12 ms·

Gitlab Critical Security Release

260 points by sidcool 5y ago

dorasmith011 5y ago
wyldfire 5y ago
> We strongly recommend that all GitLab installations be upgraded to one of these versions immediately. Sounds like an RCE vulnerability. interesting recent fate of a Ukrainian company.
- YorickPeterse 5y ago
  I doubt it's related. DZ left GitLab a while back, and even then his involvement had been limited for quite some time. Knowing GitLab and its history of security vulnerabilities, the timing is probably just a coincidence. There has also never been any evidence of e.g. state actors sneaking in backdoors and what not. The code review process is quite extensive (probably a bit too much even), so it would be difficult to sneak in vulnerabilities deliberately. It's much more likely these issues are caused by growing complexity and the amount of functionality that GitLab supports.
  - wyldfire 5y ago
    > Knowing GitLab and its history of security vulnerabilities, the timing is probably just a coincidence. You're probably right - unless Ukraine has more GL instances than most countries, in which case I'd be a little less likely to believe it's just a coincidence. Russia is deploying lots of attacks now so regardless of where the software was developed, if it's used in Ukraine at all it's more likely that we will find out about its vulnerabilities in the coming days.
    - Sebb767 5y ago
      It's only important when GitLab is used in government infrastructure, though. I imagine that most GitLab instances are civilian, in which case attacking them doesn't help Russia much.
      - cobertos 5y ago
        Not if they're instances related to critical infrastructure, like utility software vendors. Or just generally trying to sabotage their economy through hurting commercial entities
      - smus 5y ago
        because us gov operations are totally divorced from the civilian sector?
        Sebb767 5y ago
        The US government is currently very much not involved. And sure, the ua gov will have a GitLab somewhere, but their time is limited and GitLab does not seem like a great value.
  - deleted 5y ago
    [deleted]
  - deleted 5y ago
    [deleted]
- deleted 5y ago
  [deleted]
  - deleted 5y ago
    [deleted]
mschuster91 5y ago
Jesus the amount of remote-exploitable bugs in Gitlab the last months is astonishing. At this point it's madness to even consider running a publicly-reachable Gitlab instance... And that's actually pretty sad, because Gitlab is the only open-source alternative that can keep up with Github feature-wise.
- ModernMech 5y ago
  > only open-source alternative that can keep up with Github feature-wise. Imo they're still leading Github in some areas. My favorite Gitlab exclusive feature is a very simple one: folders inside of projects. Usually Github has followed a pattern of catching up to Gitlab, so I think it's probably only a matter of time before they add this feature (if they haven't already, it's been a while since I checked). Actually I take that back, my favorite feature is that I can host my own private instance. Gitlab gets even better if you have admin access to the system. And that's one feature Github will probably take a while to copy, if ever.
  - Operyl 5y ago
    > And that's one feature Github will probably take a while to copy, if ever. Eh you can already self host GitHub, longer than GitLab has been around, it’s just not free to do so.
    - ModernMech 5y ago
      > it’s just not free to do so. My general rule of thumb is that if a product lists its price as "Contact our sales team", then its effectively unavailable to me as an individual. So I guess if we're talking about what exactly the Github "feature" is that MS won't copy, it wouldn't be that there's an enterprise option, but that Gitlab is free and open source and practical for me as an individual to install. Obviously if you pay Microsoft enough money they'll do whatever you want (up to and including I guess buying Github itself as a company from them. Always has been an option, it's just not free to do so.)
      - 5y ago
shaicoleman 5y ago
I reported a 2FA bypass vulnerability (TOTP code could be reused), and it was marked as low severity, and took them nearly a year and a half to fix. They didn't even bother creating a CVE for it. It doesn't seem like they take security very seriously.
- ericpauley 5y ago
