diff options
| author | GitLab Bot <gitlab-bot@gitlab.com> | 2021-03-04 14:14:20 +0000 |
|---|---|---|
| committer | GitLab Bot <gitlab-bot@gitlab.com> | 2021-03-04 14:14:20 +0000 |
| commit | 7dfe769bfc88aba93ae3029f6d388f1068a41dbd (patch) | |
| tree | da555d6f15388406669c2a49ee19cfae4ff12e47 | |
| parent | 86d7929e05f92f75aed484de94ff74c0f1af7e67 (diff) | |
| download | gitlab-ce-13.7.8.tar.gz | |
Add latest changes from gitlab-org/security/gitlab@13-7-stable-eev13.7.8
| -rw-r--r-- | CHANGELOG.md | 11 | ||||
| -rw-r--r-- | GITALY_SERVER_VERSION | 2 | ||||
| -rw-r--r-- | changelogs/unreleased/security-bvl-update-thrift-gem.yml | 5 | ||||
| -rw-r--r-- | changelogs/unreleased/security-ci-api-variables-permissions.yml | 5 | ||||
| -rw-r--r-- | changelogs/unreleased/security-clean-up-active-sessions.yml | 5 | ||||
| -rw-r--r-- | changelogs/unreleased/security-jv-workhorse-router-13-7.yml | 5 | ||||
| -rw-r--r-- | changelogs/unreleased/security-upgrade-swagger-ui.yml | 5 |
7 files changed, 12 insertions, 26 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 9b5728c53a8..5de844c88a6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,17 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 13.7.8 (2021-03-04) + +### Security (5 changes) + +- Bump thrift gem to 0.14.0. +- Allow only owners to manage group variables. +- Do not store marshalled sessions ids in Redis. +- Workhorse: prevent escaped router path traversal. +- Fix XSS vulnerability for swagger file viewer. + + ## 13.7.7 (2021-02-11) ### Security (9 changes) diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION index 097a182f11e..9255caa9bd7 100644 --- a/GITALY_SERVER_VERSION +++ b/GITALY_SERVER_VERSION @@ -1 +1 @@ -13.7.7
\ No newline at end of file +13.7.8
\ No newline at end of file diff --git a/changelogs/unreleased/security-bvl-update-thrift-gem.yml b/changelogs/unreleased/security-bvl-update-thrift-gem.yml deleted file mode 100644 index afe1a0332e3..00000000000 --- a/changelogs/unreleased/security-bvl-update-thrift-gem.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Bump thrift gem to 0.14.0 -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-ci-api-variables-permissions.yml b/changelogs/unreleased/security-ci-api-variables-permissions.yml deleted file mode 100644 index 05642a0ff57..00000000000 --- a/changelogs/unreleased/security-ci-api-variables-permissions.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Allow only owners to manage group variables -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-clean-up-active-sessions.yml b/changelogs/unreleased/security-clean-up-active-sessions.yml deleted file mode 100644 index 49d24584ddb..00000000000 --- a/changelogs/unreleased/security-clean-up-active-sessions.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Do not store marshalled sessions ids in Redis -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-jv-workhorse-router-13-7.yml b/changelogs/unreleased/security-jv-workhorse-router-13-7.yml deleted file mode 100644 index af17a71086d..00000000000 --- a/changelogs/unreleased/security-jv-workhorse-router-13-7.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: 'Workhorse: prevent escaped router path traversal' -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-upgrade-swagger-ui.yml b/changelogs/unreleased/security-upgrade-swagger-ui.yml deleted file mode 100644 index 280dd92e23e..00000000000 --- a/changelogs/unreleased/security-upgrade-swagger-ui.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Fix XSS vulnerability for swagger file viewer -merge_request: -author: -type: security |