OpenCVE

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Gitlab	Gitlab

No data.

No data.

References

Link	Providers
https://gitlab.com/gitlab-org/gitlab/-/issues/451456
https://hackerone.com/reports/2416728
https://nvd.nist.gov/vuln/detail/CVE-2024-2829
https://www.cve.org/CVERecord?id=CVE-2024-2829

History

Thu, 03 Oct 2024 06:30:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Resource Consumption in GitLab	Inefficient Regular Expression Complexity in GitLab
Weaknesses		CWE-1333

Thu, 19 Sep 2024 02:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 29 Aug 2024 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Gitlab Gitlab gitlab
CPEs		cpe:2.3:a:gitlab:gitlab::::::::
Vendors & Products		Gitlab Gitlab gitlab

MITRE

Status: PUBLISHED

Assigner: GitLab

Published: 2024-04-25T11:02:06.060Z

Updated: 2024-10-03T06:23:19.077Z

Reserved: 2024-03-22T14:30:44.843Z

Link: CVE-2024-2829

Vulnrichment

Updated: 2024-08-01T19:25:41.746Z

NVD

Status : Awaiting Analysis

Published: 2024-04-25T11:15:46.057

Modified: 2024-11-21T09:10:37.657

Link: CVE-2024-2829

Redhat

Severity : Moderate

Publid Date: 2024-04-25T00:00:00Z

Links: CVE-2024-2829 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2829", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2024-03-22T14:30:44.843Z", "datePublished": "2024-04-25T11:02:06.060Z", "dateUpdated": "2024-10-03T06:23:19.077Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "16.9.6", "status": "affected", "version": "12.5", "versionType": "semver"}, {"lessThan": "16.10.4", "status": "affected", "version": "16.10", "versionType": "semver"}, {"lessThan": "16.11.1", "status": "affected", "version": "16.11", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program"}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-10-03T06:23:19.077Z"}, "references": [{"name": "GitLab Issue #451456", "tags": ["issue-tracking", "permissions-required"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/451456"}, {"name": "HackerOne Bug Bounty Report #2416728", "tags": ["technical-description", "exploit", "permissions-required"], "url": "https://hackerone.com/reports/2416728"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 16.9.6, 16.10.4, 16.11.1 or above."}], "title": "Inefficient Regular Expression Complexity in GitLab"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-30T15:46:53.301518Z", "id": "CVE-2024-2829", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-17T15:34:48.078Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:25:41.746Z"}, "title": "CVE Program Container", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/451456", "name": "GitLab Issue #451456", "tags": ["issue-tracking", "permissions-required", "x_transferred"]}, {"url": "https://hackerone.com/reports/2416728", "name": "HackerOne Bug Bounty Report #2416728", "tags": ["technical-description", "exploit", "x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/451456", "name": "GitLab Issue #451456", "tags": ["issue-tracking", "permissions-required", "x_transferred"]}, {"url": "https://hackerone.com/reports/2416728", "name": "HackerOne Bug Bounty Report #2416728", "tags": ["technical-description", "exploit", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:25:41.746Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2829", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-30T15:46:53.301518Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-30T15:48:07.500Z"}}], "cna": {"title": "Inefficient Regular Expression Complexity in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "12.5", "lessThan": "16.9.6", "versionType": "semver"}, {"status": "affected", "version": "16.10", "lessThan": "16.10.4", "versionType": "semver"}, {"status": "affected", "version": "16.11", "lessThan": "16.11.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 16.9.6, 16.10.4, 16.11.1 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/451456", "name": "GitLab Issue #451456", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/2416728", "name": "HackerOne Bug Bounty Report #2416728", "tags": ["technical-description", "exploit", "permissions-required"]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-10-03T06:23:19.077Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2829", "state": "PUBLISHED", "dateUpdated": "2024-10-03T06:23:19.077Z", "dateReserved": "2024-03-22T14:30:44.843Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2024-04-25T11:02:06.060Z", "assignerShortName": "GitLab"}, "dataVersion": "5.1"}