[merge-train skip]

[ci skip]

[ci skip]

Prevent leaking emails of newly created users

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3451



Merged-by: Reuben Pereira <2967854-rpereira2@users.noreply.gitlab.com>
Approved-by: Sashi Kumar Kumaresan <skumar@gitlab.com>
Co-authored-by: Bogdan Denkovych <bdenkovych@gitlab.com>

Merge branch 'security-prevent-leaking-emails-of-newly-created-users-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3451

Changelog: security

Added redirect to filtered params

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3443



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Jessie Young <jessieyoung@gitlab.com>
Co-authored-by: smriti <sgarg@gitlab.com>

Smriti Garg authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-906-glpat-logging-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3443

Changelog: security

Relocate PlantUML config and disable SVG support

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3440



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: John Mason <9717668-johnmason@users.noreply.gitlab.com>
Co-authored-by: Robert May <rmay@gitlab.com>

Robert May authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-416902-config-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3440

Changelog: security

Sanitize multiple hardlinks from import archives

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3437



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: George Koltsov <gkoltsov@gitlab.com>
Co-authored-by: Luke Duncalfe <lduncalfe@eml.cc>

Luke Duncalfe authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-hardlinks-in-import-archives-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3437

Changelog: security

Validates project path availability

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3428



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Co-authored-by: Kassio Borges <kassioborgesm@gmail.com>

Kassio Borges authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-validate-project-path-availability-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3428

Changelog: security

Fix policy project assign

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3425



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Huzaifa Iftikhar <hiftikhar@gitlab.com>
Co-authored-by: mc_rocha <mrocha@gitlab.com>

Marcos Rocha authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-fix-policy-project-assign-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3425

Changelog: security

Merge branch 'security-407166-fix-protected-branch-for-pipeline-schedule-16.0' into '16-0-stable-ee'

Fix pipeline schedule authorization for protected branch/tag

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3363



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Co-authored-by: Tianwen Chen <tchen@gitlab.com>

Tianwen Chen authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-407166-fix-protected-branch-for-pipeline-schedule-16.0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3363

Changelog: security

Mitigate autolink filter ReDOS

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3432



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: charlie ablett <cablett@gitlab.com>
Approved-by: Bala Kumar <sbalakumar@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Brett Walker authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-untrusted-autolink-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3432

Changelog: security

Fix XSS vector in Web IDE

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3411



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Enrique Alcántara <ealcantara@gitlab.com>
Co-authored-by: Paul Slaughter <pslaughter@gitlab.com>

Paul Slaughter authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-ps-fix-web-ide-xss-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3411

Changelog: security

Mitigate project reference filter ReDOS

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3429



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: charlie ablett <cablett@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Brett Walker authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-project-reference-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3429

Changelog: security

Add a stricter regex for the Harbor search param

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3396



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Heinrich Lee Yu <heinrich@gitlab.com>
Co-authored-by: Adie Po <avpfestin@gitlab.com>

Adie Po authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-add-untrusted-regexp-to-harbor-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3396

Changelog: security

Update pipeline user to the last policy MR author

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3393



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Ahmed Hemdan <ahemdan@gitlab.com>
Co-authored-by: mc_rocha <mrocha@gitlab.com>

Marcos Rocha authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-fix-user-pipeline-job-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3393

Changelog: security

Prohibit 40 character hex plus a hyphen if branch name is path

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3406



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Allen Cook <acook@gitlab.com>
Co-authored-by: ghinfeydesktop <ghinfey@gitlabdesktop.com>

Gavin Hinfey authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-416252-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3406

Changelog: security

Disable IAT verification by default

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/127518



Merged-by: Steve Abrams <sabrams@gitlab.com>
Approved-by: Drew Blessing <drew@gitlab.com>
Approved-by: Steve Abrams <sabrams@gitlab.com>
Co-authored-by: Stan Hu <stanhu@gmail.com>

https://gitlab.com/gitlab-org/gitlab/-/merge_requests/117468 in GitLab
15.11 updated the ruby-jwt gem to v2.5.0. In v2.2.0, ruby-jwt removed
the `iat_leeway` parameter (https://github.com/jwt/ruby-jwt/pull/274).

As a result, if a gitlab-shell host creates a JWT token with an
issued-at (IAT) claim that is slightly behind the host handling API
the request, users will receive a 401 error.

Disable this IAT verification by default since it's not serving a
useful purpose, since expiration times are already validated. We
already made a similar change in Geo.

Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/417543

Changelog: fixed

[merge-train skip]

[ci skip]

[ci skip]

Add authorization to the subscriptions group controller

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3380



Merged-by: Mayra Cabrera <mcabrera@gitlab.com>
Approved-by: Doug Stull <dstull@gitlab.com>
Approved-by: Thong Kuah <tkuah@gitlab.com>
Co-authored-by: Doug Stull <dstull@gitlab.com>

Ryan Cobb authored 1 year ago and Mayra Cabrera committed 1 year ago

Merge branch 'security-416797-fix-auth-issue-16-0' into '16-0-stable-ee'

See merge request gitlab-org/security/gitlab!3380

Changelog: security

[merge-train skip]

[ci skip]