GitLab Product Security Update Advisory

Overview

An update has been released to address vulnerability in our GitLab products. Users of affected versions are advised to update to the latest version.

Affected Products

CVE-2024-5655

  • GitLab CE/EE versions: 15.8 (inclusive) ~ 16.11.5 (excluded)
  • GitLab CE/EE versions: 17.0 (inclusive) ~ 17.0.3 (excluded)
  • GitLab CE/EE versions: 17.1 (inclusive) ~ 17.1.1 (excluded)

 

CVE-2024-4901

  • GitLab CE/EE versions: 16.9 (inclusive) ~ 16.11.5 (excluded)
  • GitLab CE/EE versions: 17.0 (inclusive) ~ 17.0.3 (excluded)
  • GitLab CE/EE versions: 17.1 (inclusive) ~ 17.1.1 (excluded)

 

CVE-2024-6323

  • GitLab CE/EE versions: 16.11 (inclusive) ~ 16.11.5 (excluded)
  • GitLab CE/EE versions: 17.0 (inclusive) ~ 17.0.3 (excluded)
  • GitLab CE/EE versions: 17.1 (inclusive) ~ 17.1.1 (excluded)

 

Resolved Vulnerabilities

Vulnerability in GitLab CE/EE that could allow an attacker to trigger a pipeline to a different version (CVE-2024-5655)
Vulnerability in GitLab’s GraphQL API to execute arbitrary GraphQL variants in GitLab CE/EE (CVE-2024-4901)
Vulnerability in GitLab CE/EE due to improper authentication for global searches in GitLab EE, which could allow an attacker to exfiltrate private repository content in public projects (CVE-2024-6323)

 

Vulnerability Patches

vulnerability patches have been made available in the latest updates. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.

 

Cve-2024-5655, cve-2024-4901, cve-2024-6323

  • GitLab CE/EE version 16.11.5
  • GitLab CE/EE 17.0.3
  • GitLab CE/EE 17.1.1

Referenced Sites

[1] CVE-2024-5655 Detail

https://nvd.nist.gov/vuln/detail/CVE-2024-5655

[2] CVE-2024-4901 Detail

https://nvd.nist.gov/vuln/detail/CVE-2024-4901

[3] CVE-2024-6323 Detail

https://nvd.nist.gov/vuln/detail/CVE-2024-6323

[4] GitLab Critical Patch Release: 17.1.1, 17.0.3, 16.11.5

https://about.gitlab.com/releases/2024/06/26/patch-release-gitlab-17-1-1-released/