Skip to content

GitLab Critical Security Update - 20240426002

Overview

GitLab released versions 16.11.1, 16.10.4, 16.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE) to address multiple High and Medium vulnerabilities. GitLab strongly recommends that all GitLab installations be upgraded to one of these versions. GitLab.com is already running the patched version.

What is vulnerable?

CVE Severity CVSS Product(s) Affected Summary Dated
CVE-2024-4024 High 7.3 versions before 16.11.1, 16.10.4, 16.9.6 An attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab. 25 April 2024
CVE-2024-1347 Medium 4.3 versions before 16.11.1, 16.10.4, 16.9.6 An attacker, through a crafted email address, may be able to bypass domain based restrictions on an instance or a group. 25 April 2024
CVE-2024-2829 High 7.5 versions before 16.11.1, 16.10.4, 16.9.6 A crafted wildcard filter in FileFinder may lead to a denial of service. 25 April 2024

What has been observed?

There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.

Recommendation

The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of one month... (refer Patch Management):

  • https://about.gitlab.com/releases/2024/04/24/patch-release-gitlab-16-11-1-released/

Additional References