CVE-2018-15472

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.1.0 through 11.1.7 GitLab Community and Enterprise Edition versions 11.2.0 through 11.2.4 GitLab Community and Enterprise Edition versions 11.3.0 through 11.3.1

Description An issue was discovered in the diff formatter using rouge, which can block for a long time in Sidekiq jobs without any timeout.

Recommendations For versions 11.1.0 through 11.1.7, update to version 11.1.7 or later. For versions 11.2.0 through 11.2.4, update to version 11.2.4 or later. For versions 11.3.0 through 11.3.1, update to version 11.3.1 or later. As a temporary workaround, consider restricting the use of the diff formatter using rouge in Sidekiq jobs to minimize the risk of exploitation.