Max-severity GitLab bug allows remote code execution over 12 years of releases
A maximum-severity flaw in GitLab's regular-expression compiler could permit attackers to execute arbitrary code on vulnerable self-managed instances. The bug affects both Community and Enterprise editions dating back 12 years. GitLab released patches in current versions and backported fixes to older branches. GitLab-managed services are already patched, and threat detection rules are available for self-managed deployments. The vulnerability was discovered and reported through GitLab's HackerOne bounty program.
Key points
- Max-severity RCE flaw in regex compilation affecting GitLab versions from 7.0 (2014) onward
- Unauthenticated attackers could exploit under certain conditions on self-managed instances
- Patches released across multiple version branches; GitLab.com and GitLab Dedicated already secured
- Threat detections available for self-managed deployments to detect potential exploitation
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
