CVE-2021-22187: 
GitLab vulnerability analysis and mitigation

A resource exhaustion vulnerability was discovered in GitLab (CVE-2021-22187) affecting all versions of GitLab Enterprise Edition (EE) and Community Edition (CE) before 13.6.7. The vulnerability allowed running or pending jobs to continue even after a project was deleted, potentially leading to system resource exhaustion (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. It is categorized under CWE-400 (Uncontrolled Resource Consumption). The issue specifically affects the job processing system in GitLab, where resource management failed to properly handle job termination when projects were deleted (NVD).

The vulnerability could lead to resource exhaustion in the GitLab instance, as jobs would continue to consume system resources even after their associated projects were deleted. This could potentially affect system availability and performance (GitLab Release).

The vulnerability requires low attack complexity and can be exploited remotely with low privileges. No user interaction is required for exploitation. However, there are no public reports of this vulnerability being actively exploited in the wild (NVD).

GitLab has addressed this vulnerability in versions 13.6.7, 13.7.7, and 13.8.4. Users are strongly recommended to upgrade to one of these versions or later to mitigate the issue. The fix was released as part of a security release on February 11, 2021 (GitLab Release).