Today we are releasing versions 17.2.2, 17.1.4, 17.0.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).
These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to
one of these versions immediately. GitLab.com is already running the patched version.
GitLab releases fixes for vulnerabilities in dedicated patch releases. There are two types of patch releases:
scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays.
For more information, you can visit our releases handbook and security FAQ.
You can see all of GitLab release blog posts here.
For security fixes, the issues detailing each vulnerability are made public on our
issue tracker
30 days after the release in which they were patched.
We are dedicated to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to
the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers
upgrade to the latest patch release for their supported version. You can read more
best practices in securing your GitLab instance in our blog post.
Recommended Action
We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.
When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.
Security fixes
Table of security fixes

Title
Severity

Privilege Escalation via LFS Tokens Granting Unrestricted Repository Access
Medium

Cross project access of Security policy bot
Medium

Advanced search ReDOS in highlight for code results
Medium

Denial of Service via banzai pipeline
Medium

Denial of service using adoc files
Medium

ReDoS in RefMatcher when matching branch names using wildcards
Medium

Path encoding can cause the Web interface to not render diffs correctly.
Medium

XSS while viewing raw XHTML files through API
Medium

Ambiguous tag name exploitation
Medium

Logs disclosings potentially sensitive data in query params
Medium

Password bypass on approvals using policy projects
Medium

ReDoS when parsing git push
Medium

Webhook deletion audit log can preserve auth credentials
Medium

Privilege Escalation via LFS Tokens Granting Unrestricted Repository Access
A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.
This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, 6.8).
It is now mitigated in the latest release and is assigned CVE-2024-3035.
Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.
Cross project access of Security policy bot
An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which allowed cross project access for Security policy bot.
This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N , 4.4).
It is now mitigated in the latest release and is assigned CVE-2024-6356.
Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.
Advanced search ReDOS in highlight for code results
A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch.
This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3).
We have requested a CVE ID and will update this blog post when it is assigned.
This vulnerability was discovered internally by GitLab team member Terri Chu.
Denial of Service via banzai pipeline
Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which allowed an attacker to cause resource exhaustion via banzai pipeline.
This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5).
It is now mitigated in the latest release and is assigned CVE-2024-5423.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Denial of service using adoc files
A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause a denial of service using crafted adoc files.
This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5).
It is now mitigated in the latest release and is assigned CVE-2024-4210.
Thanks gudanggaramfilter for reporting this vulnerability through our HackerOne bug bounty program.
ReDoS in RefMatcher when matching branch names using wildcards
ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex backtracking.
This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5).
It is now mitigated in the latest release and is assigned CVE-2024-2800.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Path encoding can cause the Web interface to not render diffs correctly.
An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which causes the web interface to fail to render the diff correctly when the path is encoded.
This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N, 5.7).
It is now mitigated in the latest release and is assigned CVE-2024-6329.
Thanks st4nly0n for reporting this vulnerability through our HackerOne bug bounty program.
XSS while viewing raw XHTML files through API
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 prior 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances.
This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N , 4.4).
It is now mitigated in the latest release and is assigned CVE-2024-4207.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Ambiguous tag name exploitation
An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.
This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3).
It is now mitigated in the latest release and is assigned CVE-2024-3958.
Thanks st4nly0n for reporting this vulnerability through our HackerOne bug bounty program.
Logs disclosings potentially sensitive data in query params
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versions starting from 17.2 before 17.2.2. Under certain conditions, access tokens may have been logged when an API request was made in a specific manner.
This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, 4.9).
We have requested a CVE ID and will update this blog post when it is assigned.
This vulnerability was discovered internally by GitLab team member Dominic Couture.
Password bypass on approvals using policy projects
An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the password re-entry requirement to approve a policy.
This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, 4.2).
It is now mitigated in the latest release and is assigned CVE-2024-4784.
Thanks vexin for reporting this vulnerability through our HackerOne bug bounty program.
ReDoS when parsing git push
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regular expression DoS attack on the server.
This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3).
It is now mitigated in the latest release and is assigned CVE-2024-3114.
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
Webhook deletion audit log can preserve auth credentials
An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.
This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N, 4.1).
It is now mitigated in the latest release and is assigned CVE-2024-7586.
This vulnerability was discovered internally by GitLab Team Anton Smith.
Bug fixes
17.2.2

Backups: Fix parsing of existing backups in Azure storage (Backport 17.2)
Do not consider pool repos dangling on restore
Never return nil when search for CC service
Fix issue in RTE related to adding text before a mention
Backport ‘Check if params data cannot be JSONified’ into 17.2
Document Rake task to show/edit token expirations
Backport 17.2 – Introduce lock-free rescheduling for duplicate job
Ignore unknown sequences in sequence fix migration
Fix squished badges rendering in 17.2
Optimize CustomAbility specs to reduce build times
Backport Do not index associated issues that are epic work item type
bug: Fix template error due to divided by zero
Put groups_direct field in CI JWT tokens behind feature flag
Backport ‘Fix cluster check metrics’ into 17.2
Backport Beyond Identity bug fixes to 17.2
Enable project_daily_statistic_counter_attribute_fetch FF by default
Backport 17.2: Release Environments – pipeline level resource group
Add require_personal_access_token_expiry application setting
Backport 17.2: Mark Cookie SameSite as default over HTTP
Pin QA CI tests to stable gitlab-org/gitlab branches

17.1.4

Backups: Fix parsing of existing backups in Azure storage (Backport 17.1)
Backport 17.1 – Introduce lock-free rescheduling for duplicate job
Table driven spec needs shorter spec titles backport
Optimize CustomAbility specs to reduce build times
Put groups_direct field in CI JWT tokens behind feature flag
Increase SQL query threashold on work_items test
Backport ‘Check if params data cannot be JSONified’ into 17.1
Backport Beyond Identity bug fixes to 17.1
Backport gitlab-qa shm fix to 17.1 stable branch
Add require_personal_access_token_expiry application setting

17.0.6

Backups: Fix parsing of existing backups in Azure storage (Backport 17.0)
Backport 17.0 – Introduce lock-free rescheduling for duplicate job
Table driven spec needs shorter spec titles backport
Put groups_direct field in CI JWT tokens behind feature flag
Add require_personal_access_token_expiry application setting

16.11.8

Add require_personal_access_token_expiry application setting

Add require_personal_access_token_expiry application setting
This default enabled, optional setting added for admins of GitLab self-managed instances on versions 16.11 and above allow them to enable mandatory expiraton on all new personal, project and group access tokens. Expirations set for existing tokens are not affected by this setting. For usage information see Require expiration dates for new access tokens
Updating
To update GitLab, see the Update page.
To update Gitlab Runner, see the Updating the Runner page.
Receive Patch Notifications
To receive patch blog notifications delivered to your inbox, visit our contact us page.
To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.
We’re combining patch and security releases
This improvement in our release process matches the industry standard and will help GitLab users get information about security and
bug fixes sooner, read the blog post here.

GitLab Patch Release: 17.2.2, 17.1.4, 17.0.6
via @gitlab

Click to tweet!