Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-1963
CVE-2024-1963:
GitLab vulnerability analysis and mitigation
Overview
A vulnerability (CVE-2024-1963) was discovered in GitLab CE/EE affecting all versions from 8.4 prior to 16.10.7, from 16.11 prior to 16.11.4, and from 17.0 prior to 17.0.2. The vulnerability exists in GitLab's Asana integration, where an attacker could potentially cause a regular expression denial of service (ReDoS) by sending specially crafted requests (GitLab Release).
Technical details
The vulnerability is related to a regular expression pattern used for checking issue references in data parsed during webhook calls in the Asana integration. The vulnerable regex pattern is located in app/models/integrations/asana.rb. The issue is triggered when processing commit messages or testing webhooks, where specially crafted input containing repeated patterns (such as repeated '#' characters) can cause catastrophic backtracking in the regular expression engine (GitLab Issue). The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).
Impact
The vulnerability can lead to denial of service of the GitLab instance through exhaustive resource consumption. When exploited, it can make the server unresponsive, particularly affecting the system's CPU usage. For a 1K reference architecture, an attack using 6 projects can send one request every second, which is sufficient to make the architecture unresponsive (GitLab Issue).
Mitigation and workarounds
The vulnerability has been patched in GitLab versions 16.10.7, 16.11.4, and 17.0.2. Organizations are strongly recommended to upgrade to these or later versions immediately. GitLab.com is already running the patched version (GitLab Release).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management