diff options
11 files changed, 16 insertions, 46 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 2a25a525e8b..1c118d23fad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,21 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 13.5.2 (2020-11-02) + +### Security (9 changes) + +- Add CSRF protection to runner pause and resume. !1021 +- Do not expose Terraform state record in API. +- Path traversal to RCE via LFS upload. +- Update container_repository_name_regex to prevent catastrophic backtracking. +- Validate nuget package names. +- Prevent private repo from being accessed via internal Kubernetes API. +- Validate each upload param key in multipart.rb. +- Fix XSS vulnerability for job build dependencies. +- Fix unauthorized user is able to access schedule pipeline variables and values. + + ## 13.5.1 (2020-10-22) ### Other (1 change) diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION index 9400e4c0ada..a7a4a53384c 100644 --- a/GITALY_SERVER_VERSION +++ b/GITALY_SERVER_VERSION @@ -1 +1 @@ -13.5.1
\ No newline at end of file +13.5.2
\ No newline at end of file diff --git a/changelogs/unreleased/security-10io-multipart-check-brackets-balance-in-param-names.yml b/changelogs/unreleased/security-10io-multipart-check-brackets-balance-in-param-names.yml deleted file mode 100644 index e0d1a4e535d..00000000000 --- a/changelogs/unreleased/security-10io-multipart-check-brackets-balance-in-param-names.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Validate each upload param key in multipart.rb -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-10io-validate-nuget-package-name.yml b/changelogs/unreleased/security-10io-validate-nuget-package-name.yml deleted file mode 100644 index aaf30711868..00000000000 --- a/changelogs/unreleased/security-10io-validate-nuget-package-name.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Validate nuget package names -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-255886.yml b/changelogs/unreleased/security-255886.yml deleted file mode 100644 index 8fe8da59444..00000000000 --- a/changelogs/unreleased/security-255886.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Path traversal to RCE via LFS upload -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-container-regex-backtrack.yml b/changelogs/unreleased/security-container-regex-backtrack.yml deleted file mode 100644 index c88fd526d47..00000000000 --- a/changelogs/unreleased/security-container-regex-backtrack.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Update container_repository_name_regex to prevent catastrophic backtracking -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-fix-terraform-state-exposed-object-storage-url.yml b/changelogs/unreleased/security-fix-terraform-state-exposed-object-storage-url.yml deleted file mode 100644 index 1e37aed6ca0..00000000000 --- a/changelogs/unreleased/security-fix-terraform-state-exposed-object-storage-url.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Do not expose Terraform state record in API -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-kubernetes-agent-internal-api.yml b/changelogs/unreleased/security-kubernetes-agent-internal-api.yml deleted file mode 100644 index 9ed192e90cc..00000000000 --- a/changelogs/unreleased/security-kubernetes-agent-internal-api.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Prevent private repo from being accessed via internal Kubernetes API -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-runner-csrf-milestone-13-6.yml b/changelogs/unreleased/security-runner-csrf-milestone-13-6.yml deleted file mode 100644 index 4b661ecfdc9..00000000000 --- a/changelogs/unreleased/security-runner-csrf-milestone-13-6.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Add CSRF protection to runner pause and resume -merge_request: 1021 -author: -type: security diff --git a/changelogs/unreleased/security-stored-xss-build-dependencies.yml b/changelogs/unreleased/security-stored-xss-build-dependencies.yml deleted file mode 100644 index a5ce2bd0158..00000000000 --- a/changelogs/unreleased/security-stored-xss-build-dependencies.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Fix XSS vulnerability for job build dependencies -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-unauthorized-access-schedule-variables-milestone-13-6.yml b/changelogs/unreleased/security-unauthorized-access-schedule-variables-milestone-13-6.yml deleted file mode 100644 index fc6702f8067..00000000000 --- a/changelogs/unreleased/security-unauthorized-access-schedule-variables-milestone-13-6.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Fix unauthorized user is able to access schedule pipeline variables and values -merge_request: -author: -type: security |