CVE-2023-5332
Dependency on Vulnerable Third-Party Component in GitLab
Summary
Dependency on Vulnerable Third-Party Component in GitLab
Original description
The description as published by the source.
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
Affected packages
Bitnami
consul
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.4"},{"introduced":"1.0.0"},{"fixed":"1.0.8"},{"introduced":"1.1.0"},{"fixed":"1.1.1"},{"introduced":"1.2.0"},{"fixed":"1.2.4"}]}]
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"9.5.0"},{"fixed":"16.2.8"},{"introduced":"16.3.0"},{"fixed":"16.3.5"},{"introduced":"16.4.0"},{"fixed":"16.4.1"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-5332 consul
References
- advisory hashicorp.com
- report gitlab.com
- web nvd.nist.gov