Alert GCSA-22043 - Aggiornamento di sicurezza per GitLab

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

******************************************************************

   alert ID: GCSA-22043
       data: 05 aprile 2022
     titolo: Aggiornamento di sicurezza per GitLab

******************************************************************

:: Descrizione del problema

   GitLab ha rilasciamo nuove versioni della propria piattaforma
   con le quali risolve 17 vulnerabilita', la piu' grave (CVE-2022-1162)
   e' di livello critico (CVSS 9.1), e potrebbe consentire ad
   aggressori remoti di impossessarsi degli account utente
   utilizzando password hardcoded.

   Il produttore consiglia di aggiornare immediatamente
   tutte le installazioni.

   Il 4 aprile l'avviso ufficiale e' stato aggiornato
   aggiungendo uno script per aiutare gli amministratori ad
   identificare gli account utente potenzialmente interessati
   dalla vulnerabilita' CVE-2022-1162.

   Maggiori informazioni sono disponibili alla sezione "Riferimenti".


:: Software interessato

   GitLab Community Edition (CE)
   GitLab Enterprise Edition (EE)

   versioni precedenti alla 14.9.2, 14.8.5 e 14.7.7


:: Impatto

   Cross-Site Scripting (XSS)
   Denial of Service (DoS)
   Accesso a dati riservati (ID)
   Bypass delle funzionalita' di sicurezza (SFB)
   Acquisizione di privilegi piu' elevati (EoP)


:: Soluzioni

   Aggiornare alle ultime versioni

   GitLab 14.9.2, 14.8.5 e 14.7.7

   https://about.gitlab.com/update
   https://docs.gitlab.com/ee/update/
   https://docs.gitlab.com/ee/update/package/


:: Riferimenti

   GitLab Critical Security Release
   https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/

   GitLab instance: security best practices
   https://about.gitlab.com/blog/2020/05/20/gitlab-instance-security-best-practices/

   Bleeping Computer security news
   https://www.bleepingcomputer.com/news/security/critical-gitlab-vulnerability-lets-attackers-take-over-accounts/

   Mitre's CVE ID
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1193
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1190
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1189
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1188
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1185
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1175
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1174
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1162
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1157
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1148
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1121
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1120
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1111
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1105
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1100
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1099
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0740


GARR CERT Security Alert - subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----

iF0EARECAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCYkxFDgAKCRDBnEyTZRJg
Qh1NAJ0czFyviRme/sWEhbxaLt7A8O5xNgCgns8d2ZMQH7uBm2/PjMvddeb9pKo=
=iLUj
-----END PGP SIGNATURE-----