  Are you saying that a valid TOTP code can be reused within its validity period? What’s the proposed threat model here (how is an adversary using this to inflict harm)? Given the engineering effort of tracking used tokens and the relatively low exploitability it seems odd to generalize to the entire organization based on this.
  - lolinder 5y ago
    Theoretically it means that if someone has your password and has MITM'd you or has a keylogger on you, they can log in as you in the 30 second window. That said, someone with the level of access required to exploit this vulnerability isn't going to be stopped because GitLab patches it. There are plenty of other things they could do with that kind of access.
    - hn_throwaway_99 5y ago
      This is why threat vector analysis is so important, because in your case, there is no additional vector. If someone has MITM'd you, they can just intercept your token before they pass it to Gitlab. And to your other point, you're right, if your adversary already has a keylogger running on your device you're pretty much screwed in any case.
    - nijave 5y ago
      It enables phishing where you're actually logged in after submitting your credentials. You don't need a MITM from a network perspective.
      - hedora 5y ago
deleted 5y ago
[deleted]
jdvh 5y ago
It takes about 30 minutes to set up your own git server. You can easily create your own git hooks to send email notifications on "git push", or to trigger CI or deployment. I get that gitlab is tremendously valuable for bigger teams, but smaller groups can easily do without. This isn't the first time gitlab has security issues, and it won't be the last. It's just not worth it for us. https://git-scm.com/book/en/v2/Git-on-the-Server-Setting-Up-the-Server https://git-scm.com/book/en/v2/Git-on-the-Server-Setting-Up-...
- gizmo385 5y ago
  You could make this argument about basically any service and it comes up on HN without fail anytime something like this happen: "Just self host, it isn't hard." And sure - self hosting might not be terribly complicated but that's one more thing that now you've got to worry about and keep track of. One more thing that you've got manage and keep up to date. There is a lot of value in convenience, ease of access, and simple scalability.
  - mmsbdjjkvjj 5y ago
    In this case though, gitlab is a self hosted product
  - detaro 5y ago
    You're in a thread about an update to the self-hosted Gitlab offering. They aren't saying "use this instead of the service", but "if you self-host you can also self-host a simpler thing", so your response really doesn't fit the topic at hand.
    - isbvhodnvemrwvn 5y ago
      There is a point where "simpler" is so laughably inadequate when compared to the alternative that dismissing the comment makes sense. You lose code review, integrated CI, and will need quite a lot of time to manage this entire solution anyway.
      - 5y ago
dflock 5y ago
If you're going to run gitlab, I would suggest using the docker image and docker-compose to run it. Just done this upgrade: two commands, took 30s.
- hobo_mark 5y ago
  What are the system requirements for a personal setup? I mean > 4GB RAM is the required minimum memory size and supports up to 500 users How far down does it scale to just a handful of users though? (usual free vps are about 1GB, and are normally used to run other things as well) EDIT: found it, unfortunately not as much as I would have hoped (but not unexpected) > Minimum 2GB of RAM + 1GB of SWAP > You should be able to run GitLab with up to 5 developers with individual Git projects no larger than 100MB. https://docs.gitlab.com/omnibus/settings/memory_constrained_envs.html https://docs.gitlab.com/omnibus/settings/memory_constrained_...
  - hedora 5y ago
    It looks like gogs only requires 512MB. It might be a better choice for resource constrained environments. https://github.com/gogs/gogs/issues/5487 https://github.com/gogs/gogs/issues/5487
- deleted 5y ago
  [deleted]
- ninjaoxygen 5y ago
  My only annoyance with GitLab on that front is the lack of tags for "14.8-ce" to enable use of watchtower to keep the minor/security patch up to date, like we have on other images. I definitely do not want to use "latest", in the past there have been updates or intervention required between major versions.
- Netcob 5y ago
