CVE-2023-6489: Inefficient Regular Expression Complexity in GitLab
First published: Fri Apr 12 2024(Updated: )
A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=16.7.7<16.8.6 | |
| GitLab | >=16.7.7<16.8.6 | |
| GitLab | >=16.9.0<16.9.4 | |
| GitLab | >=16.9.0<16.9.4 | |
| GitLab | >=16.10.0<16.10.2 | |
| GitLab | >=16.10.0<16.10.2 |
Remedy
Upgrade to versions 16.8.6, 16.9.4, 16.10.2 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-6489?
CVE-2023-6489 is classified as a denial of service vulnerability affecting specific versions of GitLab.
How do I fix CVE-2023-6489?
To remediate CVE-2023-6489, upgrade your GitLab instance to version 16.8.6 or later, or 16.9.4 or later, or 16.10.2 or later.
What versions of GitLab are affected by CVE-2023-6489?
CVE-2023-6489 affects GitLab versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4, and 16.10 prior to 16.10.2.
What can an attacker do with CVE-2023-6489?
An attacker exploiting CVE-2023-6489 can cause resource usage spikes in GitLab, leading to service degradation.
Is chat integration in GitLab related to CVE-2023-6489?
Yes, the chat integration feature in GitLab is specifically related to the denial of service vulnerability found in CVE-2023-6489.
- agent/remedy
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/16.7.7
- version/gitlab/16.9.0
- version/gitlab/16.10.0