News for hackers. Stuff that matters.

A comment on Gitlab – Static passwords set during OmniAuth-based registration (CVE-2022-1162). Parent comment

Re:Gitlab – Static passwords set during OmniAuth-based regis... by nightpool on Friday April 01, 2022 @03:14PM (#30882168)
This was already required in this case, you can see in the comments that an additional AppSec review was done and the appsec team signed off on the MR above and beyond the normal code review process.
[ Parent | on HN ]
Re:Gitlab – Static passwords set during OmniAuth-based regis... by bloomburger on Saturday April 02, 2022 @12:55AM (#30885921)
And two of those appsec reviewers are now out of office for the next two weeks…
[ Parent | on HN ]
Re:Gitlab – Static passwords set during OmniAuth-based regis... by orojackson on Saturday April 02, 2022 @03:17AM (#30886432)
Heh, was this you [1]? Pretty much asking the same good questions you brought up in a different post.

Additionally, I see that the Senior Director of Engineering, Tim Zallmann, has left a bunch of GitLab project repos about 14 hours ago as of this writing. He was one of the folks who tried pinging [3] Mr. Coutable (he's one of the reviewers that's currently OOO). The ping is likely regarding the discovery of the security vulnerability.

[1] https://gitlab.com/gitlab-org/gitlab/-/merge_requests/76318#...

[2] https://gitlab.com/users/timzallmann/activity

[3] https://gitlab.com/gitlab-org/gitlab/-/merge_requests/76318#...

[ Parent | on HN ]