PT-2023-13439 · Gitlab · Gitlab Ce/Ee+1
Mokusou
·
Publicado
2023-01-12
·
Atualizado
2025-04-08
·
CVE-2022-3514
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
GitLab CE/EE versions 6.6 through 15.5.7
GitLab CE/EE versions 15.6 through 15.6.4
GitLab CE/EE versions 15.7 through 15.7.2
Description
An issue has been discovered in GitLab CE/EE that affects various versions. The problem is related to a regex issue in the submodule URL parser, which can be exploited by an attacker to cause a Denial of Service on a GitLab instance.
Recommendations
For versions 6.6 through 15.5.7, update to version 15.5.7 or later to resolve the issue.
For versions 15.6 through 15.6.4, update to version 15.6.4 or later to resolve the issue.
For versions 15.7 through 15.7.2, update to version 15.7.2 or later to resolve the issue.
As a temporary workaround, consider restricting access to the submodule URL parser to minimize the risk of exploitation.
Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Gitlab
Gitlab Ce/Ee