summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGitLab Bot <gitlab-bot@gitlab.com>2021-03-04 13:43:08 +0000
committerGitLab Bot <gitlab-bot@gitlab.com>2021-03-04 13:43:08 +0000
commit189a15a911843a9059d1f8bfd31008557bea520b (patch)
tree01b1c941fae4768b8803526e0799aa09a245f244
parent38a81ea60a5d6a185d5b0466908d07e98c527494 (diff)
downloadgitlab-ce-189a15a911843a9059d1f8bfd31008557bea520b.tar.gz
Add latest changes from gitlab-org/security/gitlab@13-9-stable-eev13.9.2
-rw-r--r--CHANGELOG.md12
-rw-r--r--GITALY_SERVER_VERSION2
-rw-r--r--changelogs/unreleased/security-bvl-update-thrift-gem.yml5
-rw-r--r--changelogs/unreleased/security-ci-api-variables-permissions.yml5
-rw-r--r--changelogs/unreleased/security-clean-up-active-sessions.yml5
-rw-r--r--changelogs/unreleased/security-fj-fix-xss-wiki-email.yml5
-rw-r--r--changelogs/unreleased/security-jv-workhorse-router-13-9.yml5
-rw-r--r--changelogs/unreleased/security-upgrade-swagger-ui.yml5
8 files changed, 13 insertions, 31 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1bd602f975d..b5a038d9106 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,18 @@
documentation](doc/development/changelog.md) for instructions on adding your own
entry.
+## 13.9.2 (2021-03-04)
+
+### Security (6 changes)
+
+- Bump thrift gem to 0.14.0.
+- Allow only owners to manage group variables.
+- Do not store marshalled sessions ids in Redis.
+- Fix XSS in wiki author email and name.
+- Workhorse: prevent escaped router path traversal.
+- Fix XSS vulnerability for swagger file viewer.
+
+
## 13.9.1 (2021-02-23)
### Fixed (6 changes, 1 of them is from the community)
diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index f8b8809d011..8b723ee01f4 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-13.9.1 \ No newline at end of file
+13.9.2 \ No newline at end of file
diff --git a/changelogs/unreleased/security-bvl-update-thrift-gem.yml b/changelogs/unreleased/security-bvl-update-thrift-gem.yml
deleted file mode 100644
index afe1a0332e3..00000000000
--- a/changelogs/unreleased/security-bvl-update-thrift-gem.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Bump thrift gem to 0.14.0
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/security-ci-api-variables-permissions.yml b/changelogs/unreleased/security-ci-api-variables-permissions.yml
deleted file mode 100644
index 05642a0ff57..00000000000
--- a/changelogs/unreleased/security-ci-api-variables-permissions.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Allow only owners to manage group variables
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/security-clean-up-active-sessions.yml b/changelogs/unreleased/security-clean-up-active-sessions.yml
deleted file mode 100644
index 49d24584ddb..00000000000
--- a/changelogs/unreleased/security-clean-up-active-sessions.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Do not store marshalled sessions ids in Redis
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/security-fj-fix-xss-wiki-email.yml b/changelogs/unreleased/security-fj-fix-xss-wiki-email.yml
deleted file mode 100644
index 9faabdc9750..00000000000
--- a/changelogs/unreleased/security-fj-fix-xss-wiki-email.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix XSS in wiki author email and name
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/security-jv-workhorse-router-13-9.yml b/changelogs/unreleased/security-jv-workhorse-router-13-9.yml
deleted file mode 100644
index af17a71086d..00000000000
--- a/changelogs/unreleased/security-jv-workhorse-router-13-9.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: 'Workhorse: prevent escaped router path traversal'
-merge_request:
-author:
-type: security
diff --git a/changelogs/unreleased/security-upgrade-swagger-ui.yml b/changelogs/unreleased/security-upgrade-swagger-ui.yml
deleted file mode 100644
index 280dd92e23e..00000000000
--- a/changelogs/unreleased/security-upgrade-swagger-ui.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Fix XSS vulnerability for swagger file viewer
-merge_request:
-author:
-type: security