CVE-2019-12443: 
GitLab vulnerability analysis and mitigation

A Server-Side Request Forgery (SSRF) vulnerability was discovered in GitLab Community and Enterprise Edition versions 10.2 through 11.11. The vulnerability was caused by insufficient validation to prevent DNS rebinding attacks. The issue was discovered by @nyangawa of Chaitin Tech and was assigned CVE-2019-12443, with the fix being released on June 3, 2019 (GitLab Release, NVD).

The vulnerability stemmed from multiple features containing insufficient validation mechanisms to prevent DNS rebinding attacks, which could lead to Server-Side Request Forgery. After the fix, GitLab implemented a protection mechanism that can be controlled through the Admin Area > Settings > Network > Outbound requests section, where administrators can enable or disable the 'Enforce DNS rebinding attack protection' checkbox (GitLab Release).

The vulnerability could allow attackers to perform Server-Side Request Forgery attacks through DNS rebinding, potentially enabling them to access internal network resources or bypass security controls (NVD).

GitLab addressed this vulnerability in versions 11.11.1, 11.10.5, and 11.9.12. Users were strongly recommended to upgrade their GitLab installations to one of these versions immediately. Additionally, administrators can control the DNS rebinding attack protection through a checkbox in the Admin Area settings (GitLab Release).