Refine your search

33 vulnerabilities found for GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) by GitLab

CERTFR-2025-AVI-0853
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.4.x antérieures à 18.4.2
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.3.x antérieures à 18.3.4
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x antérieures à 18.2.8
References
Bulletin de sécurité GitLab 2025-10-08 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.4.x ant\u00e9rieures \u00e0 18.4.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.3.x ant\u00e9rieures \u00e0 18.3.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x ant\u00e9rieures \u00e0 18.2.8",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-9825",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-9825"
    },
    {
      "name": "CVE-2025-11340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-11340"
    },
    {
      "name": "CVE-2025-10004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-10004"
    },
    {
      "name": "CVE-2025-2934",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2934"
    }
  ],
  "initial_release_date": "2025-10-09T00:00:00",
  "last_revision_date": "2025-10-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0853",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-10-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/"
    }
  ]
}

CERTFR-2025-AVI-0820
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x antérieures à 18.2.7
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.4.x antérieures à 18.4.1
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.3.x antérieures à 18.3.3
References
Bulletin de sécurité GitLab 2025-09-25 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x ant\u00e9rieures \u00e0 18.2.7",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.4.x ant\u00e9rieures \u00e0 18.4.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.3.x ant\u00e9rieures \u00e0 18.3.3",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-8715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8715"
    },
    {
      "name": "CVE-2025-8014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8014"
    },
    {
      "name": "CVE-2025-10868",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-10868"
    },
    {
      "name": "CVE-2025-8713",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8713"
    },
    {
      "name": "CVE-2025-7691",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-7691"
    },
    {
      "name": "CVE-2025-9958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-9958"
    },
    {
      "name": "CVE-2025-8714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8714"
    },
    {
      "name": "CVE-2025-5069",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5069"
    },
    {
      "name": "CVE-2025-10867",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-10867"
    },
    {
      "name": "CVE-2025-10871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-10871"
    },
    {
      "name": "CVE-2025-10858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-10858"
    }
  ],
  "initial_release_date": "2025-09-26T00:00:00",
  "last_revision_date": "2025-09-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0820",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-09-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-09-25",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/09/25/patch-release-gitlab-18-4-1-released/"
    }
  ]
}

CERTFR-2025-AVI-0776
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une falsification de requêtes côté serveur (SSRF).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x antérieures à 18.2.6
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.3.x antérieures à 18.3.2
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 18.1.6
References
Bulletin de sécurité GitLab 2025-09-10 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x ant\u00e9rieures \u00e0 18.2.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.3.x ant\u00e9rieures \u00e0 18.3.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 18.1.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-6454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6454"
    },
    {
      "name": "CVE-2025-2256",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2256"
    },
    {
      "name": "CVE-2025-1250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1250"
    },
    {
      "name": "CVE-2025-10094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-10094"
    },
    {
      "name": "CVE-2025-7337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-7337"
    },
    {
      "name": "CVE-2025-6769",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6769"
    }
  ],
  "initial_release_date": "2025-09-10T00:00:00",
  "last_revision_date": "2025-09-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0776",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-09-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-09-10",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/"
    }
  ]
}

CERTFR-2025-AVI-0736
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x antérieures à 18.2.5
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.3.x antérieures à 18.3.1
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 18.1.5
References
Bulletin de sécurité GitLab 2025-08-27 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x ant\u00e9rieures \u00e0 18.2.5",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.3.x ant\u00e9rieures \u00e0 18.3.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 18.1.5",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-5101",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5101"
    },
    {
      "name": "CVE-2025-3601",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3601"
    },
    {
      "name": "CVE-2025-2246",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2246"
    },
    {
      "name": "CVE-2025-4225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4225"
    }
  ],
  "initial_release_date": "2025-08-28T00:00:00",
  "last_revision_date": "2025-08-28T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0736",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-08-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-08-27",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/08/27/patch-release-gitlab-18-3-1-released/"
    }
  ]
}

