[{"data":1,"prerenderedAt":948},["ShallowReactive",2],{"/blog/new-openssl-30-vulnerabilities-what-you-need-to-know-to-find-and-fix-them":3,"navigation-en-us":161,"banner-en-us":589,"footer-en-us":599,"blog-post-authors-en-us-GitLab Security Team":844,"blog-related-posts-en-us-new-openssl-30-vulnerabilities-what-you-need-to-know-to-find-and-fix-them":860,"blog-promotions-en-us":885,"next-steps-en-us":938},{"id":4,"title":5,"authors":6,"body":8,"category":140,"date":141,"description":142,"extension":143,"externalUrl":144,"faq":144,"featured":145,"heroImage":146,"meta":147,"navigation":148,"path":149,"seo":150,"slug":154,"stem":155,"tags":156,"template":159,"updatedDate":144,"__hash__":160},"blogPosts/en-us/blog/new-openssl-30-vulnerabilities-what-you-need-to-know-to-find-and-fix-them.md","New OpenSSL 3.0 vulnerabilities: What you need to know to find and fix them",[7],"GitLab Security Team",{"type":9,"value":10,"toc":131},"minimark",[11,28,31,36,39,42,46,55,58,61,65,80,87,91,94,124,128],[12,13,14,15,21,22,27],"p",{},"The OpenSSL Project ",[16,17,20],"a",{"href":18,"rel":19},"https://www.openssl.org/blog/blog/email-address-overflows/",[],"announced two vulnerabilities"," found in OpenSSL 3.0-3.0.6 (",[16,23,26],{"href":24,"rel":25},"https://www.openssl.org/blog/blog/OpenSSL3.Final/",[],"first released in September 2021","). CVE-2022-3786 and CVE-2022-3602 both relate to X.509 email address buffer overflows and require users to upgrade to OpenSSL 3.0.7, which includes patches for the vulnerabilities, which were downgraded from “critical” to “high.”",[12,29,30],{},"OpenSSL is an open-source library used by applications to secure communications over the internet with the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols.",[32,33,35],"h2",{"id":34},"what-are-the-openssl-30-vulnerabilities","What are the OpenSSL 3.0 vulnerabilities?",[12,37,38],{},"CVE-2022-3786 concerns an X.509 email address variable length buffer overflow that can result in a denial of service attack. CVE-2022-3602 concerns X.509 email address 4-byte buffer overflow that could result in a denial of service that could potentially escalate to remote code execution under specific circumstances (the circumstances were not detailed).",[12,40,41],{},"CVE-2022-3602 was initially announced by the OpenSSL Project as a critical severity vulnerability, but was downgraded to high severity due to unlikely exploitation in “common conditions.”",[32,43,45],{"id":44},"how-do-the-vulnerabilities-work","How do the vulnerabilities work?",[12,47,48,49,54],{},"According to the ",[16,50,53],{"href":51,"rel":52},"https://www.openssl.org/news/secadv/20221101.txt",[],"OpenSSL bulletin",": “A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs\nafter certificate chain signature verification and requires either a\nCA to have signed the malicious certificate or for the application to\ncontinue certificate verification despite failure to construct a path\nto a trusted issuer. An attacker can craft a malicious email address\nto overflow four attacker-controlled bytes on the stack. This buffer\noverflow could result in a crash (causing a denial of service) or\npotentially remote code execution.",[12,56,57],{},"\"Many platforms implement stack overflow protections which would mitigate\nagainst the risk of remote code execution. The risk may be further\nmitigated based on stack layout for any given platform/compiler...",[12,59,60],{},"\"In a TLS client, this can be triggered by connecting to a malicious\nserver. In a TLS server, this can be triggered if the server requests\nclient authentication and a malicious client connects.”",[32,62,64],{"id":63},"is-your-organization-at-risk","Is