CVE-2023-5825

Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab

Summary

Original description

The description as published by the source.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A low-privileged attacker can point a CI/CD Component to an incorrect path and cause the server to exhaust all available memory through an infinite loop and cause Denial of Service.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"16.2.0"},{"fixed":"16.3.6"},{"introduced":"16.4.0"},{"fixed":"16.4.2"},{"introduced":"16.5.0"},{"fixed":"16.5.1"}]}]

References

advisory gitlab.com
web hackerone.com
web nvd.nist.gov