CERTFR-2025-AVI-0690
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x antérieures à 18.2.2
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.1.x antérieures à 18.1.4
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 18.0.6
References
Bulletin de sécurité GitLab 2025-08-13 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x ant\u00e9rieures \u00e0 18.2.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.1.x ant\u00e9rieures \u00e0 18.1.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 18.0.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-8094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8094"
    },
    {
      "name": "CVE-2025-8770",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8770"
    },
    {
      "name": "CVE-2025-2937",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2937"
    },
    {
      "name": "CVE-2025-6186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6186"
    },
    {
      "name": "CVE-2025-7739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-7739"
    },
    {
      "name": "CVE-2025-5819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5819"
    },
    {
      "name": "CVE-2025-2614",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2614"
    },
    {
      "name": "CVE-2025-1477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1477"
    },
    {
      "name": "CVE-2024-12303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-12303"
    },
    {
      "name": "CVE-2025-7734",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-7734"
    },
    {
      "name": "CVE-2024-10219",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-10219"
    },
    {
      "name": "CVE-2025-2498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2498"
    }
  ],
  "initial_release_date": "2025-08-13T00:00:00",
  "last_revision_date": "2025-08-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0690",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-08-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/08/13/patch-release-gitlab-18-2-2-released/"
    }
  ]
}

CERTFR-2025-AVI-0619
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x antérieures à 18.2.1
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 18.0.5
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.1.x antérieures à 18.1.3
References
Bulletin de sécurité GitLab 2025-07-23 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.2.x ant\u00e9rieures \u00e0 18.2.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 18.0.5",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.1.x ant\u00e9rieures \u00e0 18.1.3",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-1299",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1299"
    },
    {
      "name": "CVE-2025-4976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4976"
    },
    {
      "name": "CVE-2025-4439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4439"
    },
    {
      "name": "CVE-2025-0765",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0765"
    },
    {
      "name": "CVE-2025-4700",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4700"
    },
    {
      "name": "CVE-2025-7001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-7001"
    }
  ],
  "initial_release_date": "2025-07-24T00:00:00",
  "last_revision_date": "2025-07-24T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0619",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-07-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-07-23",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/07/23/patch-release-gitlab-18-2-1-released/"
    }
  ]
}

CERTFR-2025-AVI-0581
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.0.x antérieures à 18.0.4
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 17.11.6
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.1.x antérieures à 18.1.2
References
Bulletin de sécurité GitLab 2025-07-09 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.0.x ant\u00e9rieures \u00e0 18.0.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.11.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.1.x ant\u00e9rieures \u00e0 18.1.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-4972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4972"
    },
    {
      "name": "CVE-2024-12084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-12084"
    },
    {
      "name": "CVE-2025-6168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6168"
    },
    {
      "name": "CVE-2025-3396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3396"
    },
    {
      "name": "CVE-2025-6948",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6948"
    },
    {
      "name": "CVE-2024-12088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-12088"
    }
  ],
  "initial_release_date": "2025-07-10T00:00:00",
  "last_revision_date": "2025-07-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0581",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-07-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/07/09/patch-release-gitlab-18-1-2-released/"
    }
  ]
}

CERTFR-2025-AVI-0537
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.1.x antérieures à 18.1.1
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.0.x antérieures à 18.0.3
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 17.11.5
References
Bulletin de sécurité GitLab 2025-06-25 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.1.x ant\u00e9rieures \u00e0 18.1.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.0.x ant\u00e9rieures \u00e0 18.0.3",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.11.5",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-2938",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2938"
    },
    {
      "name": "CVE-2025-1754",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1754"
    },
    {
      "name": "CVE-2025-5315",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5315"
    },
    {
      "name": "CVE-2025-3279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3279"
    },
    {
      "name": "CVE-2025-5846",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5846"
    }
  ],
  "initial_release_date": "2025-06-25T00:00:00",
  "last_revision_date": "2025-06-25T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0537",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-06-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-06-25",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/06/25/patch-release-gitlab-18-1-1-released/"
    }
  ]
}

