PT-2018-5143 · Gitlab · Gitlab Ce/Ee+1

Published 2018-03-18 · Updated 2019-10-09 · CVE-2017-0916

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.3

Description The issue is related to a lack of input validation in the system hook push queue through the web hook component, resulting in remote code execution.

Recommendations For Gitlab Community Edition version 10.3, consider disabling the web hook component until a patch is available to prevent remote code execution. Restrict access to the system hook push queue to minimize the risk of exploitation.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-20

CWE-77

Related Identifiers

CVE-2017-0916

DSA-4145-1

Affected Products

Gitlab

Gitlab Ce/Ee

References · 19

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0918 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0926 · Security Note
• https://security-tracker.debian.org/tracker/source-package/gitlab · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0915 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0916 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4145-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0916 · Security Note
• https://osv.dev/vulnerability/DSA-4145-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4145 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0916 · Security Note
• https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0925 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0917 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3710 · Security Note
• https://gitlab.com/gitlab-org/gitlab-ce/issues/32198 · Note