Threat intel
Critical GitLab Flaw (CVSS 10.0) Allows Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a maximum-severity flaw (CVSS 10.0) that allows unauthenticated remote code execution on self-managed servers and affects every release since version 7.0 in 2014, The Hacker News reports. Administrators who applied the October 12 patch may still need to update again.
GitLab has released fixes for a critical vulnerability that could allow an attacker to run code on a self-managed GitLab server without logging in, according to The Hacker News.
The flaw carries the maximum possible CVSS severity score of 10.0. Its reach is unusually broad: every version of GitLab going back to version 7.0, released in 2014, is affected — roughly twelve years of releases.
GitLab shipped the fixes on October 21. The report notes that the update matters even for administrators who had patched their systems only nine days earlier. A previous update, released on October 12, covered only versions 19.2 and later, and the newly fixed versions sit one patch above that earlier release. Because of this, administrators who applied only the October 12 patch may still need to update again in order to be protected.
Self-managed GitLab instances typically sit at the heart of an organization's software development workflow, storing source code and running automated build and deployment pipelines. An unauthenticated remote code execution flaw on such a system could give attackers a direct foothold inside sensitive development infrastructure.
Administrators running self-managed GitLab instances should verify which version they are on and apply the October 21 fixes where possible. All details about the flaw, the affected versions and the patch timeline come from The Hacker News.
Source: The Hacker News
