GitLab CE/EE Denial-of-Service Vulnerability in Terraform State Lock API

A denial-of-service vulnerability has been addressed in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 12.10 prior to 18.8.9, 18.9 prior to 18.9.5, and 18.10 prior to 18.10.3. The issue allowed an unauthenticated user to disrupt service by exploiting improper input validation of JSON payloads, potentially leading to resource exhaustion.

Impact

Exploitation of this vulnerability could cause a denial-of-service condition, disrupting normal operations by overwhelming server resources or processes.

Remediation

Users are advised to upgrade to GitLab versions 18.10.3, 18.9.5, or 18.8.9. Instructions for updating GitLab can be found in the GitLab Update documentation. Note that the SLES 12.5 packages for 18.10.3 and 18.9.5 are not present in this release.