CVE-2023-3364: Inefficient Regular Expression Complexity in GitLab

Q: What is the vulnerability ID for this issue in GitLab?

The vulnerability ID for this issue in GitLab is CVE-2023-3364.

Q: Which versions of GitLab are affected by CVE-2023-3364?

All versions starting from 8.14 before 16.0.8 and all versions starting from 16.1 before 16.1.3, and all versions starting from 16.2 before 16.2.2 of GitLab are affected by CVE-2023-3364.

Q: What is the severity of CVE-2023-3364?

The severity of CVE-2023-3364 is high.

Q: What is the Common Weakness Enumeration (CWE) ID for CVE-2023-3364?

The Common Weakness Enumeration (CWE) ID for CVE-2023-3364 is CWE-1333 and CWE-400.

Q: Where can I find more information about CVE-2023-3364?

You can find more information about CVE-2023-3364 on HackerOne (https://hackerone.com/reports/1959727) and GitLab's official issue tracker (https://gitlab.com/gitlab-org/gitlab/-/issues/415995).

Published Aug 1, 2023

Updated

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the previewmarkdown endpoint.

Affected Software

6 affected components

GitLab GitLab>=16.2<16.2.2

GitLab GitLab>=16.1<16.1.3

GitLab GitLab>=8.14<16.0.8

Remediation

Information

Upgrade to versions 16.2.2, 16.1.3, 16.0.8 or above.

Event History

Aug 1, 2023

CVE Published

via MITRE·11:36 PM

Data Sourced

via MITRE·11:36 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue in GitLab?

The vulnerability ID for this issue in GitLab is CVE-2023-3364.

Which versions of GitLab are affected by CVE-2023-3364?