GitLab fixes Critical Vulnerabilities
Share this:
GitLab is a web-based DevOps life cycle platform providing an open-source license from GitLab Inc. to offer wiki, problem tracking, and continuous pipeline integration and deployment capabilities. GitLab fixed many Vulnerabilities including high impact security flaws.
GitLab’s GraphQL API, a cross-site request forgery (CSRF) has developed a mechanism for an attacker to call modifications while they are impersonating as their victims.
The Gitlab Webhook feature could be exploited for denial- of service (DoS) attacks because of a second high-level security vulnerability.
‘Afewgoats‘ researchers have identified DoS vulnerability and reported it through a HackerOne-operated GitLab bug reward program.
“The webhook connections usually have timeouts set, but badly-behaving webserver can bypass them and keep the connection open for days.” afewgoats explained.
Through updating installations to a new version of GitLab, CRSF and DoS issues and a range of minor errors can be rectified.
As a security advisory from GitLab, the platform upgrade addresses 15 medium severity and two low-impact issues. These add-on vulnerabilities also include a clipboard DOM-based cross-site scripting (XSS) issue, a reflected XSS in release edit pages, and the audit log problem of the stored XSS
