DoS by repeatedly sending unauthenticated requests for diff-files of a commit or merge request

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4638



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Jan Provaznik <jprovaznik@gitlab.com>
Co-authored-by: Javiera Tapia <jtapia@gitlab.com>

Javiera Tapia authored 2 months ago and GitLab Release Tools Bot committed 2 months ago

Merge branch 'security-1216-dos-diff-files-commit-and-merge-requests-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4638

Changelog: security

Add query to filter_parameters

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4626



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Greg Myers <gmyers@gitlab.com>
Approved-by: David Fernandez <dfernandez@gitlab.com>
Co-authored-by: Radamanthus Batnag <rbatnag@gitlab.com>

Radamanthus Batnag authored 2 months ago and GitLab Release Tools Bot committed 2 months ago

Merge branch 'security-1222-rbatnag-sanitize-graphql-log-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4626

Changelog: security

Added invalid redirect fragment check

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4605



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Andrew Evans <aevans@gitlab.com>
Co-authored-by: smriti <sgarg@gitlab.com>

Smriti Garg authored 2 months ago and GitLab Release Tools Bot committed 2 months ago

Merge branch 'security-1214/verify_redirect_fragment_oauth_login-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4605

Changelog: security

Make confidential threads unresolvable via new issue

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4634



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Heinrich Lee Yu <heinrich@gitlab.com>
Co-authored-by: David Kim <dkim@gitlab.com>

Sincheol (David) Kim authored 2 months ago and GitLab Release Tools Bot committed 2 months ago

Merge branch 'security-fix-486300-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4634

Changelog: security

Do not set session cookie for /v2 endpoints in the response

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4631



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Mark Chao <mchao@gitlab.com>
Approved-by: Greg Myers <gmyers@gitlab.com>
Co-authored-by: Dzmitry Meshcharakou <12459192-dmeshcharakou@users.noreply.gitlab.com>

Dzmitry (Dima) Meshcharakou authored 2 months ago and GitLab Release Tools Bot committed 2 months ago

Merge branch 'security-494694-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4631

Changelog: security

HTML injection in vulnerability details, leads to XSS on self hosted servers

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4553



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Himanshu Kapoor <info@fleon.org>
Co-authored-by: Chen Charnolevsky <ccharnolevsky@gitlab.com>

Chen Charnolevsky authored 2 months ago and GitLab Release Tools Bot committed 2 months ago

Merge branch 'security-480718-xss-vulnerability-details-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4553

Changelog: security

Quarantine Custom model features specs

See merge request !175190



Merged-by: Dat Tang <dattang@gitlab.com>
Approved-by: Mohamed Hamda <mhamda@gitlab.com>
Approved-by: Manoj M J <mmj@gitlab.com>
Co-authored-by: Manoj M J <mmj@gitlab.com>

Backport !170141 into 17.5

See merge request !171140



Merged-by: Dat Tang <dattang@gitlab.com>
Approved-by: Michael Kozono <mkozono@gitlab.com>
Approved-by: Nick Westbury <nwestbury@gitlab.com>
Co-authored-by: Ian Baum <ibaum@gitlab.com>

Merge branch '498768-graphql-subscriptions-ignore-unauthorized-error' into 'master'

See merge request !174581



Merged-by: John Skarbek <jskarbek@gitlab.com>
Approved-by: Heinrich Lee Yu <heinrich@gitlab.com>
Co-authored-by: Bob Van Landuyt <bob@gitlab.com>

Ignore unauthorized subscription errors in SLIs

See merge request !173506



Merged-by: Bob Van Landuyt <bob@gitlab.com>
Approved-by: Bob Van Landuyt <bob@gitlab.com>
Reviewed-by: Bob Van Landuyt <bob@gitlab.com>
Reviewed-by: Heinrich Lee Yu <heinrich@gitlab.com>
Co-authored-by: Heinrich Lee Yu <heinrich@gitlab.com>

Backport 'always-build-qa-image-for-release-environments' to 17.5

See merge request !174255



Merged-by: Dat Tang <dattang@gitlab.com>
Approved-by: Mayra Cabrera <mcabrera@gitlab.com>

Always build QA image for release-environments

See merge request !174120



Merged-by: Dat Tang <dattang@gitlab.com>
Approved-by: Kev Kloss <kkloss@gitlab.com>
Approved-by: Jenny Kim <yjeankim@gitlab.com>


