CVE-2023-5332: Dependency on Vulnerable Third-Party Component in GitLab

Q: What is CVE-2023-5332?

CVE-2023-5332 is a vulnerability in GitLab that affects versions 9.5.0 to 16.2.8 and versions 16.3.0 to 16.3.5 of GitLab-EE.

Q: What is the severity of CVE-2023-5332?

CVE-2023-5332 has a severity rating of 8.1 (high).

Q: How does CVE-2023-5332 affect GitLab?

CVE-2023-5332 affects GitLab-EE versions 9.5.0 to 16.2.8 and versions 16.3.0 to 16.3.5. It requires the 'enable-script-checks' setting in the third-party library Consul to be set to False.

Q: Which versions of Consul are affected by CVE-2023-5332?

CVE-2023-5332 affects Consul versions up to 0.9.4 and versions 1.0.0 to 1.0.8, and versions 1.2.0 to 1.2.4.

Q: How can I mitigate the CVE-2023-5332 vulnerability?

To mitigate the CVE-2023-5332 vulnerability, set the 'enable-script-checks' setting in Consul to False. Refer to the vendor's patch for more details.

Published Dec 4, 2023

Updated

Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.

Affected Software

7 affected components

GitLab GitLab>=9.5.0<16.2.8

GitLab GitLab>=16.3.0<16.3.5

GitLab GitLab=16.4.0

HashiCorp Consul<0.9.4

HashiCorp Consul>=1.0.0<1.0.8

HashiCorp Consul>=1.2.0<1.2.4

HashiCorp Consul=1.1.0

Remediation

Information

Upgrade to versions 16.2.8, 16.3.5, 16.4.1 or above.

Patch Available

https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations

Event History

Dec 4, 2023

CVE Published

06:30 AM

Data Sourced

06:30 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-5332?

CVE-2023-5332 is a vulnerability in GitLab that affects versions 9.5.0 to 16.2.8 and versions 16.3.0 to 16.3.5 of GitLab-EE.

What is the severity of CVE-2023-5332?

CVE-2023-5332 has a severity rating of 8.1 (high).

How does CVE-2023-5332 affect GitLab?