erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: January 11, 2024

1 editorial brief and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: GitLab Password Reset Flaw Enables Account Takeover. Admins of self-managed GitLab CE/EE instances running 16.1.0 through any version below the fixed releases, especially internet-facing ones.
  • Composer (PHP): 1 critical advisory (drupal/core, drupal/drupal). Check with composer audit.
  • Go: 1 critical advisory (github.com/gofiber/template/django/v3). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2023-7028

GitLab Password Reset Flaw Enables Account Takeover

Any self-managed GitLab still on 16.1 through 16.7.1 lets anyone take over accounts without 2FA by email alone; upgrade immediately and turn on 2FA.

Must act: Admins of self-managed GitLab CE/EE instances running 16.1.0 through any version below the fixed releases, especially internet-facing ones.

Can relax: GitLab.com and GitLab Dedicated users, instances older than 16.1 or already upgraded, and accounts protected by 2FA (takeover via this bug requires the password step).

  1. Check your version (Admin Area > Dashboard, or `sudo gitlab-rake gitlab:env:info`) and upgrade to a fixed release or any current supported version.
  2. Enforce two-factor authentication for all users, starting with administrators.
  3. If you use an external identity provider, disable password authentication in sign-in restrictions, which also disables password reset.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 1

Check: composer audit

  • Drupal Improper Access Control CVE-2019-6342 CVSS 9.8 Critical
    drupal/core > 8.7.3, < 8.7.5 → fixed in 8.7.5; drupal/drupal > 8.7.3, < 8.7.5 → fixed in 8.7.5

Go 1

Check: govulncheck ./...