[ci skip]

Mattermost Security Updates April 27, 2023

See merge request https://gitlab.com/gitlab-org/security/omnibus-gitlab/-/merge_requests/338



Merged-by: Jenny Kim <yjeankim@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Clemens Beck <cbeck@gitlab.com>

Clemens Beck authored 1 year ago and Jenny Kim committed 1 year ago

Merge branch 'security-mattermost-2023-04-27-updates-15-10' into '15-10-stable'

See merge request gitlab-org/security/omnibus-gitlab!338

Changelog: security

Bump PostgreSQL version to 12.14 and 13.11

See merge request https://gitlab.com/gitlab-org/security/omnibus-gitlab/-/merge_requests/346



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Co-authored-by: Hossein Pursultani <hpursultani@gitlab.com>

Hossein Pursultani authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-postgresql-upgrade-12.14-and-13.11-backport-15-10' into '15-10-stable'

See merge request gitlab-org/security/omnibus-gitlab!346

Changelog: security

Bump ncurses version to 6.4-20230225

See merge request https://gitlab.com/gitlab-org/security/omnibus-gitlab/-/merge_requests/342



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Co-authored-by: Clemens Beck <cbeck@gitlab.com>

Clemens Beck authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-bump-ncurses-cve-2023-29491-15-10' into '15-10-stable'

See merge request gitlab-org/security/omnibus-gitlab!342

Changelog: security

[15.10] Validate that SMTP settings do not enable both TLS and STARTTLS

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6877



Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Co-authored-by: Stan Hu <stanhu@gmail.com>

[15.10] Add SMTP timeout configuration options

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6887



Merged-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Approved-by: Balasankar 'Balu' C <balasankar@gitlab.com>
Co-authored-by: Stan Hu <stanhu@gmail.com>

In https://github.com/mikel/mail/pull/1427/files, mail v2.8.1 gem
modified the default open and read timeout values to 5 seconds instead
of the default `Net::SMTP` 30 and 60 seconds, respectively.

Since upgrading to GitLab 15.10.3, some users have observed receiving
`Net::ReadTimeout` errors. This commit restores the original defaults
and allows users to configure the timeouts.

Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/410336

Changelog: added

GitLab versions 15.10.4 and up shipped with
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/116925 in order
to fix a Ruby 3 upgrade issue that made it impossible to disable
STARTTLS if the SMTP server advertised support for it.

However, this change enforced the constraint that both SMTP TLS and
STARTTLS cannot be enabled simultaneously. This follows the behavior
of the net-smtp gem, which raises an exception if a user attempts to
enable both.

This constraint was added because as described in
https://github.com/mikel/mail/pull/1536, the logic for
enabling/disabling TLS and/or STARTTLS is a bit tricky to get right
and missed some important edge cases.

This commit adds a validation step that will throw an error if both
settings appear:

```ruby
gitlab_rails['smtp_tls'] = true
gitlab_rails['smtp_enable_starttls_auto'] = true
```

Previously if SMTP TLS were enabled, STARTTLS was disabled outright.

If `gitlab_rails['smtp_tls']` is enabled, generally the easiest way to
get things working is to set
`gitlab_rails['smtp_enable_starttls_auto']` to `false`.

Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/409835

Also see https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6858

Changelog: changed

[ci skip]

[ci skip]

Bundle libarchive in the package

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6824



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>

Bundle libarchive in the package

Closes #7741

Changelog: fixed

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/6805



Merged-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Approved-by: Andrew Patterson <apatterson@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

[ci skip]

Mattermost Security Updates April 2023

See merge request https://gitlab.com/gitlab-org/security/omnibus-gitlab/-/merge_requests/335



Merged-by: Reuben Pereira <2967854-rpereira2@users.noreply.gitlab.com>
Approved-by: Kevin Morrison <kmorrison@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Andrew Patterson <apatterson@gitlab.com>

Merge branch 'security-mattermost-2023-04-updates-15.10' into '15-10-stable'

See merge request gitlab-org/security/omnibus-gitlab!335

Changelog: security

Patch Openssl for CVE-2023-0464

See merge request https://gitlab.com/gitlab-org/security/omnibus-gitlab/-/merge_requests/332



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: João Cunha <j.a.cunha@gmail.com>

João Alexandre Cunha authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-patch-openssl-for-2023-0464-backport-15-10' into '15-10-stable'

See merge request gitlab-org/security/omnibus-gitlab!332

Changelog: security

Patch Grafana against session cookie vulnerability and CVE-2023-1410

See merge request https://gitlab.com/gitlab-org/security/omnibus-gitlab/-/merge_requests/327



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Robert Marshall <rmarshall@gitlab.com>
Co-authored-by: Balasankar "Balu" C <balasankar@gitlab.com>

Balasankar C authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-grafana-session-cookie-outgoing-request-15-10' into '15-10-stable'

See merge request gitlab-org/security/omnibus-gitlab!327

Changelog: security

[ci skip]