HighCVE
Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
BleepingComputer·Source published ·1 min read
What happened?
Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks. [...]
Key details
- Over one thousand internet-exposed GitLab servers remain unpatched against a maximum-severity vulnerability.
- The flaw is an integer overflow in the CI/CD Regular Expression Compiler that parses pipeline configuration files.
- An unauthenticated attacker can execute arbitrary code via a crafted regular expression in CI/CD configuration.
- CISA confirmed active exploitation and added the vulnerability to its Known Exploited Vulnerabilities Catalog.
- Federal agencies were ordered to secure their servers by Sunday following the CISA directive.
- Since November 2021, CISA has added six GitLab flaws to its actively exploited vulnerabilities catalog.
Affected
- GitLab Community Edition and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8 are the patched releases; earlier versions are vulnerable.
Fixes and mitigations
- Upgrade self-managed GitLab installations to versions 19.4.2, 19.3.5, or 19.2.8 immediately.
- GitLab.com is already running the patched version and Dedicated customers do not need to take action.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.