This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE/EE fixes 10 vulnerabilities
GitLab versions 18.0.1, 17.11.3 and 17.10.7 fix 10 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe of them are described below; the remaining vulnerabilities can be found at [1].
An unauthenticated remote attacker can cause a DoS attack by exhausting server resources due to an unprotected endpoint for large blobs [1].
The vulnerability is present in product:
- GitLab; >=17.10.0, <17.10.7; >=17.11.0, <17.11.3; >=18.0.0, <18.0.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-0993 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 21. 5. 2025.
An authenticated remote attacker can, under specific conditions and due to incorrect validation of XPath expressions when processing SAML responses, bypass the two-factor authentication requirement [1].
The vulnerability is present in product:
- GitLab; >=11.1.0, <17.10.7; >=17.11.0, <17.11.3; >=18.0.0, <18.0.1
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2024-12093 at cve.org, NVD
- CWE-1288: Improper Validation of Consistency within Input at cwe.mitre.org
The vulnerability was publicly disclosed 21. 5. 2025.
An authenticated remote attacker can perform a DoS attack due to insufficient handling in the Discord webhook integration [1].
The vulnerability is present in product:
- GitLab; >=11.6.0, <17.10.7; >=17.11.0, <17.11.3; >=18.0.0, <18.0.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-7803 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 21. 5. 2025.
An authenticated remote attacker can perform a DoS attack due to insufficient input validation in the Kubernetes integration [1].
The vulnerability is present in product:
- GitLab; >=10.2.0, <17.10.7; >=17.11.0, <17.11.3; >=18.0.0, <18.0.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-3111 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 21. 5. 2025.
An authenticated remote attacker can perform a DoS attack due to insufficient validation of note position [1].
The vulnerability is present in product:
- GitLab; <17.10.7; >=17.11.0, <17.11.3; >=18.0.0, <18.0.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-2853 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 21. 5. 2025.
By CESNET, z.s.p.o. Michaela Jarošová on 23. 5. 2025.