CVE-2023-3909

Inefficient Regular Expression Complexity in GitLab

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"12.3.0"},{"fixed":"16.3.6"},{"introduced":"16.4.0"},{"fixed":"16.4.2"},{"introduced":"16.5.0"},{"fixed":"16.5.1"}]}]

Références

web gitlab.com
web hackerone.com
web nvd.nist.gov