CERTFR-2025-AVI-0502
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.10.x antérieures à 17.10.8
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.11.x antérieures à 17.11.4
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.0.x antérieures à 18.0.2
References
Bulletin de sécurité GitLab 2025-06-11 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.10.x ant\u00e9rieures \u00e0 17.10.8",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.11.x ant\u00e9rieures \u00e0 17.11.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.0.x ant\u00e9rieures \u00e0 18.0.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-4278",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4278"
    },
    {
      "name": "CVE-2025-0673",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0673"
    },
    {
      "name": "CVE-2025-2254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2254"
    },
    {
      "name": "CVE-2025-1516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1516"
    },
    {
      "name": "CVE-2025-1478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1478"
    },
    {
      "name": "CVE-2025-5982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5982"
    },
    {
      "name": "CVE-2024-9512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9512"
    },
    {
      "name": "CVE-2025-5996",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5996"
    },
    {
      "name": "CVE-2025-5121",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5121"
    },
    {
      "name": "CVE-2025-5195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5195"
    }
  ],
  "initial_release_date": "2025-06-12T00:00:00",
  "last_revision_date": "2025-06-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0502",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-06-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-06-11",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/"
    }
  ]
}

CERTFR-2025-AVI-0437
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.11.x antérieures à 17.11.3
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 17.10.7
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.0.x antérieures à 18.0.1
References
Bulletin de sécurité GitLab 2025-05-21 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.11.x ant\u00e9rieures \u00e0 17.11.3",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.10.7",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.0.x ant\u00e9rieures \u00e0 18.0.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-12093",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-12093"
    },
    {
      "name": "CVE-2025-0605",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0605"
    },
    {
      "name": "CVE-2025-0993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0993"
    },
    {
      "name": "CVE-2025-1110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1110"
    },
    {
      "name": "CVE-2025-3111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3111"
    },
    {
      "name": "CVE-2025-0679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0679"
    },
    {
      "name": "CVE-2025-2853",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2853"
    },
    {
      "name": "CVE-2024-7803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-7803"
    },
    {
      "name": "CVE-2024-9163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9163"
    },
    {
      "name": "CVE-2025-4979",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4979"
    }
  ],
  "initial_release_date": "2025-05-22T00:00:00",
  "last_revision_date": "2025-05-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0437",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-05-21",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released/"
    }
  ]
}

CERTFR-2025-AVI-0381
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.11.x antérieures à 17.11.2
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.10.x antérieures à 17.10.6
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.9.x antérieures à 17.9.8
References
Bulletin de sécurité GitLab 2025-05-07 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.11.x ant\u00e9rieures \u00e0 17.11.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.10.x ant\u00e9rieures \u00e0 17.10.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.9.x ant\u00e9rieures \u00e0 17.9.8",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-1278",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1278"
    },
    {
      "name": "CVE-2024-8973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8973"
    },
    {
      "name": "CVE-2025-0549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0549"
    }
  ],
  "initial_release_date": "2025-05-09T00:00:00",
  "last_revision_date": "2025-05-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0381",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-05-07",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/05/07/patch-release-gitlab-17-11-2-released/"
    }
  ]
}

CERTFR-2025-AVI-0346
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.10.x antérieures à 17.10.5
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 17.9.7
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.11.x antérieures à 17.11.1
References
Bulletin de sécurité GitLab 2025-04-23 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.10.x ant\u00e9rieures \u00e0 17.10.5",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.9.7",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.11.x ant\u00e9rieures \u00e0 17.11.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-12244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-12244"
    },
    {
      "name": "CVE-2025-0639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0639"
    },
    {
      "name": "CVE-2025-2443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2443"
    },
    {
      "name": "CVE-2025-1908",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1908"
    },
    {
      "name": "CVE-2025-1763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1763"
    }
  ],
  "initial_release_date": "2025-04-24T00:00:00",
  "last_revision_date": "2025-04-24T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0346",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-04-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab.  Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-04-23",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/04/23/patch-release-gitlab-17-11-1-released/"
    }
  ]
}

