#VU54087 Resource exhaustion in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2021-22217
Vulnerability identifier: #VU54087
Vulnerability risk: Medium
CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID:
CWE-ID:
CWE-400
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Gitlab Community Edition
Universal components / Libraries /
Software for developers
GitLab Enterprise Edition
Universal components / Libraries /
Software for developers
Vendor: GitLab, Inc
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote authenticated attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Gitlab Community Edition: 0.1.5, 0.8.0, 0.9.1 - 0.9.6, 1.0 - 1.0.2, 1.1 - 1.1.0, 1.2.0 - 1.2.2, 2.0 - 2.0.0, 2.1 - 2.1.0, 2.2 - 2.2.0, 2.3 - 2.3.1, 2.4 - 2.4.2, 2.5 - 2.5.0, 2.6 - 2.6.3, 2.7 - 2.7.0, 2.8 - 2.8.2, 2.9 - 2.9.1, 3.0 - 3.0.3, 3.1 - 3.1.0, 4.0 - 4.0.0, 4.1 - 4.1.0, 4.2 - 4.2.0, 5.0 - 5.0.1, 5.1 - 5.1.0, 5.2 - 5.2.1, 5.3 - 5.3.0, 5.4 - 5.4.2, 6.0 - 6.0.2, 6.1 - 6.1.0, 6.2 - 6.2.4, 6.3 - 6.3.1, 6.4 - 6.4.3, 6.5 - 6.5.1, 6.6 - 6.6.5, 6.7 - 6.7.5, 6.8 - 6.8.2, 6.9 - 6.9.2, 7.0 - 7.0.1, 7.1 - 7.1.1, 7.2 - 7.2.3, 7.3 - 7.3.3, 7.4 - 7.4.5, 7.5 - 7.5.3, 7.6 - 7.6.3, 7.7 - 7.7.2, 7.8 - 7.8.4, 7.9 - 7.9.4, 7.10 - 7.10.5, 7.11 - 7.11.4, 7.12 - 7.12.2, 7.13 - 7.13.5, 7.14 - 7.14.3, 8.0 - 8.0.5, 8.1 - 8.1.4, 8.2 - 8.2.6, 8.3 - 8.3.10, 8.4 - 8.4.11, 8.5 - 8.5.13, 8.6 - 8.6.9, 8.7 - 8.7.9, 8.8 - 8.8.9, 8.9 - 8.9.11, 8.10 - 8.10.13, 8.11 - 8.11.11, 8.12 - 8.12.13, 8.13 - 8.13.12, 8.14 - 8.14.10, 8.15 - 8.15.8, 8.16.0 - 8.16.9, 8.17 - 8.17.8, 9.0 - 9.0.13, 9.1 - 9.1.10, 9.2 - 9.2.10, 9.3 - 9.3.11, 9.4 - 9.4.7, 9.5 - 9.55, 10.0 - 10.0.7, 10.1 - 10.1.7, 10.2 - 10.2.8, 10.3 - 10.3.9, 10.4 - 10.4.7, 10.5 - 10.5.8, 10.6 - 10.6.6, 10.7 - 10.7.7, 10.8 - 10.8.7, 11.0 - 11.0.6, 11.1 - 11.1.8, 11.2 - 11.2.8, 11.3 - 11.3.14, 11.4 - 11.4.14, 11.5.0 - 11.5.11, 11.6.0 - 11.6.11, 11.7.0 - 11.7.12, 11.8.0 - 11.8.10, 11.9.0 - 11.9.12, 11.10.0 - 11.10.8, 11.11.0 - 11.11.8, 12.0.0 - 12.0.12, 12.1.0 - 12.1.17, 12.2.0 - 12.2.12, 