CVE-2018-15472: 
GitLab vulnerability analysis and mitigation

A vulnerability (CVE-2018-15472) was discovered in GitLab Community and Enterprise Edition affecting versions before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The issue was discovered in the diff formatter using rouge, which could block for a long time in Sidekiq jobs without any timeout. The vulnerability was disclosed on October 1, 2018 (GitLab Release).

The vulnerability is related to the diff formatter component using rouge in GitLab's Sidekiq jobs implementation. The issue stems from the lack of a timeout mechanism in the diff formatter, which could lead to extended blocking periods. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could result in a denial of service condition due to the diff formatter blocking Sidekiq jobs for extended periods without timeout controls. This could affect the availability of the GitLab instance (GitLab Release).

The vulnerability has been fixed in GitLab versions 11.1.7, 11.2.4, and 11.3.1. Users are strongly recommended to upgrade to one of these patched versions immediately to mitigate the risk (GitLab Release).

The vulnerability was responsibly reported by Bastian Blank, and GitLab addressed it promptly through their security release process (GitLab Release).