GitLab Patch Release: 16.11.1, 16.10.4, 16.9.6

{
  "id": "3d59f8efecd0fa351bab4a760026259c2f45a90419c7278db19f64cfa229e5e9",
  "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-16-11-1-released/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "GitLab Patch Release: 16.11.1, 16.10.4, 16.9.6",
    "summary": "GitLab released CE and EE versions 16.11.1, 16.10.4, and 16.9.6 with security fixes. The release recommends upgrading affected installations.",
    "evidence": "On April 24, 2024, we released versions 16.11.1, 16.10.4, 16.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes",
    "products": [
      {
        "name": {
          "value": "GitLab Community Edition (CE) and Enterprise Edition (EE)",
          "evidence": "On April 24, 2024, we released versions 16.11.1, 16.10.4, 16.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE)."
        },
        "prerequisites": [
          {
            "value": "if Bitbucket is used as an OAuth 2.0 provider on GitLab",
            "evidence": "Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user’s Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab."
          }
        ],
        "fixed_versions": [
          {
            "value": "16.11.1",
            "evidence": "On April 24, 2024, we released versions 16.11.1, 16.10.4, 16.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE)."
          },
          {
            "value": "16.10.4",
            "evidence": "On April 24, 2024, we released versions 16.11.1, 16.10.4, 16.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE)."
          },
          {
            "value": "16.9.6",
            "evidence": "On April 24, 2024, we released versions 16.11.1, 16.10.4, 16.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE)."
          }
        ],
        "affected_versions": [
          {
            "value": "all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1",
            "evidence": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1."
          },
          {
            "value": "all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1",
            "evidence": "An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read."
          },
          {
            "value": "all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1",
            "evidence": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1."
          },
          {
            "value": "all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1",
            "evidence": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions."
          },
          {
            "value": "all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1",
            "evidence": "An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2024-4024",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2024-4024."
      },
      {
        "value": "CVE-2024-2434",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2024-2434."
      },
      {
        "value": "CVE-2024-2829",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2024-2829."
      },
      {
        "value": "CVE-2024-4006",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2024-4006."
      },
      {
        "value": "CVE-2024-1347",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2024-1347."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-gitlab-security-releases",
  "document_id": 23816,
  "published_at": "2024-04-24T00:00:00+00:00"
}