erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: February 11, 2021

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: GitLab CVE-2021-22175: 2021 CI Lint SSRF Now in KEV. Owners of self-managed GitLab CE/EE 10.5 through 13.8.3, especially where an admin enabled local-network requests for webhooks and integrations.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2021-22175

GitLab CVE-2021-22175: 2021 CI Lint SSRF Now in KEV

Any GitLab patched since early 2021 is fine; a self-managed instance still on 13.8.3 or older is years out of date, open to this SSRF and worse bugs, and should be upgraded or pulled offline now.

Must act: Owners of self-managed GitLab CE/EE 10.5 through 13.8.3, especially where an admin enabled local-network requests for webhooks and integrations.

Can relax: Instances on any 2021-or-later release (13.8.4, 13.7.7, 13.6.7 or newer), and current, supported GitLab installs, which carry this and the later CI Lint SSRF fixes.

  1. Find every self-managed GitLab and record its version (gitlab-rake gitlab:env:info or the VERSION file).
  2. Upgrade anything on 13.x or older to a current supported release, following GitLab's upgrade path.
  3. Clear 'Allow requests to the local network from webhooks and integrations' unless you need it, and use the allowlist instead.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.