GitLab Security Update, Patch for Critical Vulnerabilities

GitLab announced the release of critical security patches for its Community Edition (CE) and Enterprise Edition (EE).

The newly released versions 17.6.2, 17.5.4, and 17.4.6 address several high-severity vulnerabilities, and GitLab strongly recommends that all self-managed installations be upgraded immediately.

It is worth noting that GitLab.com is already running the patched version, while GitLab-dedicated customers do not need to take any action.

GitLab employs a dual approach to patch releases, offering scheduled updates twice a month, alongside ad-hoc patches for critical issues.

The company emphasizes the importance of maintaining the highest security standards for all aspects of GitLab’s software, especially those handling customer data.

By upgrading to the latest patch releases, users can ensure optimal security for their GitLab instances.

2024 MITRE ATT&CK Evaluation Results for SMEs & MSPs -> Download Free Guide

Injection of Network Error Logging (NEL) Headers – CVE-2024-11274

One of the critical issues addressed in the new updates is the injection of Network Error Logging (NEL) headers in Kubernetes proxy responses.

This vulnerability affects all versions of GitLab CE/EE from 16.1 to 17.4.6, 17.5 to 17.5.4, and 17.6 to 17.6.2. Identified as CVE-2024-11274, this vulnerability could lead to session data exfiltration by abusing OAuth flows, posing a significant security risk.

The issue has been resolved in the latest release, and GitLab attributes the discovery of this vulnerability to a report by “joaxcar” via their HackerOne bug bounty program.

Denial of Service via Unauthenticated Requests – CVE-2024-8233

Another serious vulnerability addressed is a Denial of Service (DoS) attack vector that could be exploited by sending unauthenticated requests for diff files on a commit or merge request.

This vulnerability impacts all versions of GitLab CE/EE from 9.4 to 17.4.6, 17.5 to 17.5.4, and 17.6 to 17.6.2. Designated as CVE-2024-8233, this issue could allow an attacker to disrupt services significantly. It has now been mitigated in the latest patch release.

GitLab’s commitment to security is underscored by its transparent approach to handling vulnerabilities.

The company publishes detailed information about vulnerabilities on its issue tracker 30 days post-patch, allowing users to stay informed and secure.

For those seeking to bolster their GitLab environment’s security, GitLab provides additional resources and best practices through its blog.

GitLab’s latest patch release addresses critical security flaws, and users are urged to upgrade as soon as possible to ensure system integrity.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free