CVE-2024-5795: Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed resource exhaustion
First published: Tue Jul 16 2024(Updated: )
A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a large payload to the Git server. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise Server | >=3.9.0<3.9.17 | |
| GitHub Enterprise Server | >=3.10.0<3.10.14 | |
| GitHub Enterprise Server | >=3.11.0<3.11.12 | |
| GitHub Enterprise Server | >=3.12.0<3.12.6 | |
| GitHub Enterprise Server | =3.13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.14
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6
- https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1
Frequently Asked Questions
What is the severity of CVE-2024-5795?
CVE-2024-5795 has been classified as a Denial of Service vulnerability.
How do I fix CVE-2024-5795?
To fix CVE-2024-5795, upgrade to GitHub Enterprise Server version 3.14 or later.
Which versions are affected by CVE-2024-5795?
CVE-2024-5795 affects all versions of GitHub Enterprise Server prior to 3.14.
What type of attack does CVE-2024-5795 allow?
CVE-2024-5795 allows attackers to cause unbounded resource exhaustion by sending large payloads.
Is there a workaround for CVE-2024-5795?
There are no known workarounds for CVE-2024-5795; upgrading is the recommended solution.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/github
- canonical/github enterprise server
- version/github enterprise server/3.9.0
- version/github enterprise server/3.10.0
- version/github enterprise server/3.11.0
- version/github enterprise server/3.12.0
- version/github enterprise server/3.13.0