GitLab
The Ruby SAML library is for implementing the client side of a SAML authorization
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- On 25 September 2024, we released versions 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, and 16.0.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).
Questions to ask IT
- Do we run Omniauth Saml and GitLab, and which versions?
- Is any of it reachable from the internet?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 3 Dec?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2024-45409- 10.0 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality and integrity, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- Not listed
- Elevated attack likelihood (~10.7% in 30 days)
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- On 25 September 2024, we released versions 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, and 16.0.10 for GitLab Community Edition (CE) and Enterprise Edition (EE). This extends the security fixes previously added to 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10. These versions contain backports of an important security fix which was previously released for GitLab versions 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10.
Read the original reportGitLab security releases(opens in a new tab)
Products and services involved
- Omniauth Saml93% match confidence · CVE-2024-45409
- GitLab93% match confidence · CVE-2024-45409
Pulse
Last change 5d ago · Recheck overdue since 4 Nov 2026, 18:21 UK time
- Story3 Nov 2026, 18:21 UK time · 5d ago
Linked reporting from GitLab security releases (vendor psirt).
Read source (GitLab security releases) - Story3 Nov 2026, 18:21 UK time · 5d ago
Linked reporting from GitLab security releases (vendor psirt).
Read source (GitLab security releases)
2 entries so far. The timeline chart appears once this story has more history.
Sources
- GitLab security releasesVendor
GitLab Critical Patch Release: 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10
- GitLab security releasesVendor
GitLab Critical Patch Release: 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, 16.0.10
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
The Ruby SAML library is for implementing the client side of a SAML authorisation
- ProbableSummary fact75% confidence
On 25 September 2024, we released versions 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, and 16.0.10 for GitLab Community Edition (CE) and Enterprise Edition (EE). This extends the security fixes previously added to 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10. These versions contain backports of an important security fix which was previously released for GitLab versions 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2024-45409