Skip to content

Critical Security Alert - Latest stable patch text

What does this MR do and why?

Closes #438447 (closed)
Implements API changes in gitlab-org/gitlab-services/version.gitlab.com!76 (merged)

When a customer is more than 3 minor versions behind the latest release and a critical vulnerability is patched and back-ported the alert modal only shows the latest 3 minor versions. This can cause the customer to believe they need to do a minor upgrade when there is also a less intrusive patch available on their current minor version. This confusion can cause a customer to stay in a vulnerable state longer than they need to be.

With the new data exposed by gitlab-org/gitlab-services/version.gitlab.com!76 (merged) we can expose this information to the customer when there is a 4th option for them to upgrade. This will conditionally show in the alert modal if the 4th option isn't included int he initial 3 latest minor versions.

Screenshots or screen recordings

Before After
Customer is 4 versions behind and a patch is available (main concern) 4_versions_back_-_Before Screenshot_2024-01-25_at_2.23.17_PM
Customer is 3 versions behind and a patch is available (no change) 3_versions_back_-_Before 3_versions_back_-_After
Customer is 4 versions behind but a patch is not available (no change) 4_versions_no_stable_-_Before 4_versions_no_stable_-_After

How to set up and validate locally

Important: You will need to provide "spoofs" to make your GDK think its behind a version. Below are patches to achieve each type of scenario.
Important: You need to reset any changes between adding different patches.

Customer is 4 versions behind and a patch is available
diff --git a/app/helpers/version_check_helper.rb b/app/helpers/version_check_helper.rb
index 895155e00d1..328cd028d78 100644
--- a/app/helpers/version_check_helper.rb
+++ b/app/helpers/version_check_helper.rb
@@ -12,7 +12,8 @@ def show_version_check?
   def gitlab_version_check
     return unless show_version_check?
 
-    VersionCheck.new.response
+    #VersionCheck.new.response
+    { "severity" => 'danger', "critical_vulnerability" => true, "details" => 'There is a runner token vulnerability on this version. Please upgrade to prevent an attacker executing code on your instance', "latest_stable_versions" => ['16.12.3', '16.11.5', '16.10.7'], "latest_stable_version_of_minor" => '16.9.2' }
   end
   strong_memoize_attr :gitlab_version_check
Customer is 3 versions behind and a patch is available
diff --git a/app/helpers/version_check_helper.rb b/app/helpers/version_check_helper.rb
index 895155e00d1..ad79386ab4a 100644
--- a/app/helpers/version_check_helper.rb
+++ b/app/helpers/version_check_helper.rb
@@ -12,7 +12,8 @@ def show_version_check?
   def gitlab_version_check
     return unless show_version_check?
 
-    VersionCheck.new.response
+    #VersionCheck.new.response
+    { "severity" => 'danger', "critical_vulnerability" => true, "details" => 'There is a runner token vulnerability on this version. Please upgrade to prevent an attacker executing code on your instance', "latest_stable_versions" => ['16.11.3', '16.10.5', '16.9.2'], "latest_stable_version_of_minor" => '16.9.2' }
   end
   strong_memoize_attr :gitlab_version_check
Customer is 4 versions behind but a patch is not available
diff --git a/app/helpers/version_check_helper.rb b/app/helpers/version_check_helper.rb
index 895155e00d1..b14070e8fc0 100644
--- a/app/helpers/version_check_helper.rb
+++ b/app/helpers/version_check_helper.rb
@@ -12,7 +12,8 @@ def show_version_check?
   def gitlab_version_check
     return unless show_version_check?
 
-    VersionCheck.new.response
+    #VersionCheck.new.response
+    { "severity" => 'danger', "critical_vulnerability" => true, "details" => 'There is a runner token vulnerability on this version. Please upgrade to prevent an attacker executing code on your instance', "latest_stable_versions" => ['16.12.3', '16.11.5', '16.10.7'], "latest_stable_version_of_minor" => nil }
   end
   strong_memoize_attr :gitlab_version_check
  1. Login as an Admin (root is admin by default)
  2. Apply your selected patch
  3. Refresh any page
  4. Ensure alert modal appears and matches what is expected in the Before/After screenshots

Related to #438447 (closed)

Edited by Zack Cuddy

Merge request reports