medium5.9
CVE-2023-5332
Patch in third party library Consul requires 'enable-script-checks' to be set to False.
Impact
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gitlab | Gitlab | from 9.5.0 before 16.2.8 from 16.3.0 before 16.3.5 Version 16.4.0 |
| Hashicorp | Consul | before 0.9.4 from 1.0.0 before 1.0.8 from 1.2.0 before 1.2.4 Version 1.1.0 |
References
- NVD record
- CVE.org record
- https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8171
- https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations
- https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8171
- https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations