CVE-2021-39880

A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions sta...

Original description

The description as published by the source.

A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"11.9.0"},{"fixed":"14.0.9"},{"introduced":"14.1.0"},{"fixed":"14.1.4"},{"introduced":"14.2.0"},{"fixed":"14.2.2"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2021-39880 ruby-apollo-upload-server Fixed in: 2.1.0-1

References

advisory gitlab.com
report gitlab.com
report hackerone.com
web nvd.nist.gov