CVE-2024-1736: Uncontrolled Resource Consumption in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's CI/CD pipeline editor could allow for denial of service attacks through maliciously crafted configuration files.
Other sources
An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab’s CI/CD pipeline editor could allow for denial of service attacks through maliciously crafted configuration files. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2024-1736.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.11.4Fixed in 17.0.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.10.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.11.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.2
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-1736?
CVE-2024-1736 is rated as a high-severity vulnerability due to its potential for denial of service attacks.
How do I fix CVE-2024-1736?
To mitigate CVE-2024-1736, upgrade GitLab to version 16.10.7 or newer, or to versions 16.11.4 and 17.0.2 or newer.
What software is affected by CVE-2024-1736?
CVE-2024-1736 affects all versions of GitLab CE/EE prior to 16.10.7, starting from 16.11 up to 16.11.4, and from 17.0 up to 17.0.2.
What type of attacks can CVE-2024-1736 enable?
CVE-2024-1736 can enable denial of service attacks through exploitation of a vulnerability in GitLab's CI/CD pipeline editor.
How can organizations protect against CVE-2024-1736?
Organizations can protect against CVE-2024-1736 by implementing security best practices and updating to the recommended GitLab versions.