CVE-2024-0199

Published: 7 March 2024

An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions.

Priority

Status

Package	Release	Status
gitlab Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
	xenial	Ignored (not maintainable)

References

https://gitlab.com/gitlab-org/gitlab/-/issues/436977
https://hackerone.com/reports/2295423
https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released/
https://www.cve.org/CVERecord?id=CVE-2024-0199
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.