your organization at risk?",[12,66,67,68,73,74,79],{},"Only applications that use OpenSSL 3.0 are at risk. To assess if your software supply chain is vulnerable, use GitLab’s ",[16,69,72],{"href":70,"rel":71},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"dependency scanning"," and ",[16,75,78],{"href":76,"rel":77},"https://docs.gitlab.com/user/application_security/container_scanning/",[],"container scanning",".",[12,81,48,82,86],{},[16,83,85],{"href":18,"rel":84},[],"OpenSSL Security Team",": “The bugs were introduced as part of punycode decoding functionality (currently only used for processing email address name constraints in X.509 certificates). This code was first introduced in OpenSSL 3.0.0. OpenSSL 1.0.2, 1.1.1, and other earlier versions are not affected.”",[32,88,90],{"id":89},"is-gitlab-vulnerable","Is GitLab vulnerable?",[12,92,93],{},"We have investigated and, as of now, we have found that none of our production systems were impacted by the vulnerability.",[12,95,96,97,102,103,108,109,113,114,123],{},"However, our Dynamic Application Security Testing (",[16,98,101],{"href":99,"rel":100},"https://docs.gitlab.com/user/application_security/dast/",[],"DAST",") analyzer included the vulnerable library, which we have patched in ",[16,104,107],{"href":105,"rel":106},"https://gitlab.com/gitlab-org/security-products/dast/-/releases/v3.0.32",[],"DAST v3.0.32",". Self-managed customers that are using our built-in DAST CI template after 15.0 can get the latest release from ",[110,111,112],"code",{},"registry.gitlab.com",". If using ",[16,115,118,119,122],{"href":116,"rel":117},"https://docs.gitlab.com/runner/executors/docker/#using-the-always-pull-policy",[],"the ",[110,120,121],{},"always"," pull policy"," the update will occur automatically. GitLab.com is already running the updated DAST scanner.",[32,125,127],{"id":126},"how-to-mitigate-the-vulnerability-risk","How to mitigate the vulnerability risk",[12,129,130],{},"To fix the flaws found in OpenSSL 3.0, organizations must upgrade to OpenSSL 3.0.7.",{"title":132,"searchDepth":133,"depth":133,"links":134},"",2,[135,136,137,138,139],{"id":34,"depth":133,"text":35},{"id":44,"depth":133,"text":45},{"id":63,"depth":133,"text":64},{"id":89,"depth":133,"text":90},{"id":126,"depth":133,"text":127},"security","2022-11-01","Learn how to identify your risk for CVE-2022-3786 and CVE-2022-3602.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749679348/Blog/Hero%20Images/locks.jpg",{},true,"/en-us/blog/new-openssl-30-vulnerabilities-what-you-need-to-know-to-find-and-fix-them",{"title":5,"description":142,"ogTitle":5,"ogDescription":142,"noIndex":145,"ogImage":146,"ogUrl":151,"ogSiteName":152,"ogType":153,"canonicalUrls":151},"https://about.gitlab.com/blog/new-openssl-30-vulnerabilities-what-you-need-to-know-to-find-and-fix-them","https://about.gitlab.com","article","new-openssl-30-vulnerabilities-what-you-need-to-know-to-find-and-fix-them","en-us/blog/new-openssl-30-vulnerabilities-what-you-need-to-know-to-find-and-fix-them",[140,157,158],"open source","news","BlogPost","IiPQsX-0LAFsnX2fKrYs4_om8qKZrdbcVA3VkMiNL1I",{"logo":162,"freeTrial":167,"sales":172,"login":177,"items":182,"search":509,"minimal":540,"duo":559,"switchNav":568,"pricingDeployment":579},{"config":163},{"href":164,"dataGaName":165,"dataGaLocation":166},"/","gitlab logo","header",{"text":168,"config":169},"Get free trial",{"href":170,"dataGaName":171,"dataGaLocation":166},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":173,"config":174},"Request a demo",{"href":175,"dataGaName":176,"dataGaLocation":166},"/sales/?contact-topic=request-demo","sales",{"text":178,"config":179},"Sign