From 189a15a911843a9059d1f8bfd31008557bea520b Mon Sep 17 00:00:00 2001 From: GitLab Bot Date: Thu, 4 Mar 2021 13:43:08 +0000 Subject: Add latest changes from gitlab-org/security/gitlab@13-9-stable-ee --- CHANGELOG.md | 12 ++++++++++++ GITALY_SERVER_VERSION | 2 +- changelogs/unreleased/security-bvl-update-thrift-gem.yml | 5 ----- .../unreleased/security-ci-api-variables-permissions.yml | 5 ----- changelogs/unreleased/security-clean-up-active-sessions.yml | 5 ----- changelogs/unreleased/security-fj-fix-xss-wiki-email.yml | 5 ----- changelogs/unreleased/security-jv-workhorse-router-13-9.yml | 5 ----- changelogs/unreleased/security-upgrade-swagger-ui.yml | 5 ----- 8 files changed, 13 insertions(+), 31 deletions(-) delete mode 100644 changelogs/unreleased/security-bvl-update-thrift-gem.yml delete mode 100644 changelogs/unreleased/security-ci-api-variables-permissions.yml delete mode 100644 changelogs/unreleased/security-clean-up-active-sessions.yml delete mode 100644 changelogs/unreleased/security-fj-fix-xss-wiki-email.yml delete mode 100644 changelogs/unreleased/security-jv-workhorse-router-13-9.yml delete mode 100644 changelogs/unreleased/security-upgrade-swagger-ui.yml diff --git a/CHANGELOG.md b/CHANGELOG.md index 1bd602f975d..b5a038d9106 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,18 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 13.9.2 (2021-03-04) + +### Security (6 changes) + +- Bump thrift gem to 0.14.0. +- Allow only owners to manage group variables. +- Do not store marshalled sessions ids in Redis. +- Fix XSS in wiki author email and name. +- Workhorse: prevent escaped router path traversal. +- Fix XSS vulnerability for swagger file viewer. + + ## 13.9.1 (2021-02-23) ### Fixed (6 changes, 1 of them is from the community) diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION index f8b8809d011..8b723ee01f4 100644 --- a/GITALY_SERVER_VERSION +++ b/GITALY_SERVER_VERSION @@ -1 +1 @@ -13.9.1 \ No newline at end of file +13.9.2 \ No newline at end of file diff --git a/changelogs/unreleased/security-bvl-update-thrift-gem.yml b/changelogs/unreleased/security-bvl-update-thrift-gem.yml deleted file mode 100644 index afe1a0332e3..00000000000 --- a/changelogs/unreleased/security-bvl-update-thrift-gem.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Bump thrift gem to 0.14.0 -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-ci-api-variables-permissions.yml b/changelogs/unreleased/security-ci-api-variables-permissions.yml deleted file mode 100644 index 05642a0ff57..00000000000 --- a/changelogs/unreleased/security-ci-api-variables-permissions.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Allow only owners to manage group variables -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-clean-up-active-sessions.yml b/changelogs/unreleased/security-clean-up-active-sessions.yml deleted file mode 100644 index 49d24584ddb..00000000000 --- a/changelogs/unreleased/security-clean-up-active-sessions.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Do not store marshalled sessions ids in Redis -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-fj-fix-xss-wiki-email.yml b/changelogs/unreleased/security-fj-fix-xss-wiki-email.yml deleted file mode 100644 index 9faabdc9750..00000000000 --- a/changelogs/unreleased/security-fj-fix-xss-wiki-email.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Fix XSS in wiki author email and name -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-jv-workhorse-router-13-9.yml b/changelogs/unreleased/security-jv-workhorse-router-13-9.yml deleted file mode 100644 index af17a71086d..00000000000 --- a/changelogs/unreleased/security-jv-workhorse-router-13-9.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: 'Workhorse: prevent escaped router path traversal' -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-upgrade-swagger-ui.yml b/changelogs/unreleased/security-upgrade-swagger-ui.yml deleted file mode 100644 index 280dd92e23e..00000000000 --- a/changelogs/unreleased/security-upgrade-swagger-ui.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Fix XSS vulnerability for swagger file viewer -merge_request: -author: -type: security -- cgit v1.2.1