CVE-2021-39880

A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions sta...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"11.9.0"},{"fixed":"14.0.9"},{"introduced":"14.1.0"},{"fixed":"14.1.4"},{"introduced":"14.2.0"},{"fixed":"14.2.2"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2021-39880 ruby-apollo-upload-server Corrigé dans: 2.1.0-1

Références

advisory gitlab.com
report gitlab.com
report hackerone.com
web nvd.nist.gov