in",{"href":180,"dataGaName":181,"dataGaLocation":166},"https://gitlab.com/users/sign_in/","sign in",[183,212,312,317,431,487],{"text":184,"config":185,"menu":187},"Platform",{"dataNavLevelOne":186},"platform",{"type":188,"columns":189},"cards",[190,196,204],{"title":184,"description":191,"link":192},"The intelligent orchestration platform for DevSecOps",{"text":193,"config":194},"Explore our Platform",{"href":195,"dataGaName":186,"dataGaLocation":166},"/platform/",{"title":197,"description":198,"link":199},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":200,"config":201},"Meet GitLab Duo",{"href":202,"dataGaName":203,"dataGaLocation":166},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":205,"description":206,"link":207},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":208,"config":209},"Learn more",{"href":210,"dataGaName":211,"dataGaLocation":166},"/why-gitlab/","why gitlab",{"text":213,"left":148,"config":214,"menu":216},"Product",{"dataNavLevelOne":215},"solutions",{"type":217,"link":218,"columns":222,"feature":291},"lists",{"text":219,"config":220},"View all Solutions",{"href":221,"dataGaName":215,"dataGaLocation":166},"/solutions/",[223,247,270],{"title":224,"description":225,"link":226,"items":231},"Automation","CI/CD and automation to accelerate deployment",{"config":227},{"icon":228,"href":229,"dataGaName":230,"dataGaLocation":166},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[232,236,239,243],{"text":233,"config":234},"CI/CD",{"href":235,"dataGaLocation":166,"dataGaName":233},"/solutions/continuous-integration/",{"text":197,"config":237},{"href":202,"dataGaLocation":166,"dataGaName":238},"gitlab duo agent platform - product menu",{"text":240,"config":241},"Source Code Management",{"href":242,"dataGaLocation":166,"dataGaName":240},"/solutions/source-code-management/",{"text":244,"config":245},"Automated Software Delivery",{"href":229,"dataGaLocation":166,"dataGaName":246},"Automated software delivery",{"title":248,"description":249,"link":250,"items":255},"Security","Deliver code faster without compromising security",{"config":251},{"href":252,"dataGaName":253,"dataGaLocation":166,"icon":254},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[256,260,265],{"text":257,"config":258},"Application Security Testing",{"href":252,"dataGaName":259,"dataGaLocation":166},"Application security testing",{"text":261,"config":262},"Software Supply Chain Security",{"href":263,"dataGaLocation":166,"dataGaName":264},"/solutions/supply-chain/","Software supply chain security",{"text":266,"config":267},"Software Compliance",{"href":268,"dataGaName":269,"dataGaLocation":166},"/solutions/software-compliance/","software compliance",{"title":271,"link":272,"items":277},"Measurement",{"config":273},{"icon":274,"href":275,"dataGaName":276,"dataGaLocation":166},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[278,282,286],{"text":279,"config":280},"Visibility & Measurement",{"href":275,"dataGaLocation":166,"dataGaName":281},"Visibility and Measurement",{"text":283,"config":284},"Value Stream Management",{"href":285,"dataGaLocation":166,"dataGaName":283},"/solutions/value-stream-management/",{"text":287,"config":288},"Analytics & Insights",{"href":289,"dataGaLocation":166,"dataGaName":290},"/solutions/analytics-and-insights/","Analytics and insights",{"title":292,"type":217,"items":293},"GitLab for",[294,300,306],{"text":295,"config":296},"Enterprise",{"icon":297,"href":298,"dataGaLocation":166,"dataGaName":299},"Building","/enterprise/","enterprise",{"text":301,"config":302},"Small Business",{"icon":303,"href":304,"dataGaLocation":166,"dataGaName":305},"Work","/small-business/","small business",{"text":307,"config":308},"Public