(cherry picked from commit bdcf9d11)

e594d653 Always build QA image for release-environments

Co-authored-by: Dat Tang <dattang@gitlab.com>

Fix 401 errors when installing the GitLab for Jira app

See merge request !173196



Merged-by: Dat Tang <dattang@gitlab.com>
Approved-by: James Nutt <jnutt@gitlab.com>
Approved-by: Nivetha Prabakaran <nprabakaran@gitlab.com>
Co-authored-by: Andy Schoenen <asoiron@gitlab.com>

[merge-train skip]

[ci skip]

[ci skip]

Add size check for harbor registry

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4599



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Dzmitry (Dima) Meshcharakou <12459192-dmeshcharakou@users.noreply.gitlab.com>
Co-authored-by: Adie Po <avpfestin@gitlab.com>

Adie (she/her) authored 3 months ago and GitLab Release Tools Bot committed 3 months ago

Merge branch 'security-add-size-check-on-harbor-registry-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4599

Changelog: security

Adding JobArtifactReport class to pre-emptively validate job artifacts

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4568



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Hordur Freyr Yngvason <hfyngvason@gitlab.com>
Co-authored-by: Max Fan <mfan@gitlab.com>

Max Fan authored 3 months ago and GitLab Release Tools Bot committed 3 months ago

Merge branch 'security-443559-validate-test-reports-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4568

Changelog: security

Fix: unsubscribe from actioncable channel when PAT is revoked

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4550



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Alejandro Rodríguez <alejandro@gitlab.com>
Co-authored-by: Jeff Park <jpark@gitlab.com>

Jeff Park authored 3 months ago and GitLab Release Tools Bot committed 3 months ago

Merge branch 'security-456922-confidential-issue-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4550

Changelog: security

Allow a LFS token to be used only for LFS related requests

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4582



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Joe Woodward <jwoodward@gitlab.com>
Co-authored-by: Emma Park <epark@gitlab.com>

Emma Park authored 3 months ago and GitLab Release Tools Bot committed 3 months ago

Merge branch 'security-1194/misuse-token-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4582

Changelog: security

Fix possible DOS with TOML file parsing

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4590



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Javiera Tapia <jtapia@gitlab.com>
Co-authored-by: Olaoluwa Oluro <olaoluro@gitlab.com>

Olaoluwa Oluro authored 3 months ago and GitLab Release Tools Bot committed 3 months ago

Merge branch 'security-possible-dos-for-toml-file-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4590

Changelog: security

Move allow_access_with_scope to class level

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4611



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Stan Hu <stanhu@gmail.com>
Co-authored-by: Halil Coban <hcoban@gitlab.com>

Halil Coban authored 3 months ago and GitLab Release Tools Bot committed 3 months ago

Merge branch 'security-token-within-ns-17-5' into '17-5-stable-ee'

See merge request gitlab-org/security/gitlab!4611

Changelog: security

Cherry-pick 'jennli-patch-compile-prod-assets-rules' into 17-5-stable-ee

See merge request !173594



Merged-by: Mayra Cabrera <mcabrera@gitlab.com>
Approved-by: Mayra Cabrera <mcabrera@gitlab.com>
Co-authored-by: Jennifer Li <jli@gitlab.com>

Update compile-production-assets rules

See merge request !173476



Merged-by: Mark Lapierre <mlapierre@gitlab.com>
Approved-by: Dan Davison <ddavison@gitlab.com>
Co-authored-by: Jennifer Li <jli@gitlab.com>

(cherry picked from commit d512be4d)

ff186dd6 Ensure compile-production-assets and build-assets-image match
8b1a5f35 Add test case to verify security stable branch

Co-authored-by: Mark Lapierre <mlapierre@gitlab.com>

Make assertion order independent

See merge request !173185



Merged-by: Mayra Cabrera <mcabrera@gitlab.com>
Approved-by: Mayra Cabrera <mcabrera@gitlab.com>
Co-authored-by: Jennifer Li <jli@gitlab.com>

Andy Schoenen authored 3 months ago and Luke Duncalfe committed 3 months ago

We assumed that the key ID to fetch public keys from the
Atlassian CDN must be a UUID but the pattern seem to have
changed. This MR changes the validation to allow strings
other than valid UUIDs.

Changelog: fixed