CVE-2023-3385
published 2023-08-02CVE-2023-3385: An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.73%
49.9th percentile
An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 16.0.8+ds1-1 (sid) | gitlab 16.0.8+ds1-1 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 16.1 < 16.1.3 | 16.1.3 |
| gitlab | gitlab | >= 16.1.0 < 16.1.3 | 16.1.3 |
| gitlab | gitlab | >= 16.2 < 16.2.2 | 16.2.2 |
| gitlab | gitlab | >= 16.2.0 < 16.2.2 | 16.2.2 |
| gitlab | gitlab | >= 8.10 < 16.0.8 | 16.0.8 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv6.5MEDIUM
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
gitlab: tar utility causes importing a project access to read unauthorized files
vendor_redhat·2023-08-02·CVSS 6.3
CVE-2023-3385 [MEDIUM] gitlab: tar utility causes importing a project access to read unauthorized files
gitlab: tar utility causes importing a project access to read unauthorized files
An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).
Statement: The GitLab package used in OpenShift is a GitLab API NodeJS library which is not affected by CVE-2023-3385.
Package: openshift4/ose-console (Red Hat OpenShift Container Platform 4) - Not affected
GitLab
CVE-2023-3385: An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all ver
vendor_gitlab·2023-08-02·CVSS 6.3
CVE-2023-3385 [MEDIUM] CWE-22 CVE-2023-3385: An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all ver
CVE-2023-3385: An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).
Debian
CVE-2023-3385: gitlab - An issue has been discovered in GitLab affecting all versions starting from 8.10...
vendor_debian·2023·CVSS 6.3
CVE-2023-3385 [MEDIUM] CVE-2023-3385: gitlab - An issue has been discovered in GitLab affecting all versions starting from 8.10...
An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).
Scope: local
sid: resolved (fixed in 16.0.8+ds1-1)
OSV
CVE-2023-3385: An issue has been discovered in GitLab affecting all versions starting from 8
osv·2023-08-02·CVSS 6.5
CVE-2023-3385 [MEDIUM] CVE-2023-3385: An issue has been discovered in GitLab affecting all versions starting from 8
An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).
GHSA
GHSA-f8q5-vhrp-8mfc: An issue has been discovered in GitLab affecting all versions starting from 8
ghsa_unreviewed·2023-08-02
CVE-2023-3385 [MEDIUM] CWE-22 GHSA-f8q5-vhrp-8mfc: An issue has been discovered in GitLab affecting all versions starting from 8
An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-08-02
Published