Sector",{"icon":309,"href":310,"dataGaLocation":166,"dataGaName":311},"Organization","/solutions/public-sector/","public sector",{"text":313,"config":314},"Pricing",{"href":315,"dataGaName":316,"dataGaLocation":166,"dataNavLevelOne":316},"/pricing/","pricing",{"text":318,"config":319,"menu":321},"Resources",{"dataNavLevelOne":320},"resources",{"type":217,"link":322,"columns":326,"feature":420},{"text":323,"config":324},"View all resources",{"href":325,"dataGaName":320,"dataGaLocation":166},"/resources/",[327,360,387],{"title":328,"items":329},"Getting started",[330,335,340,345,350,355],{"text":331,"config":332},"Install",{"href":333,"dataGaName":334,"dataGaLocation":166},"/install/","install",{"text":336,"config":337},"Quick start guides",{"href":338,"dataGaName":339,"dataGaLocation":166},"/get-started/","quick setup checklists",{"text":341,"config":342},"Learn",{"href":343,"dataGaLocation":166,"dataGaName":344},"https://university.gitlab.com/","learn",{"text":346,"config":347},"Product documentation",{"href":348,"dataGaName":349,"dataGaLocation":166},"https://docs.gitlab.com/","product documentation",{"text":351,"config":352},"Best practice videos",{"href":353,"dataGaName":354,"dataGaLocation":166},"/getting-started-videos/","best practice videos",{"text":356,"config":357},"Integrations",{"href":358,"dataGaName":359,"dataGaLocation":166},"/integrations/","integrations",{"title":361,"items":362},"Discover",[363,368,373,378,382],{"text":364,"config":365},"Customer success stories",{"href":366,"dataGaName":367,"dataGaLocation":166},"/customers/","customer success stories",{"text":369,"config":370},"Blog",{"href":371,"dataGaName":372,"dataGaLocation":166},"/blog/","blog",{"text":374,"config":375},"Demo Hub",{"href":376,"dataGaName":377,"dataGaLocation":166},"/demo-hub/","demo hub",{"text":379,"config":380},"The Source",{"href":381,"dataGaName":372,"dataGaLocation":166},"/the-source/",{"text":383,"config":384},"Remote",{"href":385,"dataGaName":386,"dataGaLocation":166},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":388,"items":389},"Connect",[390,395,400,405,410,415],{"text":391,"config":392},"GitLab Services",{"href":393,"dataGaName":394,"dataGaLocation":166},"/services/","services",{"text":396,"config":397},"Contribute",{"href":398,"dataGaName":399,"dataGaLocation":166},"https://contributors.gitlab.com","contribute",{"text":401,"config":402},"Community",{"href":403,"dataGaName":404,"dataGaLocation":166},"/community/","community",{"text":406,"config":407},"Forum",{"href":408,"dataGaName":409,"dataGaLocation":166},"https://forum.gitlab.com/","forum",{"text":411,"config":412},"Events",{"href":413,"dataGaName":414,"dataGaLocation":166},"/events/","events",{"text":416,"config":417},"Partners",{"href":418,"dataGaName":419,"dataGaLocation":166},"/partners/","partners",{"config":421,"title":424,"text":425,"link":426},{"background":422,"textColor":423},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":427,"config":428},"Read the latest",{"href":429,"dataGaName":430,"dataGaLocation":166},"/whats-new/","whats new",{"text":432,"config":433,"menu":435},"Company",{"dataNavLevelOne":434},"company",{"type":217,"columns":436},[437],{"items":438},[439,444,450,452,457,462,467,472,477,482],{"text":440,"config":441},"About",{"href":442,"dataGaName":443,"dataGaLocation":166},"/company/","about",{"text":445,"config":446,"footerGa":449},"Jobs",{"href":447,"dataGaName":448,"dataGaLocation":166},"/jobs/","jobs",{"dataGaName":448},{"text":411,"config":451},{"href":413,"dataGaName":414,"dataGaLocation":166},{"text":453,"config":454},"Leadership",{"href":455,"dataGaName":456,"dataGaLocation":166},"/company/team/e-group/","leadership",{"text":458,"config":459},"Handbook",{"href":460,"dataGaName":461,"dataGaLocation":166},"https://handbook.gitlab.com/","handbook",{"text":463,"config":464},"Investor