cve-2024-7610
Vulnerability from cvelistv5
Published
2024-08-08 10:30
Modified
2024-08-29 15:05
Severity
Summary
Uncontrolled Resource Consumption in GitLab
References
Source | URL | Tags |
---|---|---|
cve@gitlab.com | https://gitlab.com/gitlab-org/gitlab/-/issues/468917 | Broken Link |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-7610", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-08-08T12:53:54.759743Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-08T12:54:03.483Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "17.0.6", "status": "affected", "version": "15.9", "versionType": "semver" }, { "lessThan": "17.1.4", "status": "affected", "version": "17.1", "versionType": "semver" }, { "lessThan": "17.2.2", "status": "affected", "version": "17.2", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "This vulnerability was discovered internally by GitLab team member [Terri Chu](https://gitlab.com/terrichu)" } ], "descriptions": [ { "lang": "en", "value": "A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-08-29T15:05:01.225Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #468917", "tags": [ "issue-tracking", "permissions-required" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/468917" } ], "solutions": [ { "lang": "en", "value": "Upgrade to versions 17.2.2, 17.1.4, 17.0.6 or above." } ], "title": "Uncontrolled Resource Consumption in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2024-7610", "datePublished": "2024-08-08T10:30:43.133Z", "dateReserved": "2024-08-08T10:02:04.174Z", "dateUpdated": "2024-08-29T15:05:01.225Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2024-7610\",\"sourceIdentifier\":\"cve@gitlab.com\",\"published\":\"2024-08-08T11:15:13.857\",\"lastModified\":\"2024-08-29T15:45:27.523\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch.\"},{\"lang\":\"es\",\"value\":\"Se descubri\u00f3 una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en GitLab CE/EE que afecta a todas las versiones comenzando con 15.9 anterior a 17.0.6, 17.1 anterior a 17.1.4 y 17.2 anterior a 17.2.2. Es posible que un atacante provoque un retroceso catastr\u00f3fico mientras analiza los resultados de Elasticsearch.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6},{\"source\":\"cve@gitlab.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]},{\"source\":\"cve@gitlab.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"15.9.0\",\"versionEndExcluding\":\"17.0.6\",\"matchCriteriaId\":\"684A0BB7-D809-4BD0-BEC2-4D9F25094978\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"15.9.0\",\"versionEndExcluding\":\"17.0.6\",\"matchCriteriaId\":\"A6E0DBD3-010A-405C-9EFB-FB98058CA5A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndExcluding\":\"17.1.4\",\"matchCriteriaId\":\"6CA14692-9997-4A11-8B3D-29199A3498D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndExcluding\":\"17.1.4\",\"matchCriteriaId\":\"39754D78-BBE0-41D9-B2AB-5402B32C8ECF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"17.2.0\",\"versionEndExcluding\":\"17.2.2\",\"matchCriteriaId\":\"153C136B-FF14-43EC-AE67-68273DF7D9ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"17.2.0\",\"versionEndExcluding\":\"17.2.2\",\"matchCriteriaId\":\"2BE7EFA9-D9B4-4E7E-81B2-597D3DC5756E\"}]}]}],\"references\":[{\"url\":\"https://gitlab.com/gitlab-org/gitlab/-/issues/468917\",\"source\":\"cve@gitlab.com\",\"tags\":[\"Broken Link\"]}]}}" } }
Loading...