Loading vulnerability…
Ambiguous tag name spoofing in GitLab CE/EE
CVE-2024-3958 is a medium-severity spoofing and social-engineering vulnerability in GitLab Community Edition and Enterprise Edition. A discrepancy exists between how GitLab's web application displays certain tag names and how the Git command-line interface interprets or presents them. An attacker can abuse this ambiguity to make a malicious or untrusted repository reference appear trustworthy in the web interface, increasing the likelihood that a victim will clone code they did not intend to obtain. The issue affects GitLab CE/EE before 17.0.6, 17.1 before 17.1.4, and 17.2 before 17.2.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can mislead users into cloning non-trusted code under the false impression that it corresponds to a legitimate or expected tag. This can undermine repository trust decisions and software supply-chain integrity, potentially leading to execution, review, or integration of attacker-controlled code in downstream development or build workflows. The primary impact is spoofing-enabled social engineering rather than direct server-side code execution or privilege escalation within GitLab itself.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by requiring users to verify repository references through trusted out-of-band processes before cloning, especially when acting on links or tag names presented in the web UI. Prefer commit hashes or otherwise independently validated references for sensitive workflows, and restrict reliance on visually trusted tag names alone for release validation or source acquisition decisions. These measures are only partial mitigations and do not remove the underlying flaw.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release: 17.0.6, 17.1.4, 17.2.2, or later. Self-managed installations running affected versions should be updated immediately to eliminate the display-versus-CLI ambiguity in tag handling. GitLab.com was already running a patched version at the time of disclosure.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.