CERTFR-2025-AVI-0300
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 17.8.7
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.9.x antérieures à 17.9.6
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.10.x antérieures à 17.10.4
References
Bulletin de sécurité GitLab 2025-04-09 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.8.7",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.9.x ant\u00e9rieures \u00e0 17.9.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.10.x ant\u00e9rieures \u00e0 17.10.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-11129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-11129"
    },
    {
      "name": "CVE-2025-0362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0362"
    },
    {
      "name": "CVE-2025-1677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1677"
    },
    {
      "name": "CVE-2025-2469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2469"
    },
    {
      "name": "CVE-2025-2408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2408"
    }
  ],
  "initial_release_date": "2025-04-10T00:00:00",
  "last_revision_date": "2025-04-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0300",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-04-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-04-09",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/04/09/patch-release-gitlab-17-10-4-released/"
    }
  ]
}

CERTFR-2025-AVI-0248
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.9.x antérieures à 17.9.3
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.10.x antérieures à 17.10.1
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 17.8.6
References
Bulletin de sécurité GitLab 2025-03-26 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.9.x ant\u00e9rieures \u00e0 17.9.3",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.10.x ant\u00e9rieures \u00e0 17.10.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.8.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-9773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9773"
    },
    {
      "name": "CVE-2025-2242",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2242"
    },
    {
      "name": "CVE-2024-10307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-10307"
    },
    {
      "name": "CVE-2024-12619",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-12619"
    },
    {
      "name": "CVE-2025-0811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0811"
    },
    {
      "name": "CVE-2025-2255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2255"
    }
  ],
  "initial_release_date": "2025-03-27T00:00:00",
  "last_revision_date": "2025-03-27T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0248",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-03-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-03-26",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/03/26/patch-release-gitlab-17-10-1-released/"
    }
  ]
}

CERTFR-2025-AVI-0205
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.7.x antérieures à 17.7.7
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.8.x antérieures à 17.8.5
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.9.x antérieures à 17.9.2
References
Bulletin de sécurité GitLab 2025-03-12 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.7.x ant\u00e9rieures \u00e0 17.7.7",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.8.x ant\u00e9rieures \u00e0 17.8.5",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.9.x ant\u00e9rieures \u00e0 17.9.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-12380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-12380"
    },
    {
      "name": "CVE-2025-27407",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27407"
    },
    {
      "name": "CVE-2024-13054",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-13054"
    },
    {
      "name": "CVE-2025-0652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0652"
    },
    {
      "name": "CVE-2025-25291",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-25291"
    },
    {
      "name": "CVE-2025-1257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1257"
    },
    {
      "name": "CVE-2024-8402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8402"
    },
    {
      "name": "CVE-2025-25292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-25292"
    },
    {
      "name": "CVE-2024-7296",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-7296"
    }
  ],
  "initial_release_date": "2025-03-13T00:00:00",
  "last_revision_date": "2025-03-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0205",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-03-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-03-12",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/"
    }
  ]
}

CERTFR-2025-AVI-0164
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.9.x antérieures à 17.9.1
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions antérieures à 17.7.6
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.8.x antérieures à 17.8.4
References
Bulletin de sécurité GitLab 2025-02-26 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.9.x ant\u00e9rieures \u00e0 17.9.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.7.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.8.x ant\u00e9rieures \u00e0 17.8.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-8186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8186"
    },
    {
      "name": "CVE-2025-0307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0307"
    },
    {
      "name": "CVE-2025-0475",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0475"
    },
    {
      "name": "CVE-2024-10925",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-10925"
    },
    {
      "name": "CVE-2025-0555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0555"
    }
  ],
  "initial_release_date": "2025-02-27T00:00:00",
  "last_revision_date": "2025-02-27T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0164",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-02-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-02-26",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/02/26/patch-release-gitlab-17-9-1-released/"
    }
  ]
}