relations",{"href":465,"dataGaName":466,"dataGaLocation":166},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":468,"config":469},"Trust Center",{"href":470,"dataGaName":471,"dataGaLocation":166},"/security/","trust center",{"text":473,"config":474},"AI Transparency Center",{"href":475,"dataGaName":476,"dataGaLocation":166},"/ai-transparency-center/","ai transparency center",{"text":478,"config":479},"Newsletter",{"href":480,"dataGaName":481,"dataGaLocation":166},"/company/contact/#contact-forms","newsletter",{"text":483,"config":484},"Press",{"href":485,"dataGaName":486,"dataGaLocation":166},"/press/","press",{"text":488,"config":489,"menu":490},"Contact us",{"dataNavLevelOne":434},{"type":217,"columns":491},[492],{"items":493},[494,499,504],{"text":495,"config":496},"Talk to sales",{"href":497,"dataGaName":498,"dataGaLocation":166},"/sales/","talk to sales",{"text":500,"config":501},"Support portal",{"href":502,"dataGaName":503,"dataGaLocation":166},"https://support.gitlab.com/hc/en-us","support portal",{"text":505,"config":506},"Customer portal",{"href":507,"dataGaName":508,"dataGaLocation":166},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":510,"login":511,"suggestions":518},"Close",{"text":512,"link":513},"To search repositories and projects, login to",{"text":514,"config":515},"gitlab.com",{"href":180,"dataGaName":516,"dataGaLocation":517},"search login","search",{"text":519,"default":520},"Suggestions",[521,523,527,529,533,537],{"text":197,"config":522},{"href":202,"dataGaName":197,"dataGaLocation":517},{"text":524,"config":525},"Code Suggestions (AI)",{"href":526,"dataGaName":524,"dataGaLocation":517},"/solutions/code-suggestions/",{"text":233,"config":528},{"href":235,"dataGaName":233,"dataGaLocation":517},{"text":530,"config":531},"GitLab on AWS",{"href":532,"dataGaName":530,"dataGaLocation":517},"/partners/technology-partners/aws/",{"text":534,"config":535},"GitLab on Google Cloud",{"href":536,"dataGaName":534,"dataGaLocation":517},"/partners/technology-partners/google-cloud-platform/",{"text":538,"config":539},"Why GitLab?",{"href":210,"dataGaName":538,"dataGaLocation":517},{"freeTrial":541,"mobileIcon":546,"desktopIcon":551,"secondaryButton":554},{"text":542,"config":543},"Start free trial",{"href":544,"dataGaName":171,"dataGaLocation":545},"https://gitlab.com/-/trials/new/","nav",{"altText":547,"config":548},"Gitlab Icon",{"src":549,"dataGaName":550,"dataGaLocation":545},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":547,"config":552},{"src":553,"dataGaName":550,"dataGaLocation":545},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":555,"config":556},"Get Started",{"href":557,"dataGaName":558,"dataGaLocation":545},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":560,"mobileIcon":564,"desktopIcon":566},{"text":561,"config":562},"Learn more about GitLab Duo",{"href":202,"dataGaName":563,"dataGaLocation":545},"gitlab duo",{"altText":547,"config":565},{"src":549,"dataGaName":550,"dataGaLocation":545},{"altText":547,"config":567},{"src":553,"dataGaName":550,"dataGaLocation":545},{"button":569,"mobileIcon":574,"desktopIcon":576},{"text":570,"config":571},"/switch",{"href":572,"dataGaName":573,"dataGaLocation":545},"#contact","switch",{"altText":547,"config":575},{"src":549,"dataGaName":550,"dataGaLocation":545},{"altText":547,"config":577},{"src":578,"dataGaName":550,"dataGaLocation":545},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":580,"mobileIcon":585,"desktopIcon":587},{"text":581,"config":582},"Back