CVE-2024-0410: Bypassing approvals of CODEOWNERS
An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.7.6Fixed in 16.8.3Fixed in 16.9.1 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.9.1 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.8.3 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.7.6
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-0410?
The severity of CVE-2024-0410 is considered to be high due to its potential to bypass authorization checks.
How do I fix CVE-2024-0410?
To fix CVE-2024-0410, upgrade your GitLab installation to version 16.7.6, 16.8.3, or 16.9.1 or later.
Who is affected by CVE-2024-0410?
CVE-2024-0410 affects GitLab versions from 15.1 up to 16.7.6, 16.8 up to 16.8.3, and version 16.9.0.
What types of attacks can CVE-2024-0410 enable?
CVE-2024-0410 can enable unauthorized code changes by allowing developers to bypass CODEOWNERS approvals.
Is there a workaround for CVE-2024-0410?
No official workaround is recommended for CVE-2024-0410; the best action is to upgrade to a fixed version.