CVE-2022-3759 — Uncontrolled Resource Consumption in Gitlab

CWE-400 — Uncontrolled Resource Consumption6 documents6 sources
Severity
7.5HIGHNVD
EPSS
1.8%
top 17.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedFeb 13
Latest updateJun 21

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶NVDgitlab/gitlab14.3 — 15.6.7+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=14.3, <15.6.7, >=15.7, <15.7.6, >=15.8, <15.8.1+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-c729-m2g9-m3xv: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14↗2023-02-14
▶
OSV
CVE-2022-3759: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14↗2023-02-13
▶

📋Vendor Advisories

2
GitLab
CVE-2022-3759: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, a↗2023-02-13
▶
Debian
CVE-2022-3759: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro...↗2022
▶

📄Research Papers

1
arXiv
ICAR, a categorical framework to connect vulnerability, threat and asset managements↗2023-06-21
▶