CVE-2019-13003: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab Community and Enterprise Edition before version 12.0.3, where one of the parsers used by GitLab CI was vulnerable to a resource exhaustion attack. The vulnerability was assigned CVE-2019-13003 and was disclosed on July 3, 2019 (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The weakness has been classified as CWE-400 (Uncontrolled Resource Consumption). The vulnerability affects all versions of GitLab CE/EE prior to version 12.0.3 (NVD).

The vulnerability could lead to a resource exhaustion condition, potentially affecting the availability of the GitLab CI service. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, there is a high impact on system availability (NVD).

The issue has been fixed in GitLab version 12.0.3. GitLab strongly recommends that all installations running affected versions be upgraded to the latest version as soon as possible (GitLab Release).

The vulnerability was responsibly reported by @leipert to GitLab's security team (GitLab Release).