  Am I missing something? In my experience, updating gitlab involves looking at either the docker hub page with the tags or that gitlab news page that I'm trying to find right now and then painfully going from minor to minor. If you update every week you're probably fine, but if you skip a version some database migrations might not work and then the real fun begins.
TavsiE9s 5y ago
Is code search still a hot mess for Gitlab?
- mdaniel 5y ago
  I don't know if this is what you're asking, but they have an opt-in integration with Sourcegraph and it's handy since code-aware navigation is almost always more effective than search: https://docs.gitlab.com/ee/integration/sourcegraph.html#enable-sourcegraph-in-user-preferences https://docs.gitlab.com/ee/integration/sourcegraph.html#enab... It's also unclear if your bad experience was with their saas offering, or with a self-hosted setup
- deleted 5y ago
  [deleted]
- sytse 5y ago
  Are you using the proprietary global/advanced code search powered by elastic search?
cosmiccatnap 5y ago
tedunangst 5y ago
The dreaded CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N strikes again.
- deleted 5y ago
  [deleted]
- stingraycharles 5y ago
  Out of curiosity, what are some other noteworthy projects that were affected by this CVE?
  - derac 5y ago
    This is a vulnerability scoring system, it indicates the severity level across a number of different metrics. https://www.first.org/cvss/calculator/3.0 https://www.first.org/cvss/calculator/3.0
    - stingraycharles 5y ago
      Got it, so it’s a classification system, I wasn’t aware of that. Thanks for the reply, I learned something today. :)
- deleted 5y ago
  [deleted]
pabs3 5y ago
I still wish they would accommodate security conscious users who avoid running JavaScript by practicing progressive enhancement. IIRC all of the tickets about it have been rejected though. I note the UK government uses this web development methodology. https://en.wikipedia.org/wiki/Progressive_enhancement https://en.wikipedia.org/wiki/Progressive_enhancement https://gdstechnology.blog.gov.uk/2016/09/19/why-we-use-progressive-enhancement-to-build-gov-uk/ https://gdstechnology.blog.gov.uk/2016/09/19/why-we-use-prog... https://news.ycombinator.com/item?id=12538144 https://news.ycombinator.com/item?id=12538144
- octoberfranklin 5y ago
  Gitlab's refusal to get their act together over this is why I stopped sending them money. It's ridiculous. Almost everything that doesn't require logging in works on github without javascript. There is no excuse for gitlab's sitution here.
  - klysm 5y ago
    I think the excuse is economic. That’s a pretty big investment of time to please probably a very small subset of their users. That JS isn’t exactly hostile..
    - octoberfranklin 5y ago
      And yet github and gitea had no trouble making this "big" investment? I call BS. Overreliance on JS is an architectural flaw, not a cost-saving measure.
      - KronisLV 5y ago
        > Overreliance on JS is an architectural flaw, not a cost-saving measure. While i (somewhat) agree, i don't think that this is a charitable take. Relying on heavy JS libraries with a large attack surface would be an architectural flaw. Using JS for your front end is your architecture. Probably not a choice that you approve of, however one that they've made nonetheless. Of course, one can talk of a possible middle ground in the form of interesting projects like LibreJS, but those haven't exactly gained much popularity either, unfortunately: https://www.gnu.org/software/librejs/ https://www.gnu.org/software/librejs/ Sadly the people who actually turn off JS and the reasons for doing this (as well as any sort of developer advocacy) are the minority [1][2] and therefore are largely irrelevant and unheard, even if the arguments are sometimes pretty sound (especially things like battery usage). That position has largely lost out and i guess most of us now just need to deal with the consequences of it in our daily lives where using JS frameworks can also just be easier, but even if it isn't (e.g. React and Redux), then we just have to bite the bullet and deal with it. Sources (though there are probably better ones): [1] https://w3techs.com/technologies/details/cp-javascript [2] https://stackoverflow.com/questions/9478737/browser-statistics-on-javascript-disabled Curiously, i actually migrated to Gitea (and Nexus/Drone CI) for slightly different reasons, about which i wrote on my blog: https://blog.kronis.dev/articles/goodbye-gitlab-hello-gitea-nexus-and-drone https://blog.kronis.dev/articles/goodbye-gitlab-hello-gitea-...

