CVE-2023-3909

Inefficient Regular Expression Complexity in GitLab

Summary

Original description

The description as published by the source.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"12.3.0"},{"fixed":"16.3.6"},{"introduced":"16.4.0"},{"fixed":"16.4.2"},{"introduced":"16.5.0"},{"fixed":"16.5.1"}]}]

References

web gitlab.com
web hackerone.com
web nvd.nist.gov