Alpine Linux

Hacker haben versucht, über eine Ruby-Lücke die Gitlab-Instanz von Alpine Linux zu kompromittieren. Der Vorfall ist ein Weckruf an andere Gitlab-Admins.

Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.

Hacker haben versucht, über eine Ruby-Lücke die Gitlab-Instanz von Alpine Linux zu kompromittieren. Der Vorfall ist ein Weckruf an andere Gitlab-Admins.

Next Alpine Linux EOL: Nov 1, 2026. Official Alpine Linux end-of-life dates for every version.

Alpine Linux

Alpine Linux has rebuilt its GitLab server and reset all user passwords after hackers attempted to exploit a critical remote code execution (RCE) vulnerability in its development infrastructure.  The attacks targeted a maximum-severity vulnerability tracked as CVE-2026-97229, which carries a CVSS score of 10.0. Although Alpine Linux found no evidence that the attackers successfully executed malicious code or modified its software packages, the project said it could not completely rule out a breach. Alpine Linux is a lightweight, open-source operating system widely used as the foundation for Docker container images. Its GitLab server hosts development repositories, code reviews and continuous integration (CI) jobs, including the build recipes used to produce Alpine software packages. This makes the server an important target for attackers seeking to compromise the software supply chain. The vulnerability is caused by an integer overflow in Onigmo, the regular expression engine included in Ruby and used by GitLab's CI/CD system. If successful, this could allow the attacker to execute arbitrary code on the vulnerable server. GitLab disclosed the vulnerability and released security fixes on October 12. However, Alpine Linux initially installed GitLab version 19.3.4 instead of the patched 19.3.5. The project later upgraded to version 19.3.6 on October 22, but the vulnerability remained because the required Ruby security patch was missing from Alpine's custom container image. Attackers repeatedly crashed GitLab processes According to Alpine Linux, an attacker created a new account and began submitting specially crafted CI configurations to its GitLab server on October 20-21. The security team recorded eight worker crashes during the attacks. Four attempts reportedly progressed partway through the exploitation process before failing to complete.  The attackers also downloaded Alpine Linux's GitLab container image, suggesting they may have been studying the server's configuration and preparing an exploit specifically designed for that environment. The project later discovered that upgrading GitLab alone was insufficient to address the problem. The security fix required an updated version of Ruby, which was included in GitLab's official packages but was not present in Alpine's custom image. No evidence of software tampering found There were doubts about a possible software supply-chain attack. If attackers had successfully compromised the GitLab server, they could potentially have accessed user information, password hashes, two-factor authentication secrets, CI/CD credentials, integration tokens and private project repositories. GitLab rebuilt from scratch The project also advised users to change passwords reused on other websites and to pull the updated alpinelinux/gitlab:19.3.6 container image published on October 27. This image includes Ruby 3.3.13, which contains the necessary security fix.

BleepingComputer, publié le 1er novembre 2026. L'article rapporte une tentative d'attaque contre l'infrastructure GitLab du projet open-source Alpine Linux, survenue les 20 et 21 octobre 2026. Des attaquants ont ciblé CVE-2026-97229, une vulnérabilité de type integer overflow de sévérité maximale affectant le compilateur d'expressions régulières CI/CD Onigmo, intégré à Ruby et bundlé dans GitLab.

Le 28 octobre 2026, l'équipe Alpine Linux a publié un post-mortem détaillé sur son site officiel (alpinelinux.org) concernant une tentative d'exploitation de leur instance GitLab entre le 20 et le 21 octobre 2026. CVE-2026-97229 est une vulnérabilité critique (CVSS 10.0) affectant la manière dont GitLab évalue les expressions régulières dans les configurations CI.

Le 28 octobre 2026, l'équipe Alpine Linux a publié un post-mortem détaillé sur son site officiel (alpinelinux.org) concernant une tentative d'exploitation de leur instance GitLab entre le 20 et le 21 octobre 2026. CVE-2026-97229 est une vulnérabilité critique (CVSS 10.0) affectant la manière dont GitLab évalue les expressions régulières dans les configurations CI.

TL;DR On October 20 and 21, an attacker tried to exploit a critical GitLab vulnerability on Alpine Linux's own GitLab server. The flaw, CVE-2026-97229, scores 10.0 on CVSS and can lead to remote code execution. Alpine says the attack "came close to working," so it rebuilt the whole instance from scratch. The CVE does not yet appear in CISA's KEV catalog.

TL;DR On October 20 and 21, an attacker tried to exploit a critical GitLab vulnerability on Alpine Linux's own GitLab server. The flaw, CVE-2026-97229, scores 10.0 on CVSS and can lead to remote code execution. Alpine says the attack "came close to working," so it rebuilt the whole instance from scratch. The CVE does not yet appear in CISA's KEV catalog.

Je propose ici une version plus structurée, détaillée - et à jour - ainsi que plus complémentaire de mon ancien billet Pourquoi ?.

What's Changed chore(deps): update alpine docker tag to v3.24.3 by @renovate[bot] in #18 Full Changelog: 6.11.2-alpine3.24.2-r1...6.12.0-alpine3.24.3-r1