260 points by sidcool 5y ago

> We strongly recommend that all GitLab installations be upgraded to one of these versions immediately. Sounds like an RCE vulnerability. interesting recent fate of a Ukrainian company.

YorickPeterse 5y ago
I doubt it's related. DZ left GitLab a while back, and even then his involvement had been limited for quite some time. Knowing GitLab and its history of security vulnerabilities, the timing is probably just a coincidence. There has also never been any evidence of e.g. state actors sneaking in backdoors and what not. The code review process is quite extensive (probably a bit too much even), so it would be difficult to sneak in vulnerabilities deliberately. It's much more likely these issues are caused by growing complexity and the amount of functionality that GitLab supports.
- wyldfire 5y ago
  > Knowing GitLab and its history of security vulnerabilities, the timing is probably just a coincidence. You're probably right - unless Ukraine has more GL instances than most countries, in which case I'd be a little less likely to believe it's just a coincidence. Russia is deploying lots of attacks now so regardless of where the software was developed, if it's used in Ukraine at all it's more likely that we will find out about its vulnerabilities in the coming days.
  - Sebb767 5y ago
    It's only important when GitLab is used in government infrastructure, though. I imagine that most GitLab instances are civilian, in which case attacking them doesn't help Russia much.
    - cobertos 5y ago
      Not if they're instances related to critical infrastructure, like utility software vendors. Or just generally trying to sabotage their economy through hurting commercial entities
    - smus 5y ago
      because us gov operations are totally divorced from the civilian sector?
      - Sebb767 5y ago
        The US government is currently very much not involved. And sure, the ua gov will have a GitLab somewhere, but their time is limited and GitLab does not seem like a great value.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
deleted 5y ago
[deleted]
- deleted 5y ago
  [deleted]

mschuster91 5y ago

Jesus the amount of remote-exploitable bugs in Gitlab the last months is astonishing. At this point it's madness to even consider running a publicly-reachable Gitlab instance... And that's actually pretty sad, because Gitlab is the only open-source alternative that can keep up with Github feature-wise.

ModernMech 5y ago
> only open-source alternative that can keep up with Github feature-wise. Imo they're still leading Github in some areas. My favorite Gitlab exclusive feature is a very simple one: folders inside of projects. Usually Github has followed a pattern of catching up to Gitlab, so I think it's probably only a matter of time before they add this feature (if they haven't already, it's been a while since I checked). Actually I take that back, my favorite feature is that I can host my own private instance. Gitlab gets even better if you have admin access to the system. And that's one feature Github will probably take a while to copy, if ever.
- Operyl 5y ago
  > And that's one feature Github will probably take a while to copy, if ever. Eh you can already self host GitHub, longer than GitLab has been around, it’s just not free to do so.
  - ModernMech 5y ago
    > it’s just not free to do so. My general rule of thumb is that if a product lists its price as "Contact our sales team", then its effectively unavailable to me as an individual. So I guess if we're talking about what exactly the Github "feature" is that MS won't copy, it wouldn't be that there's an enterprise option, but that Gitlab is free and open source and practical for me as an individual to install. Obviously if you pay Microsoft enough money they'll do whatever you want (up to and including I guess buying Github itself as a company from them. Always has been an option, it's just not free to do so.)
    - 5y ago

shaicoleman 5y ago

I reported a 2FA bypass vulnerability (TOTP code could be reused), and it was marked as low severity, and took them nearly a year and a half to fix. They didn't even bother creating a CVE for it. It doesn't seem like they take security very seriously.

