Description
In specific circumstances, trace file buffers in GitLab Runner versions up to 14.3.4, 14.4 to 14.4.2, and 14.5 to 14.5.2 would re-use the file descriptor 0 for multiple traces and mix the output of several jobs
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- gitlab / GitLab Runner<14.3.4 – <14.3.4
- gitlab / GitLab Runner>=14.4, <14.4.2 – >=14.4, <14.4.2
- gitlab / GitLab Runner>=14.5, <14.5.2 – >=14.5, <14.5.2