CVE-2020-13274: 
GitLab vulnerability analysis and mitigation

A security vulnerability (CVE-2020-13274) was identified in GitLab that allowed attackers to achieve Denial of Service (DoS) attacks through memory exhaustion by uploading malicious artifacts. This vulnerability affected all previous GitLab versions through 13.0.1 and was discovered internally by the GitLab Security Team (GitLab Release).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The attack vector is network-accessible, requires low attack complexity, needs no privileges or user interaction, has unchanged scope, and primarily impacts system availability (NVD).

The vulnerability allows attackers to cause Denial of Service conditions through memory exhaustion, potentially making the GitLab service unavailable to legitimate users. The attack specifically targets the Workhorse component and affects system availability while having no direct impact on confidentiality or integrity (GitLab Release).

The vulnerability is exploitable through network access and requires no special privileges or user interaction. The attack can be executed by uploading specially crafted malicious artifacts to the GitLab instance (NVD).

GitLab has addressed this vulnerability in versions 13.0.1, 12.10.7, and 12.9.8 for both Community Edition (CE) and Enterprise Edition (EE). It is strongly recommended that all affected installations be upgraded to one of these patched versions immediately (GitLab Release).