to pricing",{"href":315,"dataGaName":583,"dataGaLocation":545,"icon":584},"back to pricing","GoBack",{"altText":547,"config":586},{"src":549,"dataGaName":550,"dataGaLocation":545},{"altText":547,"config":588},{"src":553,"dataGaName":550,"dataGaLocation":545},{"title":590,"titleMobile":591,"button":592,"config":597},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":208,"config":593},{"href":594,"dataGaName":595,"dataGaLocation":596},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":598,"disabled":145},"release",{"data":600},{"text":601,"source":602,"edit":608,"contribute":613,"config":618,"items":623,"minimal":833},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":603,"config":604},"View page source",{"href":605,"dataGaName":606,"dataGaLocation":607},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":609,"config":610},"Edit this page",{"href":611,"dataGaName":612,"dataGaLocation":607},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":614,"config":615},"Please contribute",{"href":616,"dataGaName":617,"dataGaLocation":607},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":619,"facebook":620,"youtube":621,"linkedin":622},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[624,671,725,769,801],{"title":313,"links":625,"subMenu":640},[626,630,635],{"text":627,"config":628},"View plans",{"href":315,"dataGaName":629,"dataGaLocation":607},"view plans",{"text":631,"config":632},"Why Premium?",{"href":633,"dataGaName":634,"dataGaLocation":607},"/pricing/premium/","why premium",{"text":636,"config":637},"Why Ultimate?",{"href":638,"dataGaName":639,"dataGaLocation":607},"/pricing/ultimate/","why ultimate",[641],{"title":642,"links":643},"Contact Us",[644,647,649,651,656,661,666],{"text":645,"config":646},"Contact sales",{"href":497,"dataGaName":176,"dataGaLocation":607},{"text":500,"config":648},{"href":502,"dataGaName":503,"dataGaLocation":607},{"text":505,"config":650},{"href":507,"dataGaName":508,"dataGaLocation":607},{"text":652,"config":653},"Status",{"href":654,"dataGaName":655,"dataGaLocation":607},"https://status.gitlab.com/","status",{"text":657,"config":658},"Terms of use",{"href":659,"dataGaName":660,"dataGaLocation":607},"/terms/","terms of use",{"text":662,"config":663},"Privacy statement",{"href":664,"dataGaName":665,"dataGaLocation":607},"/privacy/","privacy statement",{"text":667,"config":668},"Cookie preferences",{"dataGaName":669,"dataGaLocation":607,"id":670,"isOneTrustButton":148},"cookie preferences","ot-sdk-btn",{"title":213,"links":672,"subMenu":681},[673,677],{"text":674,"config":675},"DevSecOps platform",{"href":195,"dataGaName":676,"dataGaLocation":607},"devsecops platform",{"text":678,"config":679},"AI-Assisted Development",{"href":202,"dataGaName":680,"dataGaLocation":607},"ai-assisted development",[682],{"title":683,"links":684},"Topics",[685,690,695,700,705,710,715,720],{"text":686,"config":687},"CICD",{"href":688,"dataGaName":689,"dataGaLocation":607},"/topics/ci-cd/","cicd",{"text":691,"config":692},"GitOps",{"href":693,"dataGaName":694,"dataGaLocation":607},"/topics/gitops/","gitops",{"text":696,"config":697},"DevOps",{"href":698,"dataGaName":699,"dataGaLocation":607},"/topics/devops/","devops",{"text":701,"config":702},"Version Control",{"href":703,"dataGaName":704,"dataGaLocation":607},"/topics/version-control/","version control",{"text":706,"config":707},"DevSecOps",{"href":708,"dataGaName":709,"dataGaLocation":607},"/topics/devsecops/","devsecops",{"text":711,"config":712},"Cloud Native",{"href":713,"dataGaName":714,"dataGaLocation":607},"/topics/cloud-native/","cloud native",{"text":716,"config":717},"AI for