diff --git a/docs/advisories/20240927002-GitLab-Critical-Vulnerability.md b/docs/advisories/20240927002-GitLab-Critical-Vulnerability.md new file mode 100644 index 00000000..ffa6a1a7 --- /dev/null +++ b/docs/advisories/20240927002-GitLab-Critical-Vulnerability.md @@ -0,0 +1,26 @@ +# GitLab Critical Vulnerability - 20240927002 + +## Overview + +GitLab has released critical advisories to addressed a severe vulnerability in its Community Edition (CE) and Enterprise Edition (EE) platforms, impacting all self-managed installations. + +## What is vulnerable? + +| Product(s) Affected | Version(s) | CVE | CVSS | Severity | +| ------------------- | -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ------- | ------------ | +| GitLab CE/EE | 17.3 < 17.3.3
17.2 < 17.2.7
17.1 < 17.1.8
17.0 < 17.0.8
all versions < 16.11.10 | [CVE-2024-45409](https://nvd.nist.gov/vuln/detail/CVE-2024-45409) | **9.8** | **Critical** | + +## What has been observed? + +There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing. + +## Recommendation + +The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)). + +- Github advisory: +- Github advisory: + +## Additional References + +- SecurityOnline article: