GitLab CE/EE Integer Overflow Leads to Remote Code Execution

An issue has been discovered in GitLab CE/EE that could allow an unauthenticated user to execute arbitrary code on the GitLab server. The flaw is caused by an integer overflow when compiling a specially crafted regular expression.

Under certain conditions, the vulnerability affects all versions from 7.0 before 18.11.13, as well as the following 19.x release lines:

• 19.0 before 19.0.10
• 19.1 before 19.1.9
• 19.2 before 19.2.9
• 19.3 before 19.3.6
• 19.4 before 19.4.3
• 19.5 before 19.5.1