Yuki_Osaki

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 7.12 through 18.1.6 GitLab CE/EE versions 18.2 through 18.2.6 GitLab CE/EE versions 18.3 through 18.3.2 GitLab versions prior to 16.10.5 GitLab versions prior to 17.0.3 GitLab versions prior to 17.1.1 Description: An issue exists in GitLab CE/EE that could allow unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses. Recommendations: Update GitLab CE/EE to version 18.1.6 or later. Update GitLab CE/EE to version 18.2.6 or later. Update GitLab CE/EE to version 18.3.2 or later. Update GitLab to version 16.10.5 or later. Update GitLab to version 17.0.3 or later. Update GitLab to version 17.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Action Mailer versions 3.0.0 through 6.1.7.8 Action Mailer versions 7.0.0 through 7.0.8.4 Action Mailer versions 7.1.0 through 7.1.4.0 Action Mailer versions 7.2.0 through 7.2.1.0 **Description** The issue is related to the block format helper in Action Mailer, which has a possible ReDoS vulnerability. This vulnerability can cause the block format helper to take an unexpected amount of time when processing carefully crafted text, possibly resulting in a DoS vulnerability. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. **Recommendations** For Action Mailer versions 3.0.0 through 6.1.7.8, upgrade to version 6.1.7.9 or apply the relevant patch immediately. For Action Mailer versions 7.0.0 through 7.0.8.4, upgrade to version 7.0.8.5 or apply the relevant patch immediately. For Action Mailer versions 7.1.0 through 7.1.4.0, upgrade to version 7.1.4.1 or apply the relevant patch immediately. For Action Mailer versions 7.2.0 through 7.2.1.0, upgrade to version 7.2.1.1 or apply the relevant patch immediately. As a temporary workaround, users can avoid calling the `block format` helper. Users can also upgrade to Ruby 3.2, which has mitigations for this problem.