
13/02/2025
GitLab releases critical security patches amid vulnerability streak
GitLab has released a new round of critical security patches for its Community Edition (CE) and Enterprise Edition (EE) products. The company strongly recommends that all self-managed GitLab installations be upgraded immediately to one of the latest versions: 17.4.2, 17.3.5, or 17.2.9.
These patch releases address several critical and high-severity vulnerabilities, including a critical flaw that could allow attackers to run pipelines on arbitrary branches. This latest security update comes in the wake of a series of critical vulnerabilities that GitLab has had to address in recent months.
Last month, GitLab patched another critical flaw (CVE-2024-6678) with a CVSS score of 9.9, which could have allowed an attacker to run pipeline jobs as an arbitrary user. Prior to that, the company also fixed three other similar high-severity vulnerabilities: CVE-2023-5009, CVE-2024-5655, and CVE-2024-6385, each with a CVSS score of 9.6.
In May, the US Cybersecurity and Infrastructure Security Agency (CISA) labelled a critical vulnerability (CVE-2023-7028) affecting GitLab as a Known Exploited Vulnerability (KEV) in response to detecting active exploitation attempts.
Most recent GitLab security patches