12.3.0 - 12.3.9, 12.4.0 - 12.4.8, 12.5.0 - 12.5.10, 12.6.0 - 12.6.8, 12.7.0 - 12.7.9, 12.8.0 - 12.8.10, 12.9.0 - 12.9.10, 12.10.0 - 12.10.14, 13.0.0 - 13.0.14, 13.1.0 - 13.10.4, 13.2.0 - 13.2.10, 13.3.0 - 13.3.9, 13.4.0 - 13.4.7, 13.5.0 - 13.5.7, 13.6.0 - 13.6.7, 13.7.0 - 13.7.9, 13.8.0 - 13.8.8, 13.9.0 - 13.9.7, 13.11.0 - 13.11.4, 13.12.0 - 13.12.1
GitLab Enterprise Edition: 6.2.0, 6.3.0, 6.4.0, 6.5.0, 6.6.0 - 6.6.2, 6.7.0 - 6.7.1, 6.8.0, 6.9.0 - 6.9.4, 7.0.0, 7.1.0 - 7.10.1, 7.2.0, 7.3.0, 7.4.0 - 7.4.4, 7.5.0 - 7.5.3, 7.6.0 - 7.6.2, 7.7.0, 7.8.0, 7.9.0, 7.11.0 - 7.11.4, 7.12.0 - 7.12.2, 7.13.0 - 7.13.3, 7.14.0 - 7.14.3, 8.0.0 - 8.0.6, 8.1.0 - 8.1.4, 8.2.0 - 8.2.6, 8.3.0 - 8.3.10, 8.4.0 - 8.4.11, 8.5.0 - 8.5.13, 8.6.0 - 8.6.9, 8.7.0 - 8.7.9, 8.8.0 - 8.8.9, 8.9.0 - 8.9.10, 8.10.0 - 8.10.12, 8.11.0 - 8.11.11, 8.12.0 - 8.12.12, 8.13.0 - 8.13.12, 8.14.0 - 8.14.10, 8.15.0 - 8.15.8, 8.16.0 - 8.16.9, 8.17.0 - 8.17.8, 9.0.0 - 9.0.13, 9.1.0 - 9.1.10, 9.2.0 - 9.2.10, 9.3.0 - 9.3.11, 9.4.0 - 9.4.7, 9.5.0 - 9.5.10, 10.0.0 - 10.0.7, 10.1.0 - 10.1.7, 10.2.0 - 10.2.8, 10.3.0 - 10.3.9, 10.4.0 - 10.4.7, 10.5.0 - 10.5.8, 10.6.0 - 10.6.6, 10.7.0 - 10.7.7, 10.8.0 - 10.8.6, 11.0.0 - 11.0.6, 11.1.0 - 11.1.7, 11.2.0 - 11.2.8, 11.3.0 - 11.3.14, 11.4.0 - 11.4.9, 11.5.0 - 11.5.11, 11.6.0 - 11.6.11, 11.7.0 - 11.7.12, 11.8.0 - 11.8.10, 11.9.0 - 11.9.12, 11.10.0 - 11.10.8, 11.11.0 - 11.11.8, 12.0.0 - 12.0.12, 12.1.1 - 12.1.14, 12.2.0 - 12.2.11, 12.3.0 - 12.3.9, 12.4.0 - 12.4.8, 12.5.0 - 12.5.9, 12.6.0 - 12.6.7, 12.7.0 - 12.7.9, 12.8.0 - 12.8.10, 12.9.0 - 12.9.10, 12.10.0 - 12.10.14, 13.0.0 - 13.0.14, 13.1.0 - 13.1.10, 13.2.0 - 13.2.10, 13.3.0 - 13.3.9, 13.4.0 - 13.4.7, 13.5.0 - 13.5.7, 13.6.0 - 13.6.7, 13.7.0 - 13.7.9, 13.8.0 - 13.8.8, 13.9.0 - 13.9.7, 13.10.0 - 13.10.4, 13.11.0 - 13.11.4, 13.12.0
External links
https://gitlab.com/gitlab-org/gitlab/-/issues/300709
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22217.json
https://hackerone.com/reports/1090049
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
