Ryhmnlfjon

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 9.3 through 16.0.7 GitLab CE/EE versions 16.1 through 16.1.2 GitLab CE/EE versions 16.2 through 16.2.1 **Description** An issue has been discovered in GitLab CE/EE, where a Regular Expression Denial of Service was possible via sending crafted payloads that use `ProjectReferenceFilter` to the "preview markdown" endpoint. **Recommendations** For versions 9.3 through 16.0.7, update to version 16.0.8 or later. For versions 16.1 through 16.1.2, update to version 16.1.3 or later. For versions 16.2 through 16.2.1, update to version 16.2.2 or later. As a temporary workaround, consider restricting access to the "preview markdown" endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 8.14 through 16.0.7 GitLab CE/EE versions 16.1 through 16.1.2 GitLab CE/EE versions 16.2 through 16.2.1 **Description** A Regular Expression Denial of Service issue was discovered, allowing attackers to send crafted payloads using AutolinkFilter to the "preview markdown" endpoint. This could potentially lead to a denial of service. **Recommendations** For versions 8.14 through 16.0.7, update to version 16.0.8 or later. For versions 16.1 through 16.1.2, update to version 16.1.3 or later. For versions 16.2 through 16.2.1, update to version 16.2.2 or later. As a temporary workaround, consider restricting access to the `preview markdown` endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 8.7 through 15.10.7 GitLab CE/EE versions 15.11 through 15.11.6 GitLab CE/EE versions 16.0 through 16.0.1 **Description** A Regular Expression Denial of Service issue was discovered, allowing attackers to send crafted payloads to the "preview markdown" endpoint. This could potentially lead to a denial of service. **Recommendations** For versions 8.7 through 15.10.7, update to version 15.10.8 or later. For versions 15.11 through 15.11.6, update to version 15.11.7 or later. For versions 16.0 through 16.0.1, update to version 16.0.2 or later. As a temporary workaround, consider restricting access to the "preview markdown" endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 12.0 through 15.10.7 GitLab CE/EE versions 15.11 through 15.11.6 GitLab CE/EE versions 16.0 through 16.0.1 **Description** A Regular Expression Denial of Service issue was discovered, allowing attackers to send crafted payloads to the "preview markdown" endpoint. **Recommendations** For versions 12.0 through 15.10.7, update to version 15.10.8 or later. For versions 15.11 through 15.11.6, update to version 15.11.7 or later. For versions 16.0 through 16.0.1, update to version 16.0.2 or later. As a temporary workaround, consider restricting access to the "preview markdown" endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 15.4 through 15.10.7 GitLab CE/EE versions 15.11 through 15.11.6 GitLab CE/EE versions 16.0 through 16.0.1 **Description** An issue has been discovered in GitLab CE/EE, where a DollarMathPostFilter Regular Expression Denial of Service is possible by sending crafted payloads to the "preview markdown" endpoint. **Recommendations** For versions 15.4 through 15.10.7, update to version 15.10.8 or later. For versions 15.11 through 15.11.6, update to version 15.11.7 or later. For versions 16.0 through 16.0.1, update to version 16.0.2 or later. As a temporary workaround, consider restricting access to the "preview markdown" endpoint until a patch is available.

**Nome do software vulnerável e versões afetadas** Versões 10.7 a 15.1.5 do GitLab CE/EE Versões 15.2 a 15.2.3 do GitLab CE/EE Versões 15.3 a 15.3.1 do GitLab CE/EE **Descrição** Foi descoberta uma vulnerabilidade potencial de DoS, permitindo que um invasor provoque alto uso da CPU por meio de uma entrada especialmente criada adicionada no campo `Mensagem de commit`. Isso se deve à validação insuficiente da entrada no campo Mensagem de commit, que pode ser explorada por um invasor remoto para causar uma negação de serviço. **Recomendações** Para as versões 10.7 a 15.1.5 do Gitlab CE/EE, atualize para a versão 15.1.5 ou posterior. Para as versões 15.2 a 15.2.3 do Gitlab CE/EE, atualize para a versão 15.2.3 ou posterior. Para as versões 15.3 a 15.3.1 do GitLab CE/EE, atualize para a versão 15.3.1 ou posterior. Como solução alternativa temporária, considere restringir o acesso ao campo “Mensagem de commit” para minimizar o risco de exploração.

**Nome do software vulnerável e versões afetadas** Versões 8.3 a 14.7.6 do GitLab CE/EE Versões 14.8 a 14.8.4 do GitLab CE/EE Versões 14.9 a 14.9.1 do GitLab CE/EE **Descrição** A vulnerabilidade está relacionada ao tratamento inadequado de entradas do usuário, permitindo que um invasor explore um XSS armazenado ao abusar de referências a marcos com várias palavras em descrições de issues, comentários, etc. Isso pode ser feito remotamente e pode levar a ataques de cross-site scripting usando links especialmente criados. **Recomendações** Para as versões 8.3 a 14.7.6 do GitLab CE/EE, atualize para a versão 14.7.7 ou posterior. Para as versões 14.8 a 14.8.4 do GitLab CE/EE, atualize para a versão 14.8.5 ou posterior. Para as versões 14.9 a 14.9.1 do GitLab CE/EE, atualize para a versão 14.9.2 ou posterior. Como solução alternativa temporária, considere restringir o uso de referências a marcos com várias palavras nas descrições de issues e comentários até que um patch esteja disponível.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions prior to 11.11.6 GitLab CE/EE versions prior to 12.0.4 GitLab CE/EE versions prior to 12.1.2 **Description** An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature, which could result in a persistent XSS. **Recommendations** For versions prior to 11.11.6, update to version 11.11.6 or later. For versions prior to 12.0.4, update to version 12.0.4 or later. For versions prior to 12.1.2, update to version 12.1.2 or later.