Dependency on Vulnerable Third-Party Component in GitLab(CVE-2023-5332)

概要

Dependency on Vulnerable Third-Party Component in GitLab

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami consul

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.4"},{"introduced":"1.0.0"},{"fixed":"1.0.8"},{"introduced":"1.1.0"},{"fixed":"1.1.1"},{"introduced":"1.2.0"},{"fixed":"1.2.4"}]}]

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"9.5.0"},{"fixed":"16.2.8"},{"introduced":"16.3.0"},{"fixed":"16.3.5"},{"introduced":"16.4.0"},{"fixed":"16.4.1"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2023-5332 consul

参照URL

advisory hashicorp.com
report gitlab.com
web nvd.nist.gov