Upgrading to GitLab 19.3.6 on October 22 didn’t fix the vulnerability. The fix isn’t in GitLab’s own code but in a patch to Ruby, which GitLab applies only in its official packages. Our image used standard Ruby, so it didn’t get the patch.
I guess this is a risk of repackaging things that I hadn't really considered prior...the vagueness of the CVE releases didn't really help, either (I get why they do that, but still, it wasn't clear where the problem actually was).
It's exacerbated further by the fact that the patches to ruby didn't land until two days after Gitlab announced the CVE.
But yes, if we had been using Gitlab's official images then we'd have gotten the fix regardless of where it was in the stack. It isn't Gitlab's or Ruby's fault though, just really unfortunate timing rather.
I'm impressed! The Alpine project absolutely did the right thing here. I don't know many organizations which would go this far to ensure their setup was secure. Most would probably just call it "failed exploit attempt", maybe run a few rootkit scans and keep running the (possibly compromised) server.
Huh, I didn't know there was a critical release on October 16th. The October 21 release made way more noise (as people were obviously more on edge at the time).
refi64 | 9 hours ago
I guess this is a risk of repackaging things that I hadn't really considered prior...the vagueness of the CVE releases didn't really help, either (I get why they do that, but still, it wasn't clear where the problem actually was).
[OP] durrendal | 7 hours ago
It's exacerbated further by the fact that the patches to ruby didn't land until two days after Gitlab announced the CVE.
But yes, if we had been using Gitlab's official images then we'd have gotten the fix regardless of where it was in the stack. It isn't Gitlab's or Ruby's fault though, just really unfortunate timing rather.
sjamaan | 23 minutes ago
I'm impressed! The Alpine project absolutely did the right thing here. I don't know many organizations which would go this far to ensure their setup was secure. Most would probably just call it "failed exploit attempt", maybe run a few rootkit scans and keep running the (possibly compromised) server.
kiwec | 24 minutes ago
Huh, I didn't know there was a critical release on October 16th. The October 21 release made way more noise (as people were obviously more on edge at the time).