CERTFR-2025-AVI-0123
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.6.x antérieures à 17.6.5
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.7.x antérieures à 17.7.4
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.8.x antérieures à 17.8.2
References
Bulletin de sécurité GitLab 2025-02-12 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.6.x ant\u00e9rieures \u00e0 17.6.5",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.7.x ant\u00e9rieures \u00e0 17.7.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.8.x ant\u00e9rieures \u00e0 17.8.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-1198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1198"
    },
    {
      "name": "CVE-2024-9870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9870"
    },
    {
      "name": "CVE-2025-0376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0376"
    },
    {
      "name": "CVE-2025-1042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1042"
    },
    {
      "name": "CVE-2024-12379",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-12379"
    },
    {
      "name": "CVE-2025-0516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0516"
    },
    {
      "name": "CVE-2025-1212",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1212"
    },
    {
      "name": "CVE-2024-3303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3303"
    }
  ],
  "initial_release_date": "2025-02-12T00:00:00",
  "last_revision_date": "2025-02-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0123",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-02-12T00:00:00.000000"
    },
    {
      "description": "Toutes les versions ant\u00e9rieures \u00e0 17.6.5 sont consid\u00e9r\u00e9es vuln\u00e9rables.",
      "revision_date": "2025-02-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-02-12",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/02/12/patch-release-gitlab-17-8-2-released/"
    }
  ]
}

CERTFR-2025-AVI-0063
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.7.x antérieures à 17.7.3
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 17.6.4
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.8.x antérieures à 17.8.1
References
Bulletin de sécurité GitLab 2025-01-22 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.7.x ant\u00e9rieures \u00e0 17.7.3",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.6.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.8.x ant\u00e9rieures \u00e0 17.8.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-6324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6324"
    },
    {
      "name": "CVE-2025-0314",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0314"
    },
    {
      "name": "CVE-2024-11931",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-11931"
    }
  ],
  "initial_release_date": "2025-01-23T00:00:00",
  "last_revision_date": "2025-02-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0063",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-01-23T00:00:00.000000"
    },
    {
      "description": "Toutes les versions ant\u00e9rieures \u00e0 17.6.4 sont consid\u00e9r\u00e9es vuln\u00e9rables.",
      "revision_date": "2025-02-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-01-22",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/"
    }
  ]
}

CERTFR-2025-AVI-0015
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.5.x antérieures à 17.5.5
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.7.x antérieures à 17.7.1
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.6.x antérieures à 17.6.3
References
Bulletin de sécurité GitLab 2025-01-08 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.5.x ant\u00e9rieures \u00e0 17.5.5",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.7.x ant\u00e9rieures \u00e0 17.7.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.6.x ant\u00e9rieures \u00e0 17.6.3",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-6324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6324"
    },
    {
      "name": "CVE-2024-12431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-12431"
    },
    {
      "name": "CVE-2024-13041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-13041"
    },
    {
      "name": "CVE-2025-0194",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0194"
    }
  ],
  "initial_release_date": "2025-01-09T00:00:00",
  "last_revision_date": "2025-01-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0015",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-01-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2025-01-08",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/"
    }
  ]
}

CERTFR-2024-AVI-1065
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits GitLab. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions antérieures à 17.4.6
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.5.x antérieures à 17.5.4
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.6.x antérieures à 17.6.2
References
Bulletin de sécurité GitLab 2024-12-11 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.4.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.5.x ant\u00e9rieures \u00e0 17.5.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.6.x ant\u00e9rieures \u00e0 17.6.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-8179",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8179"
    },
    {
      "name": "CVE-2024-8116",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8116"
    },
    {
      "name": "CVE-2024-9633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9633"
    },
    {
      "name": "CVE-2024-12292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-12292"
    },
    {
      "name": "CVE-2024-8647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8647"
    },
    {
      "name": "CVE-2024-10043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-10043"
    },
    {
      "name": "CVE-2024-8233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8233"
    },
    {
      "name": "CVE-2024-8650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8650"
    },
    {
      "name": "CVE-2024-9387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9387"
    },
    {
      "name": "CVE-2024-11274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-11274"
    },
    {
      "name": "CVE-2024-9367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9367"
    }
  ],
  "initial_release_date": "2024-12-11T00:00:00",
  "last_revision_date": "2024-12-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-1065",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-12-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2024-12-11",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/12/11/patch-release-gitlab-17-6-2-released/"
    }
  ]
}

