CVE-2021-39880

Name	CVE-2021-39880
Description	A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gitlab (PTS)	sid	16.8.4-1	fixed
ruby-apollo-upload-server (PTS)	bullseye	2.0.3-1	vulnerable
	bookworm	2.1.0-1	fixed
	sid, trixie	2.1.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gitlab	source	(unstable)	15.10.8+ds1-2
ruby-apollo-upload-server	source	(unstable)	2.1.0-1

Notes

[bullseye] - ruby-apollo-upload-server <no-dsa> (Minor issue)
https://gitlab.com/gitlab-org/gitlab/-/issues/330561
https://github.com/jetruby/apollo_upload_server-ruby/commit/b0582c1a3e458eee3c994fb38278bd0221f20486