Coding",{"href":718,"dataGaName":719,"dataGaLocation":607},"/topics/devops/ai-for-coding/","ai for coding",{"text":721,"config":722},"Agentic AI",{"href":723,"dataGaName":724,"dataGaLocation":607},"/topics/agentic-ai/","agentic ai",{"title":726,"links":727},"Solutions",[728,730,732,737,741,744,748,751,753,756,759,764],{"text":257,"config":729},{"href":252,"dataGaName":257,"dataGaLocation":607},{"text":246,"config":731},{"href":229,"dataGaName":230,"dataGaLocation":607},{"text":733,"config":734},"Agile development",{"href":735,"dataGaName":736,"dataGaLocation":607},"/solutions/agile-delivery/","agile delivery",{"text":738,"config":739},"SCM",{"href":242,"dataGaName":740,"dataGaLocation":607},"source code management",{"text":686,"config":742},{"href":235,"dataGaName":743,"dataGaLocation":607},"continuous integration & delivery",{"text":745,"config":746},"Value stream management",{"href":285,"dataGaName":747,"dataGaLocation":607},"value stream management",{"text":691,"config":749},{"href":750,"dataGaName":694,"dataGaLocation":607},"/solutions/gitops/",{"text":295,"config":752},{"href":298,"dataGaName":299,"dataGaLocation":607},{"text":754,"config":755},"Small business",{"href":304,"dataGaName":305,"dataGaLocation":607},{"text":757,"config":758},"Public sector",{"href":310,"dataGaName":311,"dataGaLocation":607},{"text":760,"config":761},"Education",{"href":762,"dataGaName":763,"dataGaLocation":607},"/solutions/education/","education",{"text":765,"config":766},"Financial services",{"href":767,"dataGaName":768,"dataGaLocation":607},"/solutions/finance/","financial services",{"title":318,"links":770},[771,773,775,777,780,782,785,787,789,791,793,795,797,799],{"text":331,"config":772},{"href":333,"dataGaName":334,"dataGaLocation":607},{"text":336,"config":774},{"href":338,"dataGaName":339,"dataGaLocation":607},{"text":341,"config":776},{"href":343,"dataGaName":344,"dataGaLocation":607},{"text":346,"config":778},{"href":348,"dataGaName":779,"dataGaLocation":607},"docs",{"text":369,"config":781},{"href":371,"dataGaName":372,"dataGaLocation":607},{"text":783,"config":784},"What's new",{"href":429,"dataGaName":430,"dataGaLocation":607},{"text":364,"config":786},{"href":366,"dataGaName":367,"dataGaLocation":607},{"text":383,"config":788},{"href":385,"dataGaName":386,"dataGaLocation":607},{"text":391,"config":790},{"href":393,"dataGaName":394,"dataGaLocation":607},{"text":396,"config":792},{"href":398,"dataGaName":399,"dataGaLocation":607},{"text":401,"config":794},{"href":403,"dataGaName":404,"dataGaLocation":607},{"text":406,"config":796},{"href":408,"dataGaName":409,"dataGaLocation":607},{"text":411,"config":798},{"href":413,"dataGaName":414,"dataGaLocation":607},{"text":416,"config":800},{"href":418,"dataGaName":419,"dataGaLocation":607},{"title":432,"links":802},[803,805,807,809,811,813,817,822,824,826,828],{"text":440,"config":804},{"href":442,"dataGaName":434,"dataGaLocation":607},{"text":445,"config":806},{"href":447,"dataGaName":448,"dataGaLocation":607},{"text":453,"config":808},{"href":455,"dataGaName":456,"dataGaLocation":607},{"text":458,"config":810},{"href":460,"dataGaName":461,"dataGaLocation":607},{"text":463,"config":812},{"href":465,"dataGaName":466,"dataGaLocation":607},{"text":814,"config":815},"Sustainability",{"href":816,"dataGaName":814,"dataGaLocation":607},"/sustainability/",{"text":818,"config":819},"Diversity, inclusion and belonging (DIB)",{"href":820,"dataGaName":821,"dataGaLocation":607},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":468,"config":823},{"href":470,"dataGaName":471,"dataGaLocation":607},{"text":478,"config":825},{"href":480,"dataGaName":481,"dataGaLocation":607},{"text":483,"config":827},{"href":485,"dataGaName":486,"dataGaLocation":607},{"text":829,"config":830},"Modern