CVE-2024-6595: Uncontrolled Search Path Element in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.11.6Fixed in 17.0.4Fixed in 17.1.2 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.11.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 17.0.4 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 17.1.2
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-6595?
CVE-2024-6595 has been classified as a moderate severity vulnerability.
How do I fix CVE-2024-6595?
To fix CVE-2024-6595, upgrade GitLab to version 16.11.6, 17.0.4, or 17.1.2 or later.
What versions of GitLab are affected by CVE-2024-6595?
CVE-2024-6595 affects all GitLab CE and EE versions from 11.8 prior to 16.11.6, from 17.0 prior to 17.0.4, and from 17.1 prior to 17.1.2.
What type of vulnerability is CVE-2024-6595?
CVE-2024-6595 is a vulnerability that allows the upload of an NPM package with conflicting package data.
Is CVE-2024-6595 present in GitLab's community and enterprise editions?
Yes, CVE-2024-6595 affects both community and enterprise editions of GitLab.