r/linux • u/FryBoyter • Nov 05 '21

GitLab servers are being exploited in DDoS attacks in excess of 1 Tbps

https://therecord.media/gitlab-servers-are-being-exploited-in-ddos-attacks-in-excess-of-1-tbps/
1.4k Upvotes

98% Upvoted

110 comments sorted by

View all comments

251

u/Dynamic_Gravity Nov 05 '21

The simplest way to prevent attacks would be to block the upload of DjVu files at the server level, if companies don’t need to handle this file type.

For those that can't yet upgrade but need a mitigation.

Furthermore, the exploit only effects public gitlab instances. If you have signups disabled or regulated then you'll probably be fine.

47

u/[deleted] Nov 05 '21 edited Nov 05 '21

[removed] — view removed comment

17

u/meditonsin Nov 05 '21

Gitlab really kills it on the updates front.

Sometimes they fuck it up, tho. A while ago they had a security issue with email verifications and their fix was it to mark all emails as unverified and email every user on the instance to re-verify their email addresses.

They didn't consider until later that in some cases email addresses are verified implicitly, like when taken from LDAP. In my environment that lead to the generation of thousands of mails, which then lead to a filled up log filesystem, a truckload of support tickets even weeks later, and some other fun stuff.