Our takeHKCERT lists multiple confirmed vulnerabilities in GitLab. Update your self-hosted instances now; most smaller teams on GitLab.com can ignore this one.Cyber Resilience desk
Sources (6)
- hkcert · hkcert
- govcert_hk · govcert_hk
- govcert_hk · govcert_hk
- govcert_hk · govcert_hk
- govcert_hk · govcert_hk
- hkcert · hkcert
What this means for you — Security leader:Apply the GitLab patches for the listed CVEs in all self-hosted instances; test in staging first.
What this means for you — Lean IT orgs:If you run your own GitLab server, update it to the latest version as soon as you can.
What this means for you — MSP:Check every client GitLab instance for the affected versions and schedule patching in the next maintenance window.
What this means for you — Researcher:Review the HKCERT bulletin for the full CVE list and exploit conditions.