CVE-2021-39933: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input (notes, comments, etc) was susceptible to catastrophic backtracking that could cause a DOS attack (GitLab Advisory, NVD).

The vulnerability is related to a regular expression pattern in the front_matter.rb file that processes user input such as notes and comments. The regex pattern uses a \s* ... \s* ... \s* style construction which can result in cubic backtracking, leading to catastrophic performance issues. The issue has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H according to NVD assessment (NVD).

When exploited, this vulnerability could lead to a Denial of Service (DoS) attack through the application. By submitting specially crafted input to areas handling user comments or notes, an attacker could cause the server to enter a state of high CPU usage, potentially making the GitLab instance unresponsive (GitLab Issue).

The vulnerability has been fixed in GitLab versions 14.3.6, 14.4.4, and 14.5.2. Users are strongly recommended to upgrade to one of these patched versions immediately. GitLab.com has already been updated with the patched version (GitLab Advisory).