CVE-2023-6159
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a `Cargo.toml` containing maliciously crafted input.
Summary dbcve.org
A Regular Expression Denial of Service (ReDoS) vulnerability exists in GitLab CE/EE's parsing of Cargo.toml files (Rust package manifests). When GitLab processes a maliciously crafted Cargo.toml file containing a specially crafted regular expression, it can cause excessive CPU consumption leading to service degradation or unavailability. The attack requires no authentication or special privileges.
Mitigation
Upgrade GitLab to version 16.6.6, 16.7.4, 16.8.1 or later. As a workaround, consider restricting or validating uploaded Cargo.toml files through GitLab's upload controls or implementing rate limiting on repository parsing operations.