CVE-2023-3364 - Inefficient Regular Expression Complexity in GitLab

Back Back to CVE browser

HIGH

Inefficient Regular Expression Complexity in GitLab

Published Aug 1, 2023

7.5

HIGH

CVSS 3.1

EPSS 44.49%

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  16.1
  Status
  affected
  Constraints
  <16.1.3
- Version
  16.2
  Status
  affected
  Constraints
  <16.2.2
- Version
  8.14
  Status
  affected
  Constraints
  <16.0.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
16.1	affected	<16.1.3
16.2	affected	<16.2.2
8.14	affected	<16.0.8

Product	Package	State	Advisory
Red Hat OpenShift Container Platform 4	openshift4/ose-console	Not affected	n/a

Remediation

Vendor solution

Upgrade to versions 16.2.2, 16.1.3, 16.0.8 or above.

Red Hat statement

The GitLab package used in OpenShift is a GitLab API NodeJS library which is not affected by CVE-2023-3364.

Weaknesses (1)

CWE-1333

References (7)

https://access.redhat.com/security/cve/CVE-2023-3364
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228517
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44031
Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/415995
issue-trackingBroken Link
https://hackerone.com/reports/1959727
technical-descriptionexploitpermissions-requiredPermissions Required
https://nvd.nist.gov/vuln/detail/CVE-2023-3364
https://www.cve.org/CVERecord?id=CVE-2023-3364

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-3364		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228517		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44031		Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/415995		issue-trackingBroken Link
https://hackerone.com/reports/1959727		technical-descriptionexploitpermissions-requiredPermissions Required
https://nvd.nist.gov/vuln/detail/CVE-2023-3364
https://www.cve.org/CVERecord?id=CVE-2023-3364