Alpine Linux团队披露，其GitLab实例在10月20日至21日期间遭受了针对CVE-2026-97229漏洞的攻击尝试1。该漏洞评分为CVSS 10.0，主要影响GitLab CI配置中的正则表达式评估，根源在于Ruby内置的Onigmo引擎存在缺陷1。尽管目前没有证据表明攻击成功，但由于无法排除代码执行的可能性，团队决定将GitLab实例从零重建，并强制重置所有用户密码1。
虽然GitLab官方已于10月12日发布修复补丁，但事发时Alpine的实例仍运行未修补的19.3.4版本1。此次攻击导致8个工作进程崩溃，其中4次接近成功1。经核查确认，Alpine的aports仓库、软件包以及10月21日发布的稳定版发行版（包括3.21.9、3.22.7、3.23.7和3.24.3）均未受到篡改1。
对于自行部署GitLab的用户，团队指出仅升级GitLab版本至19.3.6并不足以完全修复此漏洞1。必须确保底层的Ruby引擎包含相应补丁，具体需使用Ruby 3.3.13、3.4.12或4.0.9及以上版本1。此外，Alpine提供的alpinelinux/gitlab:19.3.6镜像直到10月27日后才包含修复后的Ruby环境，此前拉取的镜像仍存在易受攻击的风险1。
The Alpine Linux team disclosed that its GitLab instance faced attempted exploitation of the critical vulnerability CVE-2026-97229 between October 20 and 21 1. Although no evidence indicates a successful attack, the team decided to rebuild the instance from scratch and reset all user passwords because they could not rule out the possibility of code execution 1. The vulnerability, rated with a CVSS score of 10.0, affects regular expression evaluation in GitLab CI configurations and originates from the Onigmo regex engine embedded in Ruby 1.
At the time of the incident, the Alpine instance was running an unpatched version of GitLab (19.3.4), even though GitLab had released a fix on October 12 1. The attack attempts caused eight worker process crashes, with four instances identified as near-successful exploits 1. Verification confirmed that the aports repository, software packages, and stable release distributions dated October 21 (versions 3.21.9, 3.22.7, 3.23.7, and 3.24.3) were not tampered with 1.
For self-hosted deployments, upgrading GitLab alone is insufficient; the underlying Ruby engine must also be patched 1. Administrators are required to use GitLab 19.3.6 or later combined with specific Ruby versions: 3.3.13, 3.4.12, or 4.0.9 and above 1. The official Docker image provided by Alpine, alpinelinux/gitlab:19.3.6, only included the fixed Ruby environment after October 27, meaning images pulled prior to this date remain vulnerable 1.
评论
还没有评论，欢迎留下第一条。