HIGH

CVE-2018-15472

Gitlab GitLab 2023-04-15 CVSS v3.1

CVSS

7.5

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using rouge can block for a long time in Sidekiq jobs without any timeout.

Summary dbcve.org

In GitLab versions before 11.1.7, 11.2.4, and 11.3.1, the diff formatter using the Rouge syntax highlighting library can block indefinitely in Sidekiq background jobs without any timeout mechanism. This allows an attacker to craft inputs that cause the diff formatter to hang for extended periods, leading to denial of service through resource exhaustion and job queue blockage.

Mitigation

Upgrade GitLab to version 11.1.7, 11.2.4, 11.3.1 or later, which includes proper timeout handling for the Rouge diff formatter in Sidekiq jobs.

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

EPSS Score

0.72%

Probability of exploitation in next 30 days

52.5th percentile

References

https://about.gitlab.com/blog/categories/releases/ Release Notes https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/ Release Notes, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE