CVE-2024-7610: 
GitLab vulnerability analysis and mitigation

A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. The vulnerability allows an attacker to cause catastrophic backtracking while parsing results from Elasticsearch (NVD).

The vulnerability exists in the search functionality where very long lines with matches in code results can trigger catastrophic backtracking when search results are parsed and highlighting is calculated. The issue specifically occurs in the regular expression located in ee/lib/gitlab/elastic/search_results.rb when processing highlights from Elasticsearch. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause the Puma process CPU usage to climb rapidly with a low rate of traffic, potentially leading to a denial of service condition. The impact is particularly severe when processing large files with matches in code results (GitLab Issue).

The vulnerability can be triggered by uploading a large file (such as a JSON file without newlines) and performing search operations on it. An example proof of concept involves using a 264 MB JSON file and executing repeated search queries, which causes the CPU usage to increase significantly (GitLab Issue).

The issue has been addressed in GitLab versions 17.0.6, 17.1.4, and 17.2.2. Users are advised to upgrade to these or newer versions to mitigate the vulnerability (NVD).