CVE-2021-39880

Name	CVE-2021-39880
Description	A Denial Of Service vulnerability in the apollo_upload_server Ruby gem ...
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gitlab (PTS)	sid	17.6.5-19	fixed
ruby-apollo-upload-server (PTS)	bullseye	2.0.3-1	vulnerable
	bookworm	2.1.0-1	fixed
	trixie	2.1.6-1	fixed
	forky, sid	2.1.8-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gitlab	source	(unstable)	15.10.8+ds1-2
ruby-apollo-upload-server	source	(unstable)	2.1.0-1

Notes

[bullseye] - ruby-apollo-upload-server <no-dsa> (Minor issue)
https://gitlab.com/gitlab-org/gitlab/-/issues/330561
https://github.com/jetruby/apollo_upload_server-ruby/commit/b0582c1a3e458eee3c994fb38278bd0221f20486