CVE-2024-5469: Uncontrolled Resource Consumption in GitLab
DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.10.6Fixed in 16.11.3 - Upgrade
Upgrade
GitLab CE/EE (KAS)to a version that resolves this vulnerability.Fixed in 16.10.6 - Upgrade
Upgrade
GitLab CE/EE (KAS)to a version that resolves this vulnerability.Fixed in 16.11.3
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-5469?
CVE-2024-5469 is a denial-of-service vulnerability that can allow an attacker to crash the Kubernetes Agent Server (KAS) in GitLab.
How do I fix CVE-2024-5469?
To fix CVE-2024-5469, upgrade GitLab to version 16.10.6 or later, or 16.11.3 or later.
Which versions of GitLab are affected by CVE-2024-5469?
CVE-2024-5469 affects all GitLab versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3.
What type of attack does CVE-2024-5469 involve?
CVE-2024-5469 involves a denial-of-service attack through crafted gRPC requests.
Can CVE-2024-5469 be exploited remotely?
Yes, CVE-2024-5469 can be exploited remotely by sending specifically crafted gRPC requests to the affected GitLab servers.