PT-2023-10678 · Gitlab · Gitlab Ce/Ee+1

Published 2023-04-15 · Updated 2023-04-25 · CVE-2018-15472

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.1.0 through 11.1.7 GitLab Community and Enterprise Edition versions 11.2.0 through 11.2.4 GitLab Community and Enterprise Edition versions 11.3.0 through 11.3.1

Description An issue was discovered in the diff formatter using rouge, which can block for a long time in Sidekiq jobs without any timeout.

Recommendations For versions 11.1.0 through 11.1.7, update to version 11.1.7 or later. For versions 11.2.0 through 11.2.4, update to version 11.2.4 or later. For versions 11.3.0 through 11.3.1, update to version 11.3.1 or later. As a temporary workaround, consider restricting the use of the diff formatter using rouge in Sidekiq jobs to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2018-15472

Affected Products

Gitlab

Gitlab Ce/Ee

References · 10

• https://cve.org/CVERecord?id=CVE-2018-15472 · Security Note
• https://ubuntu.com/security/CVE-2018-15472 · Vendor Advisory
• https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-15472 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-15472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15472 · Security Note
• https://about.gitlab.com/blog/categories/releases · Note
• https://t.me/cvenotify/49070 · Telegram Post
• https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15472 · Note