PT-2021-22726 · Gitlab+1 · Gitlab Ce/Ee+2

0Xn3Va · Published 2021-10-05 · Updated 2024-03-06 · CVE-2021-39880

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.9 through 14.0.8 GitLab CE/EE versions 14.1 through 14.1.3 GitLab CE/EE versions 14.2 through 14.2.1

Description: A Denial Of Service issue in the apollo upload server Ruby gem allows an attacker to deny access to all users via specially crafted requests to the apollo upload server middleware.

Recommendations: For versions 11.9 through 14.0.8, update to version 14.0.9 or later. For versions 14.1 through 14.1.3, update to version 14.1.4 or later. For versions 14.2 through 14.2.1, update to version 14.2.2 or later.

Exploit

Fix

Related Identifiers

BIT-GITLAB-2021-39880

CVE-2021-39880

GHSA-W6PV-C757-6RGR

Affected Products

Debian

Gitlab

Gitlab Ce/Ee

References · 21

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/apollo_upload_server/CVE-2021-39880.yml · Exploit
• https://security-tracker.debian.org/tracker/CVE-2021-39880 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2021-39880 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39880.json · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-39880 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w6pv-c757-6rgr · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39880 · Security Note
• https://ubuntu.com/security/CVE-2021-39880 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-39880 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39880 · Vendor Advisory
• https://github.com/jetruby/apollo_upload_server-ruby · Note
• https://github.com/jetruby/apollo_upload_server-ruby/releases/tag/2.1.0 · Note
• https://github.com/jetruby/apollo_upload_server-ruby/commit/b0582c1a3e458eee3c994fb38278bd0221f20486 · Note
• https://github.com/jetruby/apollo_upload_server-ruby/pull/44 · Note