CVE-2022-2908: Medium severity gitlab vulnerability

Q: What is the severity of CVE-2022-2908?

CVE-2022-2908 is classified as a denial of service (DoS) vulnerability, which can lead to high CPU usage.

Q: How do I fix CVE-2022-2908?

To mitigate CVE-2022-2908, update GitLab to version 15.1.5 or later, 15.2.3 or later, or 15.3.1 or later.

Q: Which versions of GitLab are affected by CVE-2022-2908?

CVE-2022-2908 affects GitLab CE/EE versions starting from 10.7 up to 15.3 before 15.3.1.

Q: What causes the CVE-2022-2908 vulnerability?

CVE-2022-2908 is caused by a specially crafted input in the commit message that can trigger excessive CPU usage.

Q: Is CVE-2022-2908 exploitable remotely?

Yes, CVE-2022-2908 can be exploited remotely by sending a specially crafted commit message.

Published Oct 17, 2022

Updated

A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit message field.

Affected Software

6 affected components

GitLab GitLab>=10.7.0<15.1.5

GitLab GitLab>=15.2<15.2.3

GitLab GitLab>=15.3<15.3.1

Event History

Oct 17, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-2908?

CVE-2022-2908 is classified as a denial of service (DoS) vulnerability, which can lead to high CPU usage.

How do I fix CVE-2022-2908?

To mitigate CVE-2022-2908, update GitLab to version 15.1.5 or later, 15.2.3 or later, or 15.3.1 or later.

Which versions of GitLab are affected by CVE-2022-2908?