Developer Tools

In GitLab versions from 16.8 before 17.1.7, from 17.2 before 17.2.5, and from 17.3 before 17.3.2 a high severity vulnerability CVE-2024-8635 was detected. This vulnerability allows attackers to make unauthorized requests to internal resources using a custom Maven Dependency Proxy URL. To address this issue, upgrade to GitLab version 17.1.7 or later, 17.2.5 or later, or 17.3.2 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-8635.

In GitLab EE versions 16.6 to 17.1.7, 17.2 to 17.2.5, and 17.3 to 17.3.2 a high severity vulnerability CVE-2024-8631 was detected. This vulnerability allows users with the Admin Group Member custom role to escalate their privileges to include other custom roles. To address this issue, users should upgrade to GitLab EE to version 17.1.7, 17.2.5, or 17.3.2. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-8631.

In GitLab versions 15.6 to 17.0.5, 17.1 to 17.1.3, and 17.2 to 17.2.1 a medium severity vulnerability CVE-2024-7091 was detected. This vulnerability allows attackers to disclose limited information of an exported group or project to another user. To address this issue, upgrading to the latest version of GitLab is recommended. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7091.

In OpenShift environments using Aardvark-dns versions 1.12.0 and 1.12.1 a high severity vulnerability CVE-2024-8418 was detected. This vulnerability allows attackers to exploit serial processing of TCP DNS queries, causing a denial of service. Malicious clients can keep a TCP connection open indefinitely, leading to timeouts for other DNS queries and disrupting service for all containers using Aardvark-dns. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8418.

In OpenShift AI versions before 2.9 a high severity vulnerability CVE-2024-7557 was detected. This allows attackers to bypass authentication and escalate privileges, gaining unauthorized access to other AI models and APIs within the same namespace by exploiting exposed ServiceAccount tokens. To fix this problem, users should upgrade OpenShift AI to version 2.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-7557.

In OpenShift versions from 2.6.7 through 2.8.13 a high severity vulnerability CVE-2024-6508 was detected. A flaw in the OpenShift Console’s OAuth2 protocol can allow Cross-Site Request Forgery (CSRF) attacks due to improper use of the state parameter, enabling unauthorized access to accounts. The attack requires initiation from within the local network and no exploit is available. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-6508.

In GitLab versions from 8.2 prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 a medium severity vulnerability CVE-2024-6502 was detected. This vulnerability allows attackers to create a branch with the same name as a deleted tag. To fix this problem, users should upgrade GitLab to versions 17.1.6, 17.2.4, or 17.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-6502.

In GitLab versions starting from 12.5 before 17.1.6, versions starting from 17.2 before 17.2.4, and versions starting from 17.3 before 17.3.1 a medium severity vulnerability CVE-2024-3127 was detected. Under certain conditions, unauthorized users might be able to bypass IP restrictions for groups via GraphQL and perform some group-level actions. To fix this problem, users should upgrade to version 17.1.6, 17.2.4, 17.3.1, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-3127.

In GitLab versions before 17.1.6, 17.2.4, and 17.3.1 a medium severity vulnerability CVE-2024-8041 was detected. A DoS vulnerability can disrupt the service by importing a malicious repository through the GitHub importer. To fix this problem, users should upgrade to version 17.1.6, 17.2.4, 17.3.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8041.