CVE-2021-39938 — Uncontrolled Resource Consumption in Gitlab

CWE-400 — Uncontrolled Resource Consumption5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 66.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedDec 13
Latest updateDec 14

Description

A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted deploy Slash commands

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶NVDgitlab/gitlab8.15.0 — 14.3.6+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=14.4, <14.4.4, >=14.5, <14.5.2, >=8.15, <14.3.6+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-g8j3-2rcp-jrhm: A vulnerable regular expression pattern in GitLab CE/EE since version 8↗2021-12-14
▶
OSV
CVE-2021-39938: A vulnerable regular expression pattern in GitLab CE/EE since version 8↗2021-12-13
▶

📋Vendor Advisories

2
GitLab
CVE-2021-39938: A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions↗2021-12-13
▶
Debian
CVE-2021-39938: gitlab - A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 befor...↗2021
▶