CVE-2021-39940: Medium severity gitlab vulnerability

Q: What is the severity of CVE-2021-39940?

CVE-2021-39940 has been classified as a medium severity vulnerability.

Q: How do I fix CVE-2021-39940?

To mitigate CVE-2021-39940, upgrade GitLab to version 14.3.6 or later, 14.4.4 or later, or 14.5.2 or later.

Q: What versions of GitLab are affected by CVE-2021-39940?

CVE-2021-39940 affects GitLab CE/EE versions between 13.2.0 and 14.3.6, 14.4.0 and 14.4.4, and 14.5.0 and 14.5.2.

Q: What type of attack is possible with CVE-2021-39940?

CVE-2021-39940 allows for a regular expression denial of service attack.

Q: Is CVE-2021-39940 present in all GitLab versions?

No, CVE-2021-39940 is only present in specific versions of GitLab prior to the patched releases.

Published Dec 13, 2021

Updated

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab Maven Package registry is vulnerable to a regular expression denial of service when a specifically crafted string is sent.

Affected Software

6 affected components

GitLab GitLab>=13.2.0<14.3.6

GitLab GitLab>=14.4.0<14.4.4

GitLab GitLab>=14.5.0<14.5.2

Event History

Dec 13, 2021

CVE Published

via MITRE·03:47 PM

Data Sourced

via MITRE·03:47 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-39940?

CVE-2021-39940 has been classified as a medium severity vulnerability.

How do I fix CVE-2021-39940?

To mitigate CVE-2021-39940, upgrade GitLab to version 14.3.6 or later, 14.4.4 or later, or 14.5.2 or later.

What versions of GitLab are affected by CVE-2021-39940?