CVE-2023-6678: Redos During Parse Junit Test Report
An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. It was possible for an attacker to cause a denial of service using malicious crafted content in a junit test report file.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6678?
CVE-2023-6678 has been classified as a moderate severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2023-6678?
To remediate CVE-2023-6678, you should upgrade to GitLab EE version 16.8.6 or later, 16.9.4 or later, or 16.10.2 or later.
Which versions of GitLab EE are affected by CVE-2023-6678?
CVE-2023-6678 affects all GitLab EE versions before 16.8.6, and versions from 16.9 up to but not including 16.9.4, and from 16.10 up to but not including 16.10.2.
What type of attack can exploit CVE-2023-6678?
CVE-2023-6678 can be exploited through a denial of service attack using maliciously crafted content in a JUnit test.
Is CVE-2023-6678 specific to certain GitLab installations?
CVE-2023-6678 specifically impacts GitLab EE installations and not the Community Edition.