diff --git a/debian/patches/0850-bump-asciidoctor.patch b/debian/patches/0850-bump-asciidoctor.patch
new file mode 100644
index 0000000000..4986bf149e
--- /dev/null
+++ b/debian/patches/0850-bump-asciidoctor.patch
@@ -0,0 +1,116 @@
+Description: <short summary of the patch>
+ TODO: Put a short summary on the line above and replace this paragraph
+ with a longer explanation of this change. Complete the meta-information
+ with other relevant fields (see below for details). To make it easier, the
+ information below has been extracted from the changelog. Adjust it or drop
+ it.
+ .
+ gitlab (12.0.9-1) experimental; urgency=high
+ .
+   * Team Upload
+   * New upstream version 12.0.9 (Closes: #940007)
+     (Fixes: CVE-2019-16170)
+Author: Nilesh <npatra974@gmail.com>
+Bug-Debian: https://bugs.debian.org/940007
+
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: <vendor|upstream|other>, <url of original patch>
+Bug: <url in upstream bugtracker>
+Bug-Debian: https://bugs.debian.org/<bugnumber>
+Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
+Forwarded: <no|not-needed|url proving that it has been forwarded>
+Reviewed-By: <name and email of someone who approved the patch>
+Last-Update: 2019-09-16
+
+--- a/Gemfile
++++ b/Gemfile
+@@ -140,9 +140,9 @@
+ gem 'org-ruby', '~> 0.9.12'
+ gem 'creole', '~> 0.5.0'
+ gem 'wikicloth', '0.8.1'
+-gem 'asciidoctor', '~> 1.5', '>=1.5.8'
++gem 'asciidoctor', '~> 2.0', '>=2.0.10'
+ gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
+-gem 'asciidoctor-plantuml', '0.0.8'
++gem 'asciidoctor-plantuml', '0.0.9'
+ gem 'rouge', '~> 3.1'
+ gem 'truncato', '~> 0.7.11'
+ gem 'bootstrap_form', '~> 4.2'
+--- a/Gemfile.lock
++++ b/Gemfile.lock
+@@ -66,11 +66,11 @@
+       faraday_middleware (~> 0.9)
+       faraday_middleware-multi_json (~> 0.0)
+       oauth2 (~> 1.0)
+-    asciidoctor (1.5.8)
++    asciidoctor (2.0.10)
+     asciidoctor-include-ext (0.3.1)
+       asciidoctor (>= 1.5.6, < 3.0.0)
+-    asciidoctor-plantuml (0.0.8)
+-      asciidoctor (~> 1.5)
++    asciidoctor-plantuml (0.0.9)
++      asciidoctor (>= 1.5.6, < 3.0.0)
+     ast (2.4.0)
+     atomic (1.1.99)
+     attr_encrypted (3.1.0)
+@@ -1025,9 +1025,9 @@
+   akismet (~> 2.0)
+   apollo_upload_server (~> 2.0.0.beta3)
+   asana (~> 0.8.1)
+-  asciidoctor (~> 1.5.8)
++  asciidoctor (~> 2.0.10)
+   asciidoctor-include-ext (~> 0.3.1)
+-  asciidoctor-plantuml (= 0.0.8)
++  asciidoctor-plantuml (= 0.0.9)
+   attr_encrypted (~> 3.1.0)
+   awesome_print
+   babosa (~> 1.0.2)
+--- a/lib/gitlab/asciidoc/html5_converter.rb
++++ b/lib/gitlab/asciidoc/html5_converter.rb
+@@ -1,22 +1,19 @@
+ # frozen_string_literal: true
+ 
+ require 'asciidoctor'
+-require 'asciidoctor/converter/html5'
+ 
+ module Gitlab
+   module Asciidoc
+-    class Html5Converter < Asciidoctor::Converter::Html5Converter
+-      extend Asciidoctor::Converter::Config
+-
++    class Html5Converter < (Asciidoctor::Converter.for 'html5')
+       register_for 'gitlab_html5'
+ 
+-      def stem(node)
++      def convert_stem(node)
+         return super unless node.style.to_sym == :latexmath
+ 
+         %(<pre#{id_attribute(node)} data-math-style="display"><code>#{node.content}</code></pre>)
+       end
+ 
+-      def inline_quoted(node)
++      def convert_inline_quoted(node)
+         return super unless node.type.to_sym == :latexmath
+ 
+         %(<code#{id_attribute(node)} data-math-style="inline">#{node.text}</code>)
+--- /dev/null
++++ b/Gemfile.rej
+@@ -0,0 +1,14 @@
++--- Gemfile
+++++ Gemfile
++@@ -129,9 +129,9 @@ gem 'rdoc', '~> 6.0'
++ gem 'org-ruby', '~> 0.9.12'
++ gem 'creole', '~> 0.5.0'
++ gem 'wikicloth', '0.8.1'
++-gem 'asciidoctor', '~> 1.5.8'
+++gem 'asciidoctor', '~> 2.0.10'
++ gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
++-gem 'asciidoctor-plantuml', '0.0.8'
+++gem 'asciidoctor-plantuml', '0.0.9'
++ gem 'rouge', '~> 3.1'
++ gem 'truncato', '~> 0.7.11'
++ gem 'bootstrap_form', '~> 4.2.0'
diff --git a/debian/patches/series b/debian/patches/series
index c4b3f3c2f4..d86475e31b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -25,3 +25,4 @@
 0730-install-graphql-tag.patch
 0740-use-packaged-modules.patch
 0840-embed-gitlab-labkit.patch
+0850-bump-asciidoctor.patch