PT-2020-13494 · Gitlab · Gitaly

Published 2020-11-17 · Updated 2022-06-13 · CVE-2020-13353

Positive Technologies (AI Summary)

CVSS v3.1

3.2

Low

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gitaly versions 1.79.0 through 13.3.8 Gitaly versions 13.4.0 through 13.4.4 Gitaly versions 13.5.0 through 13.5.1

Description When importing repositories via URL, one-time use Git credentials were persisted beyond the expected time window.

Recommendations For Gitaly versions 1.79.0 through 13.3.8, update to version 13.3.9 or later. For Gitaly versions 13.4.0 through 13.4.4, update to version 13.4.5 or later. For Gitaly versions 13.5.0 through 13.5.1, update to version 13.5.2 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2020-13353

GHSA-MMMM-CHJF-JMVW

Affected Products

Gitaly

References · 10

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/gitaly/CVE-2020-13353.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13353 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-13353 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mmmm-chjf-jmvw · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-13353 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13353.json · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13353 · Vendor Advisory
• https://t.me/cibsecurity/16420 · Telegram Post
• https://gitlab.com/gitlab-org/gitaly/-/issues/2882 · Note
• https://gitlab.com/gitlab-org/gitaly · Note