High Threat Security Alert (A24-09-14): Multiple Vulnerabilities in GitLab


 

Published on: 13 September 2024

  
  

Description:

GitLab has released 17.1.7, 17.2.5 and 17.3.2 to address multiple vulnerabilities in various versions of GitLab.

Reports indicate that the vulnerability (CVE-2024-6678) in GitLab Community Edition (CE) and Enterprise Edition (EE) is at high risk of exploitation. System administrators are advised to take immediate action to patch your affected systems to mitigate the elevated risk of cyber attacks.

 

Affected Systems:

  • GitLab Community Edition (CE) prior to versions 17.1.7, 17.2.5 and 17.3.2
  • GitLab Enterprise Edition (EE) prior to versions 17.1.7, 17.2.5 and 17.3.2

For detailed information of the affected systems, please refer to the corresponding security advisory at vendor's website.

 

Impact:

Successful exploitation of the vulnerabilities could lead to remote code execution, denial of service, elevation of privilege, information disclosure, security restriction bypass or spoofing on an affected system.

 

Recommendation:

Patches for affected systems are available. System administrators of affected systems should follow the recommendations provided by the vendor and take immediate actions to mitigate the risk.

 

More Information:

  • https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
  • https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20240913
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2743
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4283
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4472
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4612
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4660
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5435
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6389
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6446
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6678
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6685
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8124
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8311
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8631
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8635
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8640 (to CVE-2024-8641)


Tag: GitLab
Tags