ericpauley 5y ago
Are you saying that a valid TOTP code can be reused within its validity period? What’s the proposed threat model here (how is an adversary using this to inflict harm)? Given the engineering effort of tracking used tokens and the relatively low exploitability it seems odd to generalize to the entire organization based on this.
- lolinder 5y ago
  Theoretically it means that if someone has your password and has MITM'd you or has a keylogger on you, they can log in as you in the 30 second window. That said, someone with the level of access required to exploit this vulnerability isn't going to be stopped because GitLab patches it. There are plenty of other things they could do with that kind of access.
  - hn_throwaway_99 5y ago
    This is why threat vector analysis is so important, because in your case, there is no additional vector. If someone has MITM'd you, they can just intercept your token before they pass it to Gitlab. And to your other point, you're right, if your adversary already has a keylogger running on your device you're pretty much screwed in any case.
  - nijave 5y ago
    It enables phishing where you're actually logged in after submitting your credentials. You don't need a MITM from a network perspective.
    - hedora 5y ago

deleted 5y ago

[deleted]

jdvh 5y ago

It takes about 30 minutes to set up your own git server. You can easily create your own git hooks to send email notifications on "git push", or to trigger CI or deployment. I get that gitlab is tremendously valuable for bigger teams, but smaller groups can easily do without. This isn't the first time gitlab has security issues, and it won't be the last. It's just not worth it for us. https://git-scm.com/book/en/v2/Git-on-the-Server-Setting-Up-the-Server https://git-scm.com/book/en/v2/Git-on-the-Server-Setting-Up-...

gizmo385 5y ago
You could make this argument about basically any service and it comes up on HN without fail anytime something like this happen: "Just self host, it isn't hard." And sure - self hosting might not be terribly complicated but that's one more thing that now you've got to worry about and keep track of. One more thing that you've got manage and keep up to date. There is a lot of value in convenience, ease of access, and simple scalability.
- mmsbdjjkvjj 5y ago
  In this case though, gitlab is a self hosted product
- detaro 5y ago
  You're in a thread about an update to the self-hosted Gitlab offering. They aren't saying "use this instead of the service", but "if you self-host you can also self-host a simpler thing", so your response really doesn't fit the topic at hand.
  - isbvhodnvemrwvn 5y ago
    There is a point where "simpler" is so laughably inadequate when compared to the alternative that dismissing the comment makes sense. You lose code review, integrated CI, and will need quite a lot of time to manage this entire solution anyway.
    - 5y ago

dflock 5y ago

If you're going to run gitlab, I would suggest using the docker image and docker-compose to run it. Just done this upgrade: two commands, took 30s.

hobo_mark 5y ago
What are the system requirements for a personal setup? I mean > 4GB RAM is the required minimum memory size and supports up to 500 users How far down does it scale to just a handful of users though? (usual free vps are about 1GB, and are normally used to run other things as well) EDIT: found it, unfortunately not as much as I would have hoped (but not unexpected) > Minimum 2GB of RAM + 1GB of SWAP > You should be able to run GitLab with up to 5 developers with individual Git projects no larger than 100MB. https://docs.gitlab.com/omnibus/settings/memory_constrained_envs.html https://docs.gitlab.com/omnibus/settings/memory_constrained_...
- hedora 5y ago
  It looks like gogs only requires 512MB. It might be a better choice for resource constrained environments. https://github.com/gogs/gogs/issues/5487 https://github.com/gogs/gogs/issues/5487
deleted 5y ago
[deleted]
ninjaoxygen 5y ago
My only annoyance with GitLab on that front is the lack of tags for "14.8-ce" to enable use of watchtower to keep the minor/security patch up to date, like we have on other images. I definitely do not want to use "latest", in the past there have been updates or intervention required between major versions.
Netcob 5y ago
Am I missing something? In my experience, updating gitlab involves looking at either the docker hub page with the tags or that gitlab news page that I'm trying to find right now and then painfully going from minor to minor. If you update every week you're probably fine, but if you skip a version some database migrations might not work and then the real fun begins.

