GitLab upgradation process depends on the installation methods followed in your organization.
#EXIFTOOL VULNERABILITY HOW TO#
How to upgrade GitLab to the latest version? or publish them on a secure platform like Citrix.
Since attacks are prone to the GitLab exposed to the internet, we recommend not to host the GitLab directly to the internet.Since Gitlab shipped the fix in versions 13.10.3, 13.9.6, and 13.8.8, we recommend updating your GitLab to any of the versions which are greater or equal to these versions.How To Fix CVE-2021-22205, Unauthenticated RCE Vulnerability In GitLab? GitLab also recommends updating GitLab to the latest available versions. CVE-2021-22205 Patched Versions Of GitLabĪccording to GitLab’s April 2021 advisory, GitLab patched the CVE-2021-22205 vulnerability from these versions. Note: These exploits were created only for educational/research purposes only. List of exploits available for the public: In support of this, there are multiple exploits published on public forums. Since the vulnerability was announced that it’s an unauthenticated REC vulnerability, an increment in the number of attacks has been seen. Affected GitLab Versions:Īccording to the report, this unauthenticated RCE vulnerability CVE-2021-22205 affects all versions of GitLab (both Enterprise Edition (EE) and Community Edition (CE)) lower than v13.8.8. However, later in Sep 21, 2021, the CVSS score was revised to 10.0 and made the vulnerability to unauthenticated remote code execution vulnerability from authenticated. The vulnerability was initially tracked as CVE-2021-22205 and assigned a CVSSv3 score of 9.9 in Apr 14, 2021.
#EXIFTOOL VULNERABILITY FULL#
A remote attacker could execute arbitrary commands as the git user due to ExifTool’s mishandling of DjVu files, an issue that was later assigned CVE-2021-22204.” Rapid 7 research team has shared the full technical root cause analysis of the vulnerability here. “GitLab described the issue as an authenticated vulnerability that was the result of passing user-provided images to the service’s embedded version of ExifTool.
0 kommentar(er)
