CVE-2024-5423: Uncontrolled Resource Consumption in GitLab
First published: Thu Aug 08 2024(Updated: )
Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which allowed an attacker to cause resource exhaustion via banzai pipeline.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=1.0<17.0.6 | |
| GitLab | >=1.0<17.0.6 | |
| GitLab | >=17.1.0<17.1.4 | |
| GitLab | >=17.1.0<17.1.4 |
Remedy
Upgrade to versions 17.2.2, 17.1.4, 17.0.6 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-5423?
CVE-2024-5423 has a high severity level due to its potential to cause denial of service through resource exhaustion.
How do I fix CVE-2024-5423?
To fix CVE-2024-5423, you should upgrade to GitLab version 17.0.6 or later, 17.1.4 or later, or 17.2.2 or later.
Which versions of GitLab are affected by CVE-2024-5423?
CVE-2024-5423 affects all GitLab versions starting from 1.0 up to 17.0.6, starting from 17.1 up to 17.1.4, and starting from 17.2 up to 17.2.2.
What kind of vulnerability is CVE-2024-5423?
CVE-2024-5423 is classified as a Denial of Service (DoS) vulnerability allowing attackers to exhaust resources.
Can CVE-2024-5423 be exploited remotely?
Yes, CVE-2024-5423 can be exploited remotely by attackers to trigger denial of service conditions.
- agent/references
- agent/weakness
- agent/author
- agent/description
- agent/type
- agent/title
- agent/severity
- agent/remedy
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/1.0
- version/gitlab/17.1.0
- version/gitlab/17.2.0