This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-39880 →

DEBIAN-CVE-2021-39880

A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions sta...

Original description

The description as published by the source.

A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ruby-apollo-upload-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1"}]}]

Debian:13 ruby-apollo-upload-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1"}]}]

Debian:14 ruby-apollo-upload-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1"}]}]

References

advisory security-tracker.debian.org