Lucene search

Ubuntu.comUB:CVE-2023-2132

HistoryJun 06, 2023 - 12:00 a.m.

CVE-2023-2132

2023-06-0600:00:00

ubuntu.com

gitlab

version 15.4

version 15.10.8

version 15.11

version 15.11.7

version 16.0

version 16.0.2

dollarmathpostfilter

regex

dos

preview_markdown

endpoint

unix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

30.8%

JSON

An issue has been discovered in GitLab CE/EE affecting all versions
starting from 15.4 before 15.10.8, all versions starting from 15.11 before
15.11.7, all versions starting from 16.0 before 16.0.2. A
DollarMathPostFilter Regular Expression Denial of Service in was possible
by sending crafted payloads to the preview_markdown endpoint.

OSVersionArchitecturePackageVersionFilename
ubuntu16.04noarchgitlab< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	16.04	noarch	gitlab	< any	UNKNOWN

References

gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2132.json

gitlab.com/gitlab-org/gitlab/-/issues/407586

hackerone.com/reports/1934711

launchpad.net/bugs/cve/CVE-2023-2132

nvd.nist.gov/vuln/detail/CVE-2023-2132

security-tracker.debian.org/tracker/CVE-2023-2132

www.cve.org/CVERecord?id=CVE-2023-2132

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

30.8%

JSON

Related for UB:CVE-2023-2132