Authentication Bypass by Assumed-Immutable Data in GitLab(CVE-2024-4024)

概要

Authentication Bypass by Assumed-Immutable Data in GitLab

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"7.8.0"},{"fixed":"16.9.6"},{"introduced":"16.10.0"},{"fixed":"16.10.4"},{"introduced":"16.11.0"},{"fixed":"16.11.1"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Ubuntu UBUNTU-CVE-2024-4024 gitlab

参照URL

report gitlab.com
web nvd.nist.gov