PT-2020-10133 · Gitlab · Gitlab Ce/Ee+1

Dfenson · Published 2020-01-05 · Updated 2021-07-21 · CVE-2019-19313

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.3 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6

Description The issue allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits.

Recommendations For GitLab EE versions 12.3 through 12.5, update to a version that does not contain this issue. For GitLab EE version 12.4.3, update to a version that does not contain this issue. For GitLab EE version 12.3.6, update to a version that does not contain this issue. As a temporary workaround, consider restricting the use of certain characters to minimize the risk of exploitation.

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2019-19313

Affected Products

Gitlab

Gitlab Ce/Ee

References · 5

• https://osv.dev/vulnerability/CVE-2019-19313 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19313 · Security Note
• https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released · Vendor Advisory
• https://about.gitlab.com/blog/categories/releases · Note
• https://gitlab.com/gitlab-org/gitlab/issues/14947 · Note