Create 20240927002-GitLab-Critical-Vulnerability.md

docs/advisories/20240927002-GitLab-Critical-Vulnerability.md

@@ -0,0 +1,26 @@
+# GitLab Critical Vulnerability - 20240927002
+
+## Overview
+
+GitLab has released critical advisories to addressed a severe vulnerability in its Community Edition (CE) and Enterprise Edition (EE) platforms, impacting all self-managed installations.
+
+## What is vulnerable?
+
+| Product(s) Affected | Version(s)                                                                                               | CVE                                                               | CVSS    | Severity     |
+| ------------------- | -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ------- | ------------ |
+| GitLab CE/EE        | 17.3 < 17.3.3 <br> 17.2 < 17.2.7 <br> 17.1 < 17.1.8 <br> 17.0 < 17.0.8 <br> all versions < 16.11.10 | [CVE-2024-45409](https://nvd.nist.gov/vuln/detail/CVE-2024-45409) | **9.8** | **Critical** |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)).
+
+- Github advisory: <https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq>
+- Github advisory: <https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2>
+
+## Additional References
+
+- SecurityOnline article: <https://securityonline.info/gitlab-backports-fix-for-cve-2024-45409-to-older-versions/>