GitLab Vulnerability PoC: Exfiltrate and mutate repository via injected template

Re:GitLab Vulnerability PoC: Exfiltrate and mutate repositor... by privateSFacct on Thursday March 07, 2019 @01:23PM (#19330589)

Thank you for submitting this report. We will investigate the issue as soon as possible. Due to our current workload, we will get back within 20 business days with an update.

Best regards, GitLab Security Team

Luckily someone looked at this sooner than a month later! You can see where Google's project zero came in - push for folks to prioritize security.

[ Parent | on HN ]

Re:GitLab Vulnerability PoC: Exfiltrate and mutate repositor... by m4tthumphrey on Thursday March 07, 2019 @01:38PM (#19330764)

I would assume that everything is screened as soon as it comes in. Then anything that looks remotely urgent/dangerous is escalated accordingly. Anything else is left pending. Under promise, over deliver via the message.

[ Parent | on HN ]

Re:GitLab Vulnerability PoC: Exfiltrate and mutate repositor... by gitlab-security on Thursday March 07, 2019 @02:27PM (#19331292)

Thank you for your feedback and comment. The message is generated by our automation capability. We want to keep hackers engaged by making sure they know that the issue is successfully submitted. We usually review the report sooner than promised, but want to set expectations accordingly. The automation calculates the number of business days based on current number of reports pending, so it is not always going to be the same message.

[ Parent | on HN ]

Re:GitLab Vulnerability PoC: Exfiltrate and mutate repositor... by sytse on Thursday March 07, 2019 @01:26PM (#19330627)

Underpromise and overdeliver?

[ Parent | on HN ]