Jun 19, 2014 - Jacob Vosmaer

Omnibus-gitlab security release: bundled Postgres trusts all local connections

Due to a configuration error, the PostgreSQL server that is bundled into omnibus-gitlab trusts all connections originating from the server omnibus-gitlab is running on. This has been rectified in omnibus-gitlab 6.9.2.omnibus.2 (GitLab Community Edition) and 6.9.4-ee.omnibus.1 (GitLab Enterprise Edition). We advise all users of omnibus-gitlab to update to the latest release.

Affected versions: all versions of omnibus-gitlab up to and including omnibus-gitlab 6.9.2.omnibus.1 (GitLab Community Edition) and 6.9.4-ee.omnibus (GitLab Enterprise Edition).

Not affected: Source and cookbook installations of GitLab (e.g. not using .deb or .rpm packages). Omnibus-gitlab installations which use an external DBMS are also not affected.

Fixed versions: omnibus-gitlab 6.9.2.omnibus.2 (GitLab Community Edition) and 6.9.4-ee.omnibus.1 (GitLab Enterprise Edition).

Releases

You can download the latest version of omnibus-gitlab for GitLab Community Edition or omnibus-gitlab for GitLab Enterprise Edition and follow the update instructions.

Impact

An attacker who can execute code on the server omnibus-gitlab runs on can get full superuser access to the bundled Postgres database which holds all GitLab metadata.

To see if your omnibus-gitlab installation is affected you can run the following command on your GitLab server.

sudo -u root /opt/gitlab/embedded/bin/psql -U gitlab-psql -d template1 -c '\echo connected to an insecure Postgres instance'

If the command echoes connected to an insecure Postgres instance your omnibus-gitlab installation is affected by this issue. If you receive an error message psql: FATAL: Peer authentication failed for user "gitlab-psql", your bundled Postgres service is secured.

Please contact us at support@gitlab.com if you have any questions.

Install GitLab in 2 minutes

With Ubuntu, Debian, CentOS, openSUSE, and Raspbian packages or from source

Install GitLab Now

Try GitLab Enterprise Edition risk-free for 30 days.

No credit card required. Have questions? Contact us.
{"cc_re__cc_re__cc_by_sa_4_0": ["><a href=\"/privacy/\">Privacy Policy</a></li> <li><a href=\"/contact/\">Contact Us</a></li> </ul> </div> </div> </div> </footer> <div class='animated text-center source-link'> Edit <a href=\"https://gitlab.com/gitlab-com/www-gitlab-com/blob/master/source/posts/2014-06-19-omnibus-gitlab-postgres-security-release.html.md\" class=external-source-link>this page</a> &mdash; please <a href=\"https://gitlab.com/gitlab-com/www-gitlab-com/blob/master/CONTRIBUTING.md\" class=external-source-link>contribute</a>. <a href='https://creativecommons.org/licenses/by-sa/4.0/' rel=license> <img src=\"/images/by-sa.svg\" alt=\"Creative Commons License\"/> </a> </div> <script src=\"/javascripts/libs/jquery.min.js\"></script> <script src=\"/javascripts/libs/bootstrap.min.js\"></script> <script src=\"/javascripts/libs/jqBootstrapValidation.js\"></script> <script src=\"/javascripts/scripts.js\"></script> <script>\n  //<![CDATA[\n    $.ajax({\n      url: '//munchkin.marketo.net/munchkin.js',\n      dataType: 'script',\n      cache: true,\n      success: function() {\n        Munchkin.init('194-VVC-221');"]}