Skip to content
OpenAdvisories
High NCSC-2024-0258 5 CVEs

Kwetsbaarheden verholpen in GitLab Enterprise Edition en Community Edition

Published Jun 14, 2024 · Updated Jun 14, 2024 · nl

Vendor: GitLab Product: GitLab

Summary

GitLab heeft kwetsbaarheden verholpen in GitLab Enterprise Edition (EE) en Community Edition (CE).

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, of om een Cross-Site-Scripting-aanval uit te voeren. Een dergelijke aanval kan leiden tot uitvoer van willekeurige code in de browser van het slachtoffer, of toegang tot gevoelige gegevens in de context van de browser van het slachtoffer.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 5

  • Medium 6.5
    CVE-2024-1495

    Uncontrolled Resource Consumption in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. It was possible for an attacker to cause a denial of service using malicious…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-1736

    Uncontrolled Resource Consumption in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's CI/CD pipeline editor could allow for denial of service attacks thr…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-1963

    Uncontrolled Resource Consumption in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's Asana integration allowed an attacker to potentia…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.4
    CVE-2024-4201

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in ra…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.1
    CVE-2024-5469

    Uncontrolled Resource Consumption in GitLab

    DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests.

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #0

    Initiele versie

References

  • Reference - ncscclear
    https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/