← Back

CVE-2024-3114

nvd nist
Published: Aug 8, 2024Modified: Aug 30, 2024

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regular expression DoS attack on the server.

Affected (6)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
From 11.10.0 to 17.0.6
Gitlab
From 17.1.0 to 17.1.4
Gitlab
From 17.2.0 to 17.2.2
Gitlab
From 11.10.0 to 17.0.6
Gitlab
From 17.1.0 to 17.1.4
Gitlab
From 17.2.0 to 17.2.2

Related CWEs

CWE-1333
Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References (2)

Source: cve@gitlab.com
Broken Link
Source: cve@gitlab.com
Permissions Required

Timeline

No history available yet.