CVE-2023-3909: Parsing gitlab-ci.yml with large string via timeout input leads to Denial of Service
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-3909?
CVE-2023-3909 is a vulnerability in GitLab that allows for uncontrolled resource consumption.
Which versions of GitLab are affected by CVE-2023-3909?
All versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, and version 16.5.0 are affected by CVE-2023-3909.
What is the severity of CVE-2023-3909?
CVE-2023-3909 has a severity value of 6.5, which is considered medium.
How can I fix CVE-2023-3909?
To fix CVE-2023-3909, update GitLab to version 16.3.6, 16.4.2, or 16.5.1.
Where can I find more information about CVE-2023-3909?
You can find more information about CVE-2023-3909 on the GitLab issue page (https://gitlab.com/gitlab-org/gitlab/-/issues/418763) and the HackerOne report (https://hackerone.com/reports/2050269).