Skip to content
OpenAdvisories
High NCSC-2024-0329 11 CVEs

Kwetsbaarheden verholpen in GitLab Enterprise Edition en Community Edition

Published Aug 12, 2024 · Updated Aug 12, 2024 · nl

Vendor: GitLab Product: GitLab

Summary

GitLab heeft kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE).

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, of om beveiligingsmaatregelen te omzeilen en zo toegang te krijgen tot projecten waar de kwaadwillende aanvankelijk niet voor is geautoriseerd.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen in GitLab EE en CE v 17.2.2, 17.1.4 & 17.0.6. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 11

  • Medium 6.8
    CVE-2024-3035

    Authorization Bypass Through User-Controlled Key in GitLab

    A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-2800

    Uncontrolled Resource Consumption in GitLab

    ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex backtracking.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-4210

    Uncontrolled Resource Consumption in GitLab

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause a denial of service using crafted adoc fil…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-5423

    Uncontrolled Resource Consumption in GitLab

    Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which allowed an attacker to cause resource ex…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.7
    CVE-2024-6329

    Improper Encoding or Escaping of Output in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which causes the web interface to fail to render the diff correctly when the path is…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.3
    CVE-2024-3958

    Improper Control of Generation of Code ('Code Injection') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line inter…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.4
    CVE-2024-4207

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 prior 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2. When viewing an XML file in a repository in raw mode, it can be made …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.4
    CVE-2024-6356

    Incorrect User Management in GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which allowed cross project access for Security policy bot.

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2024-3114

    Uncontrolled Resource Consumption in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regular expression DoS attack on the server.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.2
    CVE-2024-4784

    Authentication Bypass by Primary Weakness in GitLab

    An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the password re-entry requirement to approve a policy.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.1
    CVE-2024-7586

    Insertion of Sensitive Information into Log File in GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #0

    Initiele versie

References