Our news and updates

In GitLab CE/EE versions 8.16 to 17.2.8, 17.3.0 to 17.3.4, and 17.4.0 to 17.4.1 a medium severity vulnerability CVE-2024-9623 was detected. This vulnerability allows attackers to use deploy keys to push to an archived repository. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-9623.

In Keycloak version before 24.0.5 a high severity vulnerability CVE-2024-3656 was detected. This vulnerability allows low-privilege users to access administrative functionalities via certain endpoints in the admin REST API, potentially leading to data breaches or system compromise. To fix this issue, users should upgrade Keycloak to versions 24.0.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-3656.

In SonarQube versions before 9.9.5 LTA and 10.x before 10.5 a high severity vulnerability CVE-2024-47910 was detected. A SonarQube user with Administrator privileges can modify a GitHub integration configuration to exfiltrate a pre-signed JWT, posing a security risk. To fix this problem, users should upgrade to version 9.9.5 LTA or later and 10.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-47910.

In OpenShift versions using Buildah a medium severity vulnerability CVE-2024-9675 was detected. This vulnerability lets attackers choose paths outside the cache directory, allowing a `RUN` instruction in a Container file to mount any accessible directory from the host (with read/write permissions) into the container. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-9675.

In PHP versions 8.1 to 8.1.30, 8.2 to 8.2.24, and 8.3 to 8.3.12 a high severity vulnerability related to command injection CVE-2024-8926 was detected. This vulnerability allows attackers to exploit certain non-standard configurations of Windows codepages, potentially enabling them to pass options to the PHP binary being executed. This may result in revealing the source code of scripts or running arbitrary PHP code on the server. To fix this issue, users must upgrade to 8.1.30, 8.2.24, or 8.3.12 versions. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-8926.

In Discourse version stable < 3.3.2, tests-passed < 3.4.0.beta2 a high severity vulnerability CVE-2024-47773 was detected. This vulnerability allows attackers to poison the cache with empty responses through repeated XHR requests, affecting anonymous visitors. It has been patched, and users should upgrade or disable the anonymous cache by setting DISCOURSE_DISABLE_ANON_CACHE. To fix this problem, users should upgrade to version stable >= 3.3.2, tests-passed >= 3.4.0.beta2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-47773.

In GitLab versions starting from 8.16 up to 17.2.8, versions 17.3 prior to 17.3.5, and versions 17.4 prior to 17.4.2 a medium severity vulnerability related to deploy keys CVE-2024-9623 was detected. This vulnerability allows attackers to push code to an archived repository, potentially leading to unauthorized changes or data breaches. To fix this issue, users should upgrade GitLab to versions 17.2.9, 17.3.5, or 17.4.2. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-9623.

In Redis versions prior to 7.2.6 and 7.4.1 a medium severity vulnerability CVE-2024-31227 was detected. An authenticated user with sufficient privileges can create a malformed ACL selector in Redis, triggering a server panic and causing a denial of service. To fix this problem, users should upgrade to versions 7.2.6 and 7.4.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-31227.

In Redis versions prior to 6.2.16, 7.2.6 and 7.4.1 a medium severity vulnerability CVE-2024-31228 was detected. Authenticated users can trigger a denial-of-service in Redis by using specially crafted long string match patterns on certain commands, leading to stack overflow and a process crash. To fix this problem, users should upgrade to versions 6.2.16, 7.2.6 and 7.4.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-31228.