- Gitlab releases patch for nine deficiencies including two critical difficulty
- The critical deficiencies enabled threat actors to bypass approval and could lead to data filling
- Patch is available now, with Gitlab encourages users to apply it
Gitlab has patched nine vulnerabilities affecting its Community Edition (CE) and Enterprise Edition (EE) solutions and encouraged users to use patch immediately.
In a published security advice, Gitlab said that among the nine shortcomings are two critical difficulty that allow threat actors to bypass approval.
Users are encouraged to bring their Gitlab CE/EE to versions 17.7.7, 17.8.5 and 17.9.2, as soon as possible. Gitlab.com has already been patched and Gitlab -Dedicated Customers are automatically updated so no action is required on their end. However, users running self -controlled installations also have to patch up.
Afforded and lapping
“We strongly recommend that all installations running a version affected by the problems below have been upgraded to the latest version as soon as possible,” Gitlab said.
The two critical seriousness errors are traced as CVE-2025-25291 and CVE-2025-25292. They were both discovered in the Ruby-Saml Library used for Saml Sign-On (SSO) approval on cases or group level. An approved striker with access to a validly signed SAML document can mimic another user with the same SAML identity provider (IDP) environment and thus access their account.
This in turn can lead to data -exfiltration, privilege shell and more.
Users who cannot use the patch immediately must mitigate the risk of ensuring that all users on Gitlab-self-controlled instances have 2FA created (2FA at the identity provider level does not help). They also need to disable the Saml-to-Factor City Pass setting and must request administration approval for auto-created users.
Gitlab emphasized that these should only be seen as temporary mitigation and that the only way to permanently solve the problem is to apply the patch.
GitHub says its platform is not affected by this discovery when it stopped using the Ruby-Saml library more than a decade ago, found diaper computer.
“GitHub is not currently using Ruby-Saml for approval, but began to evaluate the use of the library for the purpose of using an open source library for Saml Authorization once again,” Github said.
Via Bleeping computer
