Alert GCSA-24030 - Aggiornamento di sicurezza per GitLab
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ****************************************************************** alert ID: GCSA-24030 data: 23 febbraio 2024 titolo: Aggiornamento di sicurezza per GitLab ****************************************************************** :: Descrizione del problema GitLab ha rilasciamo nuove versioni della propria piattaforma con le quali risolve 8 vulnerabilita' di cui una di livello alto. Maggiori informazioni sono disponibili alla sezione "Riferimenti". :: Software interessato GitLab Community Edition (CE) GitLab Enterprise Edition (EE) versioni precedenti alla 16.9.1, 16.8.3, 16.7.6 :: Impatto Esecuzione da remoto di codice arbitrario (RCE) Bypass delle funzionalita' di sicurezza (SFB) Denial of Service (DoS) :: Soluzioni Aggiornare alle ultime versioni https://about.gitlab.com/update https://docs.gitlab.com/ee/update/ :: Riferimenti GitLab Security Release https://about.gitlab.com/releases/2024/02/21/security-release-gitlab-16-9-1-released/ GitLab - security best practices https://about.gitlab.com/blog/2022/03/21/security-hygiene-best-practices-for-gitlab-users/ https://about.gitlab.com/blog/2020/05/20/gitlab-instance-security-best-practices/ CSIRT Italia https://www.csirt.gov.it/contenuti/sanate-vulnerabilita-su-gitlab-ce-ee-al01-240222-csirt-ita Mitre CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3509 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4895 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6477 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6736 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0410 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0861 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1451 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1525 GARR CERT Security Alert - subscribe/unsubscribe: http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert -----BEGIN PGP SIGNATURE----- iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCZdhHJAAKCRDBnEyTZRJg QqKnAJ97x7Sem7nUFDk66RDmWuV9aZS1tACeNSB0NuEJA676G9/aTNBrL7XwaqY= =JM4z -----END PGP SIGNATURE-----