[merge-train skip]

[ci skip]

[ci skip]

Implement input sanitization for SummarizeComments

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4412



Merged-by: Mayra Cabrera <mcabrera@gitlab.com>
Approved-by: Ethan Urie <eurie@gitlab.com>
Approved-by: Mayra Cabrera <mcabrera@gitlab.com>
Co-authored-by: dillonwheeler <dwheeler@gitlab.com>

Dillon Wheeler authored 5 months ago and Mayra Cabrera committed 5 months ago

Merge branch 'security-duo-chat-issue-summary-prompt-injection-1-17-2' into '17-2-stable-ee'

See merge request gitlab-org/security/gitlab!4412

Changelog: security

Hide system notes with invalid references

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4484



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Bob Van Landuyt <bob@gitlab.com>
Co-authored-by: Heinrich Lee Yu <heinrich@gitlab.com>

Heinrich Lee Yu authored 5 months ago and GitLab Release Tools Bot committed 5 months ago

Merge branch 'security-hide-system-notes-with-invalid-references-17-2' into '17-2-stable-ee'

See merge request gitlab-org/security/gitlab!4484

Changelog: security

Reset dependency proxy maven credentials when registry url is changed

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4459



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Dzmitry (Dima) Meshcharakou <12459192-dmeshcharakou@users.noreply.gitlab.com>
Co-authored-by: Radamanthus Batnag <rbatnag@gitlab.com>

Rad Batnag authored 5 months ago and GitLab Release Tools Bot committed 5 months ago

Merge branch 'security-1180-fix-dependency-proxy-leak-17-2' into '17-2-stable-ee'

See merge request gitlab-org/security/gitlab!4459

Changelog: security

Update OpenSSL v3 callout to delay update to GitLab 17.7

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/166935



Merged-by: Stan Hu <stanhu@gmail.com>
Approved-by: Ash McKenzie <amckenzie@gitlab.com>

This gives users more time to prepare for the upgrade.

[merge-train skip]

Improve OpenSSL callout message

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/166183



Merged-by: Stan Hu <stanhu@gmail.com>
Approved-by: Drew Blessing <drew@gitlab.com>
Co-authored-by: Drew Blessing <drew@gitlab.com>

The previous message made it sound like everything needed to use
OpenSSL 3. Revise this message to make it clear that TLS 1.2+
is needed for TLS connections, and ensure that we mention ciphers
and bits of encryption.

[merge-train skip]

[ci skip]

[ci skip]

[merge-train skip]

[ci skip]

[ci skip]

Bump ruby dependencies

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/166043



Merged-by: Ahmad Tolba <atolba@gitlab.com>
Approved-by: Aboobacker MK <akarakath@gitlab.com>
Approved-by: Jim Baumgardner <jbaumgardner@gitlab.com>
Approved-by: Mayra Cabrera <mcabrera@gitlab.com>
Co-authored-by: Drew Blessing <drew@gitlab.com>

[merge-train skip]

[ci skip]

[ci skip]

Revert "Merge branch 'security-psk-fix-external-wiki-integration-dos-17-2' into '17-2-stable-ee'"

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4454



Merged-by: Mayra Cabrera <mcabrera@gitlab.com>
Approved-by: Mayra Cabrera <mcabrera@gitlab.com>
Co-authored-by: John T Skarbek <jtslear@gmail.com>

Ameya Darshan authored 5 months ago and Mayra Cabrera committed 5 months ago

Merge branch 'revert-7bad7451' into '17-2-stable-ee'

See merge request gitlab-org/security/gitlab!4454

Changelog: security

Improve OpenSSL 3 upgrading warning notes

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/165587



Merged-by: Stan Hu <stanhu@gmail.com>
Approved-by: Eduardo Sanz García <esanz-garcia@gitlab.com>

Fix the vulnerability in the glm_source parameter

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4435



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Gabriel Mazetto <gabriel@gitlab.com>
Co-authored-by: Doug Stull <dstull@gitlab.com>

Doug Stull authored 5 months ago and GitLab Release Tools Bot committed 5 months ago

Merge branch 'cherry-pick-98bf5baa-2' into '17-2-stable-ee'

See merge request gitlab-org/security/gitlab!4435

Changelog: security

Improve GraphQL log security

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4349



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Greg Myers <gmyers@gitlab.com>
Approved-by: Dzmitry (Dima) Meshcharakou <12459192-dmeshcharakou@users.noreply.gitlab.com>
Reviewed-by: Dzmitry (Dima) Meshcharakou <12459192-dmeshcharakou@users.noreply.gitlab.com>
Co-authored-by: Radamanthus Batnag <rbatnag@gitlab.com>

Rad Batnag authored 5 months ago and GitLab Release Tools Bot committed 5 months ago

Merge branch 'security-460289-confidential-issue-17-2' into '17-2-stable-ee'

See merge request gitlab-org/security/gitlab!4349

Changelog: security

Add permissions check to project creations from a project template

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4444



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Gavin Hinfey <ghinfey@gitlab.com>
Co-authored-by: Fred Reinink <freinink@gitlab.com>

Fred Reinink authored 5 months ago and GitLab Release Tools Bot committed 5 months ago

Merge branch 'security-custom-templates-source-code-disclosure-17-2' into '17-2-stable-ee'

See merge request gitlab-org/security/gitlab!4444

Changelog: security

Fix credentials disclosure in mirroring failure

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4447



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Co-authored-by: Olaoluwa Oluro <olaoluro@gitlab.com>

Ola Oluro authored 5 months ago and GitLab Release Tools Bot committed 5 months ago

Merge branch 'security-scp-url-sanitizer-17-2' into '17-2-stable-ee'

See merge request gitlab-org/security/gitlab!4447

Changelog: security

Redirect url in the link validated for being external

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4441



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Drew Blessing <drew@gitlab.com>
Co-authored-by: smriti <sgarg@gitlab.com>

Smriti Garg authored 5 months ago and GitLab Release Tools Bot committed 5 months ago

Merge branch 'security-sg-redirect-check-for-releases-17-2' into '17-2-stable-ee'

See merge request gitlab-org/security/gitlab!4441

Changelog: security