of the Fortune 100.
No attacks were known by Thursday. Last month, attackers went after another top-severity flaw in the same products. Those attacks came days after GitLab issued its fix, according to the US cybersecurity agency CISA and researchers.
The fix is out. For companies running their own GitLab, the clock now is installation time, and last month the gap between fix and attack was days.
Image: AI-generated.
Sources
Our file on GitLab
All 3 GitLab storiesFor your next steering committee
- 1Ask when systems of this kind in your landscape were last patched, and who confirms it.
- 2Ask which finance and ERP accounts can be reached from outside, and how each sign-in is protected.
- 3Ask how long a restore took the last time it was tested.
Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01
Welcome back. · Issue 01
