House › Endpoint Safety

GitLab Patches Important Distant Code Execution Vulnerability

By Ionut Arghire on August 23, 2022

Tweet

DevOps platform GitLab has issued patches for a vital distant code execution vulnerability impacting its GitLab Group Version (CE) and Enterprise Version (EE) releases.

Tracked as CVE-2022-2884 (CVSS 9.9/10 severity), the safety flaw might be exploited through the GitHub import API, however requires authentication to be triggered.

“A vulnerability in GitLab CE/EE affecting all variations ranging from 11.3.four earlier than 15.1.5, all variations ranging from 15.2 earlier than 15.2.3, all variations ranging from 15.Three earlier than 15.3.1 permits an authenticated person to attain distant code execution through the Import from GitHub API endpoint,” GitLab mentioned in an advisory.

“We strongly advocate that every one installations working a model affected by the problems described are upgraded to the most recent model as quickly as doable,” the corporate added.

[ READ: Researchers Spot Provide Chain Assault Concentrating on GitLab CI Pipelines ]

For these unable to replace their GitLab installations instantly, the corporate recommends disabling the GitHub import perform from the ‘Visibility and entry controls’ tab within the Settings menu (utilizing an administrator account).

GitLab Group Version and Enterprise Version variations 15.3.1, 15.2.3, and 15.1.5 include patches for this vulnerability.

GitLab made no point out of this vulnerability being exploited in in-the-wild assaults.

GitLab 15.Three additionally packs further safety enhancements, comparable to the choice to outline password complexity necessities alongside minimal password size, the flexibility so as to add approval guidelines for all protected branches, and safe defaults for brand spanking new entry tokens.

Associated: Important Account Takeover Vulnerability Patched in GitLab Enterprise Version

Associated: Researchers Spot Provide Chain Assault Concentrating on GitLab CI Pipelines

Associated: GitLab Patches Important Account Takeover Vulnerability

Get the Day by day Briefing

• Most Latest
• Most Learn

• GitLab Patches Important Distant Code Execution Vulnerability
• Ransomware Gang Leaks Information Allegedly Stolen From Greek Fuel Provider
• Backdoors Discovered on Counterfeit Android Telephones
• Ex-Safety Chief Accuses Twitter of Hiding Main Flaws
• LockBit Ransomware Website Hit by DDoS Assault as Hackers Begin Leaking Entrust Information
• Information on California Prisons’ Guests, Workers, Inmates Uncovered
• ‘DirtyCred’ Vulnerability Haunting Linux Kernel for eight Years
• Safety Agency Discloses CrowdStrike Problem After ‘Ridiculous Disclosure Course of’
• Novant Well being Says Malformed Monitoring Pixel Uncovered Well being Information to Meta
• Pretend DDoS Safety Prompts on Hacked WordPress Websites Ship RATs

In search of Malware in All of the Mistaken Locations?

First Step For The Web’s subsequent 25 years: Including Safety to the DNS

Tattle Story: What Your Pc Says About You

Be in a Place to Act By Cyber Situational Consciousness

Report Reveals Closely Regulated Industries Letting Social Networking Apps Run Rampant

2010, A Nice Yr To Be a Scammer.

Do not Let DNS be Your Single Level of Failure

Learn how to Determine Malware in a Blink

Defining and Debating Cyber Warfare

The 5 A’s that Make Cybercrime so Engaging

Learn how to Defend In opposition to DDoS Assaults

Safety Budgets Not in Line with Threats

Anycast – Three Causes Why Your DNS Community Ought to Use It

The Evolution of the Prolonged Enterprise: Safety Methods for Ahead Pondering Organizations

Utilizing DNS Throughout the Prolonged Enterprise: It’s Dangerous Enterprise

Orbit Brain

http://orbitbrain.com/

Orbit Brain is the senior science writer and technology expert. Our aim provides the best information about technology and web development designing SEO graphics designing video animation tutorials and how to use software easy ways
and much more. Like Best Service Latest Technology, Information Technology, Personal Tech Blogs, Technology Blog Topics, Technology Blogs For Students, Futurism Blog.