Dependency on Vulnerable Third-Party Component in GitLab (CVE-2023-5332)

Résumé

Dependency on Vulnerable Third-Party Component in GitLab

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami consul

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.4"},{"introduced":"1.0.0"},{"fixed":"1.0.8"},{"introduced":"1.1.0"},{"fixed":"1.1.1"},{"introduced":"1.2.0"},{"fixed":"1.2.4"}]}]

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"9.5.0"},{"fixed":"16.2.8"},{"introduced":"16.3.0"},{"fixed":"16.3.5"},{"introduced":"16.4.0"},{"fixed":"16.4.1"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2023-5332 consul

Références

advisory hashicorp.com
report gitlab.com
web nvd.nist.gov