GitLab
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
There is no written leader briefing for this story yet. These questions come from the facts we hold.
Questions to ask IT
- Do we run Netapp Storagegrid, Omniauth Saml, Onelogin Ruby-saml and 1 more, and which versions?
- Is any of it reachable from the internet?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2025-25291- 9.3 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality and integrity.CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Not listed
- Before 1.12.4
- 1.12.4
These facts are for CVE-2025-25291. This event covers 2 more CVEs, each with its own record. Versions are as the CVE record states them; check the vendor advisory before planning a fix.
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- On 12 March 2025, we released versions 17.9.2, 17.8.5, 17.7.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.
Read the original reportGitLab security releases(opens in a new tab)
Products and services involved
- Netapp Storagegrid93% match confidence · CVE-2025-25291
- Omniauth Saml90% match confidence · CVE-2025-25291
- Onelogin Ruby-saml90% match confidence · CVE-2025-25291
- GitLab92% match confidence · CVE-2025-25291
Pulse
Last change 5d ago · Recheck overdue since 4 Nov 2026, 18:21 UK time
- Story3 Nov 2026, 18:21 UK time · 5d ago
Linked reporting from GitLab security releases (vendor psirt).
Read source (GitLab security releases)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- GitLab security releasesVendor
GitLab Critical Patch Release: 17.9.2, 17.8.5, 17.7.7
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
- ProbableSummary fact75% confidence
On 12 March 2025, we released versions 17.9.2, 17.8.5, 17.7.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2025-25291
- ConfirmedCVE identifier95% confidence
Event involves CVE-2025-25292
- ConfirmedCVE identifier95% confidence
Event involves CVE-2025-27407