GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression. (...)

CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Here, CVSS 10.0 means arbitrary remote code execution.

▲

tptacek 4 hours ago | parent [-]

"Arbitrary RCE" does mean something. "CVSS 10.0" does not. We should be using the article headline here.

▲

phoe-krk 4 hours ago | parent | next [-]

Truth be told, I don't think that "GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13" is a more descriptive title, even taking the HN guidelines into account. It could be better, sure, but it's not horrible (IMO).

	▲	tptacek 4 hours ago \| parent [-]
		It's an editorialization. The submitter is saying something about the importance of CVSS that the article does not. A better title would say "Remote Code Execution" where it says "CVSS 10.0" now.

▲

artooro 3 hours ago | parent | prev [-]

Good point guys, I've updated the title.