This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE/EE fixes 9 vulnerabilities
GitLab versions 17.9.2, 17.8.5 and 17.7.7 fix 9 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe ones are described below; the remaining vulnerabilities can be found at [1].
Due to vulnerabilities in the ruby-saml library, an unauthenticated remote attacker with access to a valid SAML document from the identity provider can, under certain conditions, authenticate as another user on GitLab CE/EE instances using SAML authentication. If an immediate update to the fixed version is not possible, the risk can be temporarily mitigated following the procedure at [1].
The vulnerability is present in products:
- *:GitLab Community Edition;>=17.7,<17.7.7;>=17.8,<17.8.5;>=17.9,<17.9.2;
- *:GitLab Enterprise Edition;>=17.7,<17.7.7;>=17.8,<17.8.5;>=17.9,<17.9.2;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
More information:
- CVE-2025-25291 at cve.org, NVD
- CVE-2025-25292 at cve.org, NVD
- CWE-436: Interpretation Conflict at cwe.mitre.org
- CWE-347: Improper Verification of Cryptographic Signature at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
Due to a vulnerability in the graphql library in GitLab CE/EE, an unauthenticated remote attacker can, under certain conditions, execute code through the Direct Transfer functionality (disabled by default) [1]. If an immediate update to the fixed version is not possible, the risk can be mitigated by disabling this functionality.
The vulnerability is present in products:
- *:GitLab Community Edition;>=17.7,<17.7.7;>=17.8,<17.8.5;>=17.9,<17.9.2;
- *:GitLab Enterprise Edition;>=17.7,<17.7.7;>=17.8,<17.8.5;>=17.9,<17.9.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2025-27407 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
An unauthenticated remote attacker can perform a DoS attack in GitLab EE by manipulating specific API inputs [1].
The vulnerability is present in product:
- *:GitLab Enterprise Edition;>=12.3,<17.7.7;>=17.8,<17.8.5;>=17.9,<17.9.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
More information:
- CVE-2025-1257 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 13. 3. 2025.
Under certain conditions, an authenticated remote attacker can perform a DoS attack in GitLab CE/EE [1].
The vulnerability is present in products:
- *:GitLab Community Edition;<17.7.7;>=17.8,<17.8.5;>=17.9,<17.9.2;
- *:GitLab Enterprise Edition;<17.7.7;>=17.8,<17.8.5;>=17.9,<17.9.2;
CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-13054 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 13. 3. 2025.
An authenticated remote attacker can improperly disclose credentials through specific user inputs during repository mirroring [1].
The vulnerability is present in products:
- *:GitLab Community Edition;>=11.5,<17.7.7;>=17.8,<17.8.5;>=17.9,<17.9.2;
- *:GitLab Enterprise Edition;>=11.5,<17.7.7;>=17.8,<17.8.5;>=17.9,<17.9.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-12380 at cve.org, NVD
- CWE-209: Generation of Error Message Containing Sensitive Information at cwe.mitre.org
The vulnerability was publicly disclosed 13. 3. 2025.
By CESNET, z.s.p.o. Michaela Ručková on 13. 3. 2025.