CVE-2023-0921
Allocation of Resources Without Limits or Throttling in GitLab
Résumé
Allocation of Resources Without Limits or Throttling in GitLab
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
Paquets affectés
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"15.10.8"},{"introduced":"15.11.0"},{"fixed":"15.11.7"},{"introduced":"16.0.0"},{"fixed":"16.0.2"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- report gitlab.com
- web gitlab.com
- web hackerone.com