CERTFR-2024-AVI-1021
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions antérieures à 17.4.5
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.5.x antérieures à 17.5.3
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.6.x antérieures à 17.6.1
References
Bulletin de sécurité GitLab 2024-11-26 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.4.5",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.5.x ant\u00e9rieures \u00e0 17.5.3",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.6.x ant\u00e9rieures \u00e0 17.6.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-11669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-11669"
    },
    {
      "name": "CVE-2024-8177",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8177"
    },
    {
      "name": "CVE-2024-11828",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-11828"
    },
    {
      "name": "CVE-2024-11668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-11668"
    },
    {
      "name": "CVE-2024-8237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8237"
    },
    {
      "name": "CVE-2024-8114",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8114"
    }
  ],
  "initial_release_date": "2024-11-27T00:00:00",
  "last_revision_date": "2024-11-27T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-1021",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-11-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2024-11-26",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/11/26/patch-release-gitlab-17-6-1-released/"
    }
  ]
}

CERTFR-2024-AVI-0981
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab versions 17.5.x antérieures à 17.5.2
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab versions antérieures à 17.3.7
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab versions 17.4.x antérieures à 17.4.4
References
Bulletin de sécurité GitLab 2024-11-13 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab versions 17.5.x ant\u00e9rieures \u00e0 17.5.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab versions ant\u00e9rieures \u00e0 17.3.7",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab versions 17.4.x ant\u00e9rieures \u00e0 17.4.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-8180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8180"
    },
    {
      "name": "CVE-2024-10240",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-10240"
    },
    {
      "name": "CVE-2024-9693",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9693"
    },
    {
      "name": "CVE-2024-8648",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8648"
    },
    {
      "name": "CVE-2024-7404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-7404"
    }
  ],
  "initial_release_date": "2024-11-13T00:00:00",
  "last_revision_date": "2024-11-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0981",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-11-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2024-11-13",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/"
    }
  ]
}

CERTFR-2024-AVI-0918
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer un déni de service à distance et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab versions antérieures à 17.3.6
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) Gitlab versions 17.5.x antérieures à 17.5.1
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) Gitlab versions 17.4.x antérieures à 17.4.3
References
Bulletin de sécurité GitLab 2024-10-23 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab versions ant\u00e9rieures \u00e0 17.3.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "Gitlab versions 17.5.x ant\u00e9rieures \u00e0 17.5.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "Gitlab versions 17.4.x ant\u00e9rieures \u00e0 17.4.3",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-8312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8312"
    },
    {
      "name": "CVE-2024-6826",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6826"
    }
  ],
  "initial_release_date": "2024-10-24T00:00:00",
  "last_revision_date": "2024-10-24T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0918",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2024-10-23",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/10/23/patch-release-gitlab-17-5-1-released/"
    }
  ]
}

CERTFR-2024-AVI-0862
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) Gitlab Community Edition (CE) et Enterprise Edition (EE) versions 17.2.9
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) Gitlab Community Edition (CE) et Enterprise Edition (EE) versions 17.5.x antérieures à 17.3.5
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) Gitlab Community Edition (CE) et Enterprise Edition (EE) versions 17.4.x antérieures à 17.4.2
References
Bulletin de sécurité GitLab 2024-10-09 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Gitlab Community Edition (CE) et Enterprise Edition (EE) versions 17.2.9",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "Gitlab Community Edition (CE) et Enterprise Edition (EE) versions 17.5.x ant\u00e9rieures \u00e0 17.3.5",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "Gitlab Community Edition (CE) et Enterprise Edition (EE) versions 17.4.x ant\u00e9rieures \u00e0 17.4.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-8970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8970"
    },
    {
      "name": "CVE-2024-5005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5005"
    },
    {
      "name": "CVE-2024-9631",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9631"
    },
    {
      "name": "CVE-2024-8977",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8977"
    },
    {
      "name": "CVE-2024-9623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9623"
    },
    {
      "name": "CVE-2024-9164",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9164"
    },
    {
      "name": "CVE-2024-9596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9596"
    },
    {
      "name": "CVE-2024-6530",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6530"
    }
  ],
  "initial_release_date": "2024-10-10T00:00:00",
  "last_revision_date": "2024-10-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0862",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/10/09/patch-release-gitlab-17-4-2-released/"
    }
  ]
}

