GitLab Patches Critical CVSS 10.0 Vulnerability Allowing Unauthenticated Remote Code Execution
Flaw in CI/CD regex handling could enable unauthenticated attackers to execute arbitrary code on GitLab servers
Key Takeaways
- GitLab has patched a CVSS 10.0 vulnerability in Community Edition and Enterprise Edition.
- The flaw involves improper handling of crafted regular expressions in CI/CD configurations.
- Unauthenticated remote code execution is possible under certain conditions.
- Users must update to the latest patched versions to secure their installations.
Related Security News
GitLab Warns of Critical Remote Code Execution Vulnerability in CI/CD Regular Expression Compiler
GitLab has identified a critical vulnerability in the CI/CD Regular Expression Compiler component that could allow remote attackers to execute arbitrary code on targeted instances. The issue is tracked as a maximum severity flaw and affects GitLab instances with the compiler enabled. Patches have been released and users are urged to update immediately.
SonicWall SMA 1000 SSRF Flaw Exploited in Wild Within Days of Disclosure
SonicWall has confirmed active exploitation of a critical server-side request forgery vulnerability in Secure Mobile Access 1000 appliances. Exploitation was observed in the wild shortly after public disclosure, with over 135 attempts detected. The issue affects SMA 1000 devices and requires urgent patching to prevent unauthorized access and data exfiltration.
