MEDIUM

CVE-2024-1963

Gitlab GitLab 2024-06-12 CVSS v3.1

CVSS

6.5

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's Asana integration allowed an attacker to potentially cause a regular expression denial of service by sending specially crafted requests.

Summary dbcve.org

A regular expression denial of service (ReDoS) vulnerability exists in GitLab's Asana integration across versions 8.4 through 16.10.7, 16.11.0-16.11.4, and 17.0.0-17.0.2. Attackers can send specially crafted requests that cause excessive regex processing, leading to service degradation or unavailability.

Mitigation

Upgrade GitLab to version 16.10.7, 16.11.4, 17.0.2 or later to patch the ReDoS vulnerability in the Asana integration.

Weakness (CWE)

CWE-1333

EPSS Score

0.58%

Probability of exploitation in next 30 days

46.2th percentile

References

https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#redos-in-asana-integration-issue-mapping-when-webhook-is-called Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/443577 Vendor Advisory https://hackerone.com/reports/2376482 Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE