CVE-2023-2232: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS (Regular Expression Denial of Service) vulnerability in the Jira prefix functionality. The vulnerability was assigned CVE-2023-2232 and was disclosed in June 2023 (NVD).

The vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity) and received a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The issue stems from insufficient sanitization of user input in the Jira integration feature, specifically in the handling of jira_issue_prefix and jira_issue_regex parameters (GitLab Issue).

When exploited, this vulnerability can cause a denial of service condition at the backend, resulting in high CPU usage and potential server restarts. In documented cases, the exploitation led to 100% CPU utilization with servers requiring restart after 5 minutes of sustained attack (GitLab Issue).

The vulnerability can be exploited by an authenticated user with access to Jira integration settings. A proof of concept exists demonstrating that malicious input in the Jira issue prefix and regex fields can trigger the ReDoS condition (GitLab Issue).

The vulnerability has been fixed in GitLab version 16.1. Users running affected versions (15.10 to 16.0.x) should upgrade to version 16.1 or later to mitigate this security risk (Debian Tracker).