CVE-2021-39942: 
GitLab vulnerability analysis and mitigation

A denial of service vulnerability was discovered in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, and all versions starting from 14.5 before 14.5.2. The vulnerability was assigned CVE-2021-39942 and allows low-privileged users to bypass file size limits in the NPM package repository (GitLab Security Release, CERT-EU Advisory).

The vulnerability exists in the NPM package repository functionality where the file size validation incorrectly relies on user-provided parameters rather than actual file sizes. The issue has been rated as medium severity with a CVSS score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) (GitLab Security Release).

The vulnerability allows attackers to bypass specified file size limits when creating NPM packages, potentially leading to disk space exhaustion and denial of service. Given the lack of storage limits for the package registry, this could result in system resource depletion (GitLab Security Release).

The vulnerability can be exploited by low-privileged users who have access to create NPM packages in the GitLab instance. The exploit involves manipulating the file length parameter in package creation requests to bypass size restrictions (GitLab Security Release).

GitLab has addressed this vulnerability in versions 14.3.6, 14.4.4, and 14.5.2. Users are strongly recommended to upgrade to these or later versions to mitigate the risk. The fix ensures proper validation of actual file sizes rather than relying on user-provided parameters (GitLab Security Release).