BIT-gitlab-2024-2800

vendorUSosv

Uncontrolled Resource Consumption in GitLab

view advisory published 2024-08-10Licence: per source

ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex backtracking.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-2800US	high7.5	0.70% (53rd)	—	2024-08-08
ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2…

references

External citations — patches, advisories, analysis.

https://gitlab.com/gitlab-org/gitlab/-/issues/451293WEB
https://hackerone.com/reports/2416332WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-2800WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan