CVE-2023-6736: ReDoS issue in the Codeowners reference extractor
An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted content in the CODEOWNERS file.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6736?
CVE-2023-6736 is rated as a moderate severity vulnerability due to its potential to cause a client-side denial of service.
How do I fix CVE-2023-6736?
To fix CVE-2023-6736, upgrade to GitLab versions 16.7.6, 16.8.3, or 16.9.1 or later.
Which versions of GitLab are affected by CVE-2023-6736?
CVE-2023-6736 affects GitLab EE versions from 11.3 before 16.7.6, 16.8 before 16.8.3, and 16.9 before 16.9.1.
Is CVE-2023-6736 exploitable remotely?
CVE-2023-6736 can be exploited remotely as it involves client-side interactions.
What type of attack does CVE-2023-6736 enable?
CVE-2023-6736 enables an attacker to cause a client-side denial of service using specially crafted requests.