CERTFR-2024-AVI-0814
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.5.x antérieures à 16.5.10
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.9.x antérieures à 16.9.11
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.4.x antérieures à 17.4.1
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.3.x antérieures à 17.3.4
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.8.x antérieures à 16.8.10
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.4.x antérieures à 16.4.7
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.0.x antérieures à 16.0.10
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.2.x antérieures à 17.2.8
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.10.x antérieures à 16.10.10
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.7.x antérieures à 16.7.10
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.2.x antérieures à 16.2.11
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.6.x antérieures à 16.6.10
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.3.x antérieures à 16.3.9
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.1.x antérieures à 16.1.8
References
Bulletin de sécurité GitLab 2024-09-25 vendor-advisory
Bulletin de sécurité GitLab 2024-09-25 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.5.x ant\u00e9rieures \u00e0 16.5.10",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.9.x ant\u00e9rieures \u00e0 16.9.11",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.4.x ant\u00e9rieures \u00e0 17.4.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.3.x ant\u00e9rieures \u00e0 17.3.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.8.x ant\u00e9rieures \u00e0 16.8.10",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.4.x ant\u00e9rieures \u00e0 16.4.7",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.0.x ant\u00e9rieures \u00e0 16.0.10",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 17.2.x ant\u00e9rieures \u00e0 17.2.8",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.10.x ant\u00e9rieures \u00e0 16.10.10",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.7.x ant\u00e9rieures \u00e0 16.7.10",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.2.x ant\u00e9rieures \u00e0 16.2.11",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.6.x ant\u00e9rieures \u00e0 16.6.10",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.3.x ant\u00e9rieures \u00e0 16.3.9",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 16.1.x ant\u00e9rieures \u00e0 16.1.8",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-8974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8974"
    },
    {
      "name": "CVE-2024-4278",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4278"
    },
    {
      "name": "CVE-2024-4099",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4099"
    }
  ],
  "initial_release_date": "2024-09-26T00:00:00",
  "last_revision_date": "2024-09-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0814",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-09-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2024-09-25",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/09/25/patch-release-gitlab-17-4-1-released/"
    },
    {
      "published_at": "2024-09-25",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/09/25/patch-release-gitlab-16-10-10-released/"
    }
  ]
}

CERTFR-2024-AVI-0791
Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans GitLab. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.2.x antérieures à 17.2.7
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions antérieures à 16.11.10
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.x antérieures à 17.0.8
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.1.x antérieures à 17.1.8
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.3.x antérieures à 17.3.3
References
Bulletin de sécurité GitLab 2024-09-17 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.2.x ant\u00e9rieures \u00e0 17.2.7",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 16.11.10",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.x ant\u00e9rieures \u00e0 17.0.8",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.1.x ant\u00e9rieures \u00e0 17.1.8",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.3.x ant\u00e9rieures \u00e0 17.3.3",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-45409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45409"
    }
  ],
  "initial_release_date": "2024-09-18T00:00:00",
  "last_revision_date": "2024-09-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0791",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-09-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans GitLab. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2024-09-17",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/09/17/patch-release-gitlab-17-3-3-released/"
    }
  ]
}

CERTFR-2024-AVI-0769
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.2.x antérieures à 17.2.5
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions antérieures à 17.1.7
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.3.x antérieures à 17.3.2
References
Bulletin de sécurité GitLab 2024-09-11 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.2.x ant\u00e9rieures \u00e0 17.2.5",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.1.7",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.3.x ant\u00e9rieures \u00e0 17.3.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-5435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5435"
    },
    {
      "name": "CVE-2024-6446",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6446"
    },
    {
      "name": "CVE-2024-6389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6389"
    },
    {
      "name": "CVE-2024-8635",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8635"
    },
    {
      "name": "CVE-2024-6678",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6678"
    },
    {
      "name": "CVE-2024-4283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4283"
    },
    {
      "name": "CVE-2024-4612",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4612"
    },
    {
      "name": "CVE-2024-4660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4660"
    },
    {
      "name": "CVE-2024-8311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8311"
    },
    {
      "name": "CVE-2024-6685",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6685"
    },
    {
      "name": "CVE-2024-8124",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8124"
    },
    {
      "name": "CVE-2024-4472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4472"
    },
    {
      "name": "CVE-2024-2743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-2743"
    },
    {
      "name": "CVE-2024-8641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8641"
    },
    {
      "name": "CVE-2024-8631",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8631"
    },
    {
      "name": "CVE-2024-8640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8640"
    }
  ],
  "initial_release_date": "2024-09-12T00:00:00",
  "last_revision_date": "2024-09-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0769",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-09-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2024-09-11",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/"
    }
  ]
}