TavsiE9s 5y ago

Is code search still a hot mess for Gitlab?

mdaniel 5y ago
I don't know if this is what you're asking, but they have an opt-in integration with Sourcegraph and it's handy since code-aware navigation is almost always more effective than search: https://docs.gitlab.com/ee/integration/sourcegraph.html#enable-sourcegraph-in-user-preferences https://docs.gitlab.com/ee/integration/sourcegraph.html#enab... It's also unclear if your bad experience was with their saas offering, or with a self-hosted setup
deleted 5y ago
[deleted]
sytse 5y ago
Are you using the proprietary global/advanced code search powered by elastic search?

cosmiccatnap 5y ago

tedunangst 5y ago

The dreaded CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N strikes again.

deleted 5y ago
[deleted]
stingraycharles 5y ago
Out of curiosity, what are some other noteworthy projects that were affected by this CVE?
- derac 5y ago
  This is a vulnerability scoring system, it indicates the severity level across a number of different metrics. https://www.first.org/cvss/calculator/3.0 https://www.first.org/cvss/calculator/3.0
  - stingraycharles 5y ago
    Got it, so it’s a classification system, I wasn’t aware of that. Thanks for the reply, I learned something today. :)
deleted 5y ago
[deleted]

pabs3 5y ago

I still wish they would accommodate security conscious users who avoid running JavaScript by practicing progressive enhancement. IIRC all of the tickets about it have been rejected though. I note the UK government uses this web development methodology. https://en.wikipedia.org/wiki/Progressive_enhancement https://en.wikipedia.org/wiki/Progressive_enhancement https://gdstechnology.blog.gov.uk/2016/09/19/why-we-use-progressive-enhancement-to-build-gov-uk/ https://gdstechnology.blog.gov.uk/2016/09/19/why-we-use-prog... https://news.ycombinator.com/item?id=12538144 https://news.ycombinator.com/item?id=12538144

octoberfranklin 5y ago
Gitlab's refusal to get their act together over this is why I stopped sending them money. It's ridiculous. Almost everything that doesn't require logging in works on github without javascript. There is no excuse for gitlab's sitution here.
- klysm 5y ago
  I think the excuse is economic. That’s a pretty big investment of time to please probably a very small subset of their users. That JS isn’t exactly hostile..
  - octoberfranklin 5y ago
    And yet github and gitea had no trouble making this "big" investment? I call BS. Overreliance on JS is an architectural flaw, not a cost-saving measure.
    - KronisLV 5y ago
      > Overreliance on JS is an architectural flaw, not a cost-saving measure. While i (somewhat) agree, i don't think that this is a charitable take. Relying on heavy JS libraries with a large attack surface would be an architectural flaw. Using JS for your front end is your architecture. Probably not a choice that you approve of, however one that they've made nonetheless. Of course, one can talk of a possible middle ground in the form of interesting projects like LibreJS, but those haven't exactly gained much popularity either, unfortunately: https://www.gnu.org/software/librejs/ https://www.gnu.org/software/librejs/ Sadly the people who actually turn off JS and the reasons for doing this (as well as any sort of developer advocacy) are the minority [1][2] and therefore are largely irrelevant and unheard, even if the arguments are sometimes pretty sound (especially things like battery usage). That position has largely lost out and i guess most of us now just need to deal with the consequences of it in our daily lives where using JS frameworks can also just be easier, but even if it isn't (e.g. React and Redux), then we just have to bite the bullet and deal with it. Sources (though there are probably better ones): [1] https://w3techs.com/technologies/details/cp-javascript [2] https://stackoverflow.com/questions/9478737/browser-statistics-on-javascript-disabled Curiously, i actually migrated to Gitea (and Nexus/Drone CI) for slightly different reasons, about which i wrote on my blog: https://blog.kronis.dev/articles/goodbye-gitlab-hello-gitea-nexus-and-drone https://blog.kronis.dev/articles/goodbye-gitlab-hello-gitea-...