CVE-2023-3909
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file.
Summary dbcve.org
A Regular Expression Denial of Service (ReDoS) vulnerability exists in GitLab CE/EE where parsing large strings in the timeout input field of .gitlab-ci.yml files can cause excessive CPU consumption due to inefficient regex processing, leading to service degradation or unavailability.
Mitigation
Upgrade GitLab to version 16.3.6, 16.4.2, 16.5.1 or later. Alternatively, restrict who can modify CI/CD pipeline configurations and validate .gitlab-ci.yml files before acceptance.