MEDIUM

CVE-2024-1495

Gitlab GitLab 2024-06-12 CVSS v3.1

CVSS

6.5

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. It was possible for an attacker to cause a denial of service using maliciously crafted file.

Summary dbcve.org

A denial of service vulnerability exists in GitLab CE/EE where processing a maliciously crafted file can cause the application to become unresponsive or crash. The issue affects file parsing/processing functionality across multiple GitLab versions.

Mitigation

Upgrade GitLab to version 16.10.7, 16.11.4, or 17.0.2 or later to patch the vulnerability. If immediate upgrade is not possible, restrict or validate file uploads from untrusted sources.

Weakness (CWE)

CWE-1333

EPSS Score

0.58%

Probability of exploitation in next 30 days

46.2th percentile

References

https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#redos-in-gomod-dependency-linker Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/441807 Vendor Advisory https://hackerone.com/reports/2359528 Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE