CVE-2023-5332: Dependency on Vulnerable Third-Party Component in GitLab
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab-EEto a version that resolves this vulnerability.Fixed in 16.2.8 - Upgrade
Upgrade
GitLab-EEto a version that resolves this vulnerability.Fixed in 16.3.5 - Upgrade
Upgrade
GitLab-EEto a version that resolves this vulnerability.Fixed in 16.4.1 - Configuration
Set Consul's enable-script-checks setting to False to enable the vendor patch; this applies to GitLab-EE.
Consul enable-script-checks = False
Event History
Frequently Asked Questions
What is CVE-2023-5332?
CVE-2023-5332 is a vulnerability in GitLab that affects versions 9.5.0 to 16.2.8 and versions 16.3.0 to 16.3.5 of GitLab-EE.
What is the severity of CVE-2023-5332?
CVE-2023-5332 has a severity rating of 8.1 (high).
How does CVE-2023-5332 affect GitLab?
CVE-2023-5332 affects GitLab-EE versions 9.5.0 to 16.2.8 and versions 16.3.0 to 16.3.5. It requires the 'enable-script-checks' setting in the third-party library Consul to be set to False.
Which versions of Consul are affected by CVE-2023-5332?
CVE-2023-5332 affects Consul versions up to 0.9.4 and versions 1.0.0 to 1.0.8, and versions 1.2.0 to 1.2.4.
How can I mitigate the CVE-2023-5332 vulnerability?
To mitigate the CVE-2023-5332 vulnerability, set the 'enable-script-checks' setting in Consul to False. Refer to the vendor's patch for more details.