cve-2024-1493
Vulnerability from cvelistv5
Published
2024-06-26 23:31
Modified
2024-08-30 13:24
Severity
Summary
Uncontrolled Resource Consumption in GitLab
References
Source | URL | Tags |
---|---|---|
cve@gitlab.com | https://gitlab.com/gitlab-org/gitlab/-/issues/441806 | Broken Link |
cve@gitlab.com | https://hackerone.com/reports/2370084 | Permissions Required |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-1493", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-27T18:20:24.801000Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-27T18:20:35.300Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T18:40:21.333Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GitLab Issue #441806", "tags": [ "issue-tracking", "permissions-required", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/441806" }, { "name": "HackerOne Bug Bounty Report #2370084", "tags": [ "technical-description", "exploit", "permissions-required", "x_transferred" ], "url": "https://hackerone.com/reports/2370084" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "16.11.5", "status": "affected", "version": "9.2", "versionType": "semver" }, { "lessThan": "17.0.3", "status": "affected", "version": "17.0", "versionType": "semver" }, { "lessThan": "17.1.1", "status": "affected", "version": "17.1", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program" } ], "descriptions": [ { "lang": "en", "value": "An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the server" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-08-30T13:24:42.450Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #441806", "tags": [ "issue-tracking", "permissions-required" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/441806" }, { "name": "HackerOne Bug Bounty Report #2370084", "tags": [ "technical-description", "exploit", "permissions-required" ], "url": "https://hackerone.com/reports/2370084" } ], "solutions": [ { "lang": "en", "value": "Upgrade to versions 17.1.1, 17.0.3, 16.11.5 or above." } ], "title": "Uncontrolled Resource Consumption in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2024-1493", "datePublished": "2024-06-26T23:31:55.434Z", "dateReserved": "2024-02-14T16:02:21.502Z", "dateUpdated": "2024-08-30T13:24:42.450Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2024-1493\",\"sourceIdentifier\":\"cve@gitlab.com\",\"published\":\"2024-06-27T00:15:10.283\",\"lastModified\":\"2024-08-30T14:15:15.167\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the server\"},{\"lang\":\"es\",\"value\":\" Se descubri\u00f3 un problema en GitLab CE/EE que afecta a todas las versiones desde la 9.2 anterior a la 16.11.5, desde la 17.0 anterior a la 17.0.3 y desde la 17.1 anterior a la 17.1.1, con la l\u00f3gica de procesamiento para generar enlaces en archivos de dependencia puede provocar un ataque DoS de expresi\u00f3n regular en el servidor\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6},{\"source\":\"cve@gitlab.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1333\"}]},{\"source\":\"cve@gitlab.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1333\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"9.2.0\",\"versionEndExcluding\":\"16.11.5\",\"matchCriteriaId\":\"094ACB9D-124C-49F8-A3D6-4DBFCC962BB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"9.2.0\",\"versionEndExcluding\":\"16.11.5\",\"matchCriteriaId\":\"3A3396AE-9030-4C02-955F-62A6AF04702A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"17.0.0\",\"versionEndExcluding\":\"17.0.3\",\"matchCriteriaId\":\"541958DE-CB05-43D9-921B-4ADD2E436BF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"17.0.0\",\"versionEndExcluding\":\"17.0.3\",\"matchCriteriaId\":\"C987EC42-A56B-462A-A0CE-7417CC0FD414\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:17.1.0:*:*:*:community:*:*:*\",\"matchCriteriaId\":\"D2461A15-EA5F-43D1-B359-0F24713A713B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:17.1.0:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"9AA7835D-35E6-44D6-9194-2AC4C38961CE\"}]}]}],\"references\":[{\"url\":\"https://gitlab.com/gitlab-org/gitlab/-/issues/441806\",\"source\":\"cve@gitlab.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://hackerone.com/reports/2370084\",\"source\":\"cve@gitlab.com\",\"tags\":[\"Permissions Required\"]}]}}" } }
Loading...