CVE-2023-5825: Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab
First published: Mon Nov 06 2023(Updated: )
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A low-privileged attacker can point a CI/CD Component to an incorrect path and cause the server to exhaust all available memory through an infinite loop and cause Denial of Service.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=16.2.0<16.3.6 | |
| GitLab | >=16.2.0<16.3.6 | |
| GitLab | >=16.4.0<16.4.2 | |
| GitLab | >=16.4.0<16.4.2 | |
| GitLab | =16.5.0 | |
| GitLab | =16.5.0 |
Remedy
Upgrade to versions 16.5.1, 16.4.2, 16.3.6 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this GitLab vulnerability?
The vulnerability ID for this GitLab vulnerability is CVE-2023-5825.
What is the severity of CVE-2023-5825?
CVE-2023-5825 has a severity of medium (6.5).
Which versions of GitLab are affected by this vulnerability?
This vulnerability affects all versions of GitLab starting from 16.2 before 16.3.6, starting from 16.4 before 16.4.2, and starting from 16.5 before 16.5.1.
How can a low-privileged attacker exploit CVE-2023-5825?
A low-privileged attacker can point a CI/CD Component to an incorrect path and cause the server to exhaust resources.
Is there a fix available for CVE-2023-5825?
Yes, a fix is available for CVE-2023-5825. It is recommended to upgrade to GitLab versions 16.3.6, 16.4.2, or 16.5.1.
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/remedy
- collector/epss-latest
- source/FIRST
- agent/description
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/16.2.0
- version/gitlab/16.4.0
- version/gitlab/16.5.0