CVE-2022-1431
Description
An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious requests to the PyPi API endpoint allowing the attacker to cause uncontrolled resource consumption.
Summary dbcve.org
GitLab versions 12.10 through 14.10.1 contain a vulnerability in the PyPi API endpoint where malicious requests are not properly validated, allowing attackers to cause uncontrolled resource consumption and potentially render the service unavailable.
Mitigation
Upgrade GitLab to version 14.8.6, 14.9.4, 14.10.1 or later to patch the vulnerability. Consider implementing rate limiting on API endpoints as a defense-in-depth measure.