CVE-2021-39917

Name

CVE-2021-39917

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking that could cause a DOS attack.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
MISC	https://hackerone.com/reports/1277918
MISC	https://gitlab.com/gitlab-org/gitlab/-/issues/338486
CONFIRM	https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39917.json

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:gitlab:gitlab:::::community:::*`	gitlab	>= 12.9.0	< 14.3.6
`cpe:2.3:a:gitlab:gitlab:::::community:::*`	gitlab	>= 14.4.0	< 14.4.4
`cpe:2.3:a:gitlab:gitlab:::::community:::*`	gitlab	>= 14.5.0	< 14.5.2

References

Match rules

Vulnerable and fixed packages