Slavery Transparency Statement",{"href":831,"dataGaName":832,"dataGaLocation":607},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":834},[835,838,841],{"text":836,"config":837},"Terms",{"href":659,"dataGaName":660,"dataGaLocation":607},{"text":839,"config":840},"Cookies",{"dataGaName":669,"dataGaLocation":607,"id":670,"isOneTrustButton":148},{"text":842,"config":843},"Privacy",{"href":664,"dataGaName":665,"dataGaLocation":607},[845],{"id":846,"title":847,"body":144,"config":848,"content":850,"description":144,"extension":854,"meta":855,"navigation":148,"path":856,"seo":857,"stem":858,"__hash__":859},"blogAuthors/en-us/blog/authors/gitlab-security-team.yml","Gitlab Security Team",{"template":849},"BlogAuthor",{"name":7,"config":851},{"headshot":852,"ctfId":853},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659488/Blog/Author%20Headshots/gitlab-logo-extra-whitespace.png","GitLab-Security-Team","yml",{},"/en-us/blog/authors/gitlab-security-team",{},"en-us/blog/authors/gitlab-security-team","M5RMqW6Lb84jEWdwJrctViGP9u1WMH2dPkXsUXXXcrk",[861,869,877],{"title":862,"description":863,"heroImage":864,"category":140,"date":865,"authors":866,"slug":868,"externalUrl":144},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[867],"Julian Thome","improved-scope-offset-fingerprinting",{"title":870,"description":871,"heroImage":864,"category":140,"date":872,"authors":873,"slug":876,"externalUrl":144},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[874,875],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":878,"description":879,"heroImage":880,"category":140,"date":881,"authors":882,"slug":884,"externalUrl":144},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[883],"Alisa Ho","claude-security-and-gitlab",{"promotions":886},[887,901,913,924],{"id":888,"categories":889,"header":891,"text":892,"button":893,"image":898},"ai-modernization",[890],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":894,"config":895},"Get your AI maturity score",{"href":896,"dataGaName":897,"dataGaLocation":372},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":899},{"src":900},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":902,"categories":903,"header":905,"text":892,"button":906,"image":910},"devops-modernization",[904,709],"product","Are you just managing tools or shipping innovation?",{"text":907,"config":908},"Get your DevOps maturity score",{"href":909,"dataGaName":897,"dataGaLocation":372},"/assessments/devops-modernization-assessment/",{"config":911},{"src":912},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":914,"categories":915,"header":916,"text":892,"button":917,"image":921},"security-modernization",[140],"Are you trading speed for security?",{"text":918,"config":919},"Get your security maturity score",{"href":920,"dataGaName":897,"dataGaLocation":372},"/assessments/security-modernization-assessment/",{"config":922},{"src":923},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":925,"paths":926,"header":929,"text":930,"button":931,"image":936},"github-azure-migration",[927,928],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":932,"config":933},"See how GitLab compares to GitHub",{"href":934,"dataGaName":935,"dataGaLocation":372},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":937},{"src":912},{"header":939,"blurb":940,"button":941,"secondaryButton":946},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":942,"config":943},"Get your free trial",{"href":944,"dataGaName":171,"dataGaLocation":945},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":645,"config":947},{"href":497,"dataGaName":176,"dataGaLocation":945},1786803764161]