Ruby releases Onigmo fixes for GitLab remote-code-execution flaws

Alpine Linux investigated attempted exploit activity against its GitLab server

Alpine Linux found no evidence that the attack worked but could not rule it out, so it rebuilt the server from scratch and reset every account’s password.

The account sent crafted CI configurations to the server on 20 and 21 October, crashing GitLab worker processes eight times. In four of those crashes, Alpine said the attacker got partway through the exploit and failed at the next step.

The attacker also downloaded Alpine’s GitLab container image, which Alpine said “suggests they were tuning the exploit to our exact build.”

GitLab upgrades did not replace the standard Ruby runtime

Alpine Linux said its GitLab image used standard Ruby, so upgrading the server to GitLab 19.3.6 on 22 October did not fix the flaw. Servers using Alpine’s own Ruby also need Ruby 3.3.13, 3.4.12, 4.0.9 or later.

Alpine blocked the account on 23 October. The attacker returned on 25 and 26 October, but those attempts failed.

The first two GitLab flaws required a logged-in account

The Hacker News said the first two GitLab flaws were disclosed on September 23. Each required a logged-in account and was rated 9.9 out of 10.

Ruby recommends upgrading to 4.0.9, 3.4.12 or 3.3.13 or later. It said users who cannot upgrade should avoid compiling regular expressions from untrusted input.

Alpine Linux finished rebuilding its GitLab server with Ruby 3.3.13 or later and replaced GitLab’s secret keys after investigating attempted exploit activity.