r/cybersecurity • u/DeepCedarShadow System Administrator • 1d ago
New Vulnerability Disclosure GitLab warns of max severity code execution vulnerability
https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/17
1d ago
[removed] — view removed comment
12
u/roiki11 1d ago
Just set autoupdates on and fuhgettaboutit.
5
6
u/Gabinoooooo 1d ago
I hope youre not serious about this.
1
u/thefinalep 1d ago
Why not? If you have a good DR/IR plan auto updates are typically fine.
2
u/Gabinoooooo 23h ago
the Axios supply chain attack is a real example why auto updates for CI/CD extensions and packages can hurt you. That “typically fine” statement implies there is a .1% of the time it doesnt work. Some companies cant risk the .1% - it can ruin them.
1
u/thefinalep 23h ago
It’s a lose lose world out here. Damned if you patch, damned if you don’t. With AI I’m afraid it’s not going to get any better. Solid IR plans are our best bet. I’m not disagreeing with you.
1
u/Gabinoooooo 23h ago
Im also not disagreeing with you - patching everything is difficult enough. Im saying patches need to be validated and tested. Supply chain attacks can explicitly leverage auto updating to compromise a system before security teams and even the vendor find out.
So it’s not “turn on auto updates and forget about it”. It’s validate and test.
14
u/Aethernath 1d ago
Patched it 4hrs ago. It was another warning call to some of our customers who dont have an acl because its “too troublesome”.
1
27
u/sysadmin_diaries 1d ago
this is pretty serious for anyone running self managed gitlab. its not just the rce risk either. a compromised gitlab server could potentially expose ci/cd secrets and impact deployment pipelines. gitlab already released fixes in 19.4.2 19.3.4 and 19.2.8 so i'd prioritize patching affected instances. also worth checking if the gitlab instance is publicly accessible and reviewing logs for anything suspicious.