CVE-2022-3411
13.02.2023, 23:15
A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.Enginsight
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | 12.4 ≤ 𝑥 < 15.6.7 |
| gitlab | gitlab | 12.4 ≤ 𝑥 < 15.6.7 |
| gitlab | gitlab | 15.7 ≤ 𝑥 < 15.7.6 |
| gitlab | gitlab | 15.7 ≤ 𝑥 < 15.7.6 |
| gitlab | gitlab | 15.8 ≤ 𝑥 < 15.8.1 |
| gitlab | gitlab | 15.8 ≤ 𝑥 < 15.8.1 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-1284 - Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
References