GitLab releases patches to multiple flaws, including critical - patch ASAP
Take action: If you are running GitLab Enterprise, plan a quick patch. All flaws require certain preconditions to be exploited, so it's not immediately hacked. But it will be very soon, so don't delay.
Learn More
GitLab has released a critical security update that addresses several vulnerabilities, including four critical and high-severity flaws tracked as CVE-2024-6678, CVE-2024-8640, CVE-2024-8635, and CVE-2024-8124. GitLab urges all installations running affected versions to upgrade to the latest patched releases (17.3.2, 17.2.5, and 17.1.7) immediately to mitigate potential security risks.
Critical and High-Severity Vulnerabilities
-
CVE-2024-6678 (CVSS score 9.6) - Allows an attacker to trigger a pipeline as another user under certain circumstances.
- Affected Versions: GitLab CE/EE versions starting from 8.14 up to 17.1.6, 17.2.4, and 17.3.1.
-
CVE-2024-8640 (CVSS score 8.5) - Due to incomplete input filtering, it was possible to inject commands into a connected Cube server in GitLab EE.
- Affected Versions: GitLab EE versions starting from 16.11 up to 17.1.6, 17.2.4, and 17.3.1.
-
CVE-2024-8635 (High, CVSS score 7.7) - A Server-Side Request Forgery (SSRF) vulnerability in GitLab EE could allow an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL.
- Affected Versions: GitLab EE versions starting from 16.8 up to 17.1.6, 17.2.4, and 17.3.1.
-
CVE-2024-8124 (High, CVSS score 7.5) - A Denial-of-Service (DoS) vulnerability could be triggered by sending a large glm_source parameter.
- Affected Versions: GitLab CE/EE versions starting from 16.4 up to 17.1.6, 17.2.4, and 17.3.1.
Additional medium and low-severity vulnerabilities were also patched, including issues related to unauthorized access, privilege escalation, command injection, open redirect vulnerabilities, and potential exposure of sensitive data. These vulnerabilities could potentially allow attackers to manipulate code, exfiltrate private information, and compromise critical infrastructure components.
GitLab recommends upgrading all self-managed installations to the latest patched versions: 17.3.2, 17.2.5, or 17.1.7. GitLab.com users don't need to take action - the platform is already running the patched versions; no action is needed.
Organizations using GitLab should:
- Regularly monitor for security updates and apply patches promptly.
- Implement multi-factor authentication (MFA) to enhance account security.
