GitLab Releases Patch for Critical CI/CD Pipeline Vulnerability and 13 Others

GitLab has unveiled security updates to address 14 security flaws, like 1 critical vulnerability that could be exploited to run ongoing integration and steady deployment (CI/CD) pipelines as any person.

The weaknesses, which have an impact on GitLab Group Edition (CE) and Business Version (EE), have been dealt with in versions 17.1.1, 17..3, and 16.11.5.

The most critical of the vulnerabilities is CVE-2024-5655 (CVSS rating: 9.6), which could permit a malicious actor to result in a pipeline as a further consumer under specific conditions.

It impacts the adhering to variations of CE and EE –

• 17.1 prior to 17.1.1
• 17. prior to 17..3, and
• 15.8 prior to 16.11.5

GitLab reported the resolve introduces two breaking variations as a final result of which GraphQL authentication utilizing CI_Position_TOKEN is disabled by default and pipelines will no for a longer time operate immediately when a merge ask for is re-targeted immediately after its prior goal department is merged.

Some of the other essential flaws fastened as element of the most up-to-date release are mentioned below –

• CVE-2024-4901 (CVSS rating: 8.7) – A saved XSS vulnerability could be imported from a task with malicious commit notes

• CVE-2024-4994 (CVSS score: 8.1) – A CSRF attack on GitLab’s GraphQL API primary to the execution of arbitrary GraphQL mutations

• CVE-2024-6323 (CVSS score: 7.5) – An authorization flaw in the world lookup feature that enables for leakage of delicate information and facts from a non-public repository within a general public task

• CVE-2024-2177 (CVSS rating: 6.8) – A cross window forgery vulnerability that enables an attacker to abuse the OAuth authentication circulation by using a crafted payload

Though there is no evidence of lively exploitation of the flaws, users are advisable to use the patches to mitigate towards probable threats.

Identified this article appealing? Comply with us on Twitter  and LinkedIn to examine more special information we publish.

Some parts of this article are sourced from:
thehackernews.com