Masked variable vulnerability in Runner version 13.9.0-rc1
Feb 18, 2021Lee Matos
Summary
This post details a vulnerability in GitLab Runner version 13.9.0-rc1 where masked CI variables could be exposed in build logs. It outlines the affected versions and timeframes on GitLab.com and for self-managed instances, provides examples of how variables could be exposed, and instructs users on remediation steps (reviewing jobs, rotating secrets, upgrading/downgrading runner). It also explains the release candidate process and actions taken by GitLab to mitigate the issue.
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting