CVE-2022-1100: Input Validation
A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 14.7.7 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 14.8.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 14.9.2
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1100?
CVE-2022-1100 is classified as a potential denial-of-service (DoS) vulnerability in GitLab.
What versions of GitLab are affected by CVE-2022-1100?
CVE-2022-1100 affects all versions of GitLab from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2.
How do I fix CVE-2022-1100?
To mitigate CVE-2022-1100, upgrade to GitLab versions 14.7.7, 14.8.5, or 14.9.2 or later.
What type of vulnerability is CVE-2022-1100?
CVE-2022-1100 is identified as a regular expression (regex) denial-of-service vulnerability.
Can CVE-2022-1100 be exploited remotely?
Yes, CVE-2022-1100 can potentially be exploited remotely if the vulnerable versions of GitLab are accessible.