CVE-2023-6489: Redos on Integrations Chat Messages
A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.8.6Fixed in 16.9.4Fixed in 16.10.2 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.8.6Patch CVE-2023-6489 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.9.4Patch CVE-2023-6489 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.10.2Patch CVE-2023-6489
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6489?
CVE-2023-6489 is classified as a denial of service vulnerability affecting specific versions of GitLab.
How do I fix CVE-2023-6489?
To remediate CVE-2023-6489, upgrade your GitLab instance to version 16.8.6 or later, or 16.9.4 or later, or 16.10.2 or later.
What versions of GitLab are affected by CVE-2023-6489?
CVE-2023-6489 affects GitLab versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4, and 16.10 prior to 16.10.2.
What can an attacker do with CVE-2023-6489?
An attacker exploiting CVE-2023-6489 can cause resource usage spikes in GitLab, leading to service degradation.
Is chat integration in GitLab related to CVE-2023-6489?
Yes, the chat integration feature in GitLab is specifically related to the denial of service vulnerability found in CVE-2023-6489.