PT-2017-14967 · Gitlab · Gitlab+1

Published 2017-12-17 · Updated 2018-01-04 · CVE-2017-17716

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 9.4.0 through 9.4.1

Description The issue is related to the use of the omniauth-ldap library and the gitlab omniauth-ldap gem, where GitLab does not support LDAP SSL certificate verification. This occurred due to unmerged code.

Recommendations For GitLab versions 9.4.0 through 9.4.1, update to version 9.4.2 or later to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-17716

Affected Products

Gitlab

Gitlab Omniauth-Ldap

References · 8

• https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verification · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab-ce/issues/30420 · Vendor Advisory
• https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-17716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17716 · Security Note
• https://about.gitlab.com/releases/2017/07/28/gitlab-9-dot-4-dot-2-released · Note
• https://about.gitlab.com/releases/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verification · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17716 · Note