GitLab Security Release: 16.4.1, 16.3.5, and 16.2.8

{
  "id": "bccf9917bf35f3a708c7bf95c93b1c1ce91628d022e4c674e0b50938060d4cb7",
  "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-16-4-1-released/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "GitLab Security Release: 16.4.1, 16.3.5, and 16.2.8",
    "summary": "GitLab released security patches for CE and EE in versions 16.4.1, 16.3.5, and 16.2.8, and recommends upgrading affected installations. The announcement also describes security updates to Exiftool, Mattermost, and Auto deploy image.",
    "evidence": "On September 28, 2023, we released versions 16.4.1, 16.3.5, and 16.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important security fixes",
    "products": [
      {
        "name": {
          "value": "GitLab Community Edition (CE)",
          "evidence": "for GitLab Community Edition (CE) and Enterprise Edition (EE)"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "16.2.8",
            "evidence": "released versions 16.4.1, 16.3.5, and 16.2.8"
          },
          {
            "value": "16.3.5",
            "evidence": "released versions 16.4.1, 16.3.5, and 16.2.8"
          },
          {
            "value": "16.4.1",
            "evidence": "released versions 16.4.1, 16.3.5, and 16.2.8"
          }
        ],
        "affected_versions": [
          {
            "value": "all versions starting 16.0 prior to 16.2.8",
            "evidence": "affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1"
          },
          {
            "value": "16.3 prior to 16.3.5",
            "evidence": "affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1"
          },
          {
            "value": "16.4 prior to 16.4.1",
            "evidence": "affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1"
          }
        ]
      },
      {
        "name": {
          "value": "Enterprise Edition (EE)",
          "evidence": "for GitLab Community Edition (CE) and Enterprise Edition (EE)"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "16.2.8",
            "evidence": "released versions 16.4.1, 16.3.5, and 16.2.8"
          },
          {
            "value": "16.3.5",
            "evidence": "released versions 16.4.1, 16.3.5, and 16.2.8"
          },
          {
            "value": "16.4.1",
            "evidence": "released versions 16.4.1, 16.3.5, and 16.2.8"
          }
        ],
        "affected_versions": [
          {
            "value": "all versions starting 16.0 prior to 16.2.8",
            "evidence": "affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1"
          },
          {
            "value": "16.3 prior to 16.3.5",
            "evidence": "affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1"
          },
          {
            "value": "16.4 prior to 16.4.1",
            "evidence": "affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1"
          }
        ]
      },
      {
        "name": {
          "value": "Consul",
          "evidence": "Patch in third party library Consul requires ’enable-script-checks’ to be set to False."
        },
        "prerequisites": [
          {
            "value": "’enable-script-checks’ to be set to False",
            "evidence": "Patch in third party library Consul requires ’enable-script-checks’ to be set to False."
          },
          {
            "value": "This only affects GitLab-EE.",
            "evidence": "This only affects GitLab-EE."
          }
        ],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Exiftool",
          "evidence": "Update Exiftool Exiftool has been updated to version 1.12 in order to mitigate security issues."
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "version 1.12",
            "evidence": "Exiftool has been updated to version 1.12 in order to mitigate security issues."
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Mattermost",
          "evidence": "Update Mattermost Mattermost has been updated to version 8.1.2 in order to mitigate security issues."
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "version 8.1.2",
            "evidence": "Mattermost has been updated to version 8.1.2 in order to mitigate security issues."
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Auto deploy image",
          "evidence": "Update Auto deploy image Auto deploy image has been updated to version 2.55.0 in order to mitigate security issues."
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "version 2.55.0",
            "evidence": "Auto deploy image has been updated to version 2.55.0 in order to mitigate security issues."
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2023-5207",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-5207."
      },
      {
        "value": "CVE-2023-5106",
        "evidence": "They are now mitigated in the latest release and are assigned CVE-2023-5106."
      },
      {
        "value": "CVE-2023-4379",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-4379."
      },
      {
        "value": "CVE-2023-3413",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-3413."
      },
      {
        "value": "CVE-2023-5332",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-5332."
      },
      {
        "value": "CVE-2023-3914",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-3914."
      },
      {
        "value": "CVE-2023-3115",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-3115."
      },
      {
        "value": "CVE-2023-5198",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-5198."
      },
      {
        "value": "CVE-2023-4532",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-4532."
      },
      {
        "value": "CVE-2023-3917",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-3917."
      },
      {
        "value": "CVE-2023-3920",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-3920."
      },
      {
        "value": "CVE-2023-0989",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-0989."
      },
      {
        "value": "CVE-2023-3906",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-3906."
      },
      {
        "value": "CVE-2023-4658",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-4658."
      },
      {
        "value": "CVE-2023-3979",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-3979."
      },
      {
        "value": "CVE-2023-2233",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-2233."
      },
      {
        "value": "CVE-2023-3922",
        "evidence": "It is now mitigated in the latest release and is assigned CVE-2023-3922."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-gitlab-security-releases",
  "document_id": 23831,
  "published_at": "2023-09-28T00:00:00+00:00"
}