PT-2023-11342 · Gitlab · Gitlab Ce/Ee+2

Vakzz · Published 2023-04-15 · Updated 2023-04-25 · CVE-2019-14944

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.11.8 and earlier GitLab Community and Enterprise Edition versions 12.0.6 and earlier GitLab Community and Enterprise Edition versions 12.1.6 and earlier

Description An issue was discovered in GitLab Community and Enterprise Edition. Gitaly allows injection of command-line flags, which sometimes leads to privilege escalation or remote code execution.

Recommendations For versions 11.11.8 and earlier, update to version 11.11.8 or later. For versions 12.0.6 and earlier, update to version 12.0.6 or later. For versions 12.1.6 and earlier, update to version 12.1.6 or later.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2019-14944

Affected Products

Gitlab

Gitlab Ce/Ee

Gitaly

References · 9

• 🔥 https://gitlab.com/gitlab-org/gitaly/issues/1801 · Exploit
• https://osv.dev/vulnerability/CVE-2019-14944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14944 · Security Note
• https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released · Vendor Advisory
• https://t.me/cibsecurity/62250 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14944 · Note
• https://about.gitlab.com/blog/categories/releases · Note
• https://t.me/cvenotify/48354 · Telegram Post
• https://gitlab.com/gitlab-org/gitaly/issues/1802 · Note