CERTFR-2024-AVI-0709
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.2.x antérieures à 17.2.4
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions antérieures à 17.1.6
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.3.x antérieures à 17.3.1
References
Bulletin de sécurité GitLab 2024-08-21 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.2.x ant\u00e9rieures \u00e0 17.2.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.1.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.3.x ant\u00e9rieures \u00e0 17.3.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-3127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3127"
    },
    {
      "name": "CVE-2024-6502",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6502"
    },
    {
      "name": "CVE-2024-7110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-7110"
    }
  ],
  "initial_release_date": "2024-08-22T00:00:00",
  "last_revision_date": "2024-08-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0709",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-08-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2024-08-21",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/08/21/patch-release-gitlab-17-3-1-released/"
    }
  ]
}

CERTFR-2024-AVI-0659
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) and Enterprise Edition (EE) versions antérieures à 17.0.6
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) and Enterprise Edition (EE) versions 17.1.x antérieures à 17.1.4
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) and Enterprise Edition (EE) versions 17.2.x antérieures à 17.2.2
References
Bulletin de sécurité GitLab 2024-08-07 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) and Enterprise Edition (EE) versions ant\u00e9rieures \u00e0 17.0.6",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) and Enterprise Edition (EE) versions 17.1.x ant\u00e9rieures \u00e0 17.1.4",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) and Enterprise Edition (EE) versions 17.2.x ant\u00e9rieures \u00e0 17.2.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-3114",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3114"
    },
    {
      "name": "CVE-2024-3958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3958"
    },
    {
      "name": "CVE-2024-5423",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5423"
    },
    {
      "name": "CVE-2024-4207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4207"
    },
    {
      "name": "CVE-2024-3035",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3035"
    },
    {
      "name": "CVE-2024-4784",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4784"
    },
    {
      "name": "CVE-2024-7586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-7586"
    },
    {
      "name": "CVE-2024-6356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6356"
    },
    {
      "name": "CVE-2024-2800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-2800"
    },
    {
      "name": "CVE-2024-4210",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4210"
    },
    {
      "name": "CVE-2024-6329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6329"
    }
  ],
  "initial_release_date": "2024-08-08T00:00:00",
  "last_revision_date": "2024-08-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0659",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-08-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2024-08-07",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/08/07/patch-release-gitlab-17-2-2-released/"
    }
  ]
}

CERTFR-2024-AVI-0625
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.1.x antérieures à 17.1.3
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.2.x antérieures à 17.2.1
GitLab GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.3.x antérieures à 17.3.2
References
Bulletin de sécurité GitLab 2024-07-24 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.1.x ant\u00e9rieures \u00e0 17.1.3",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.2.x ant\u00e9rieures \u00e0 17.2.1",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    },
    {
      "description": "GitLab Community Edition (CE) et Enterprise Edition (EE) versions 17.3.x ant\u00e9rieures \u00e0 17.3.2",
      "product": {
        "name": "GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE)",
        "vendor": {
          "name": "GitLab",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-5067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5067"
    },
    {
      "name": "CVE-2024-0231",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0231"
    },
    {
      "name": "CVE-2024-7057",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-7057"
    }
  ],
  "initial_release_date": "2024-07-25T00:00:00",
  "last_revision_date": "2024-07-25T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0625",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GitLab. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GitLab",
  "vendor_advisories": [
    {
      "published_at": "2024-07-24",
      "title": "Bulletin de s\u00e9curit\u00e9 GitLab",
      "url": "https://about.gitlab.com/releases/2024/07/24/patch-release-gitlab-17-2-1-released/"
    }
  ]
}