PT-2022-12977 · Gitlab · Gitlab

Published 2022-03-28 · Updated 2024-03-06 · CVE-2022-0123

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 14.4.5 GitLab versions 14.5.0 through 14.5.3 GitLab versions 14.6.0 through 14.6.1

Description An issue has been discovered where GitLab does not validate SSL certificates for some external CI services, making it possible to perform Man-in-the-Middle (MitM) attacks on connections to these external services.

Recommendations For versions prior to 14.4.5, update to version 14.4.5 or later. For versions 14.5.0 through 14.5.3, update to version 14.5.4 or later. For versions 14.6.0 through 14.6.1, update to version 14.6.2 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BIT-GITLAB-2022-0123

CVE-2022-0123

Affected Products

Gitlab

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0123.json · Exploit
• https://osv.dev/vulnerability/BIT-gitlab-2022-0123 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0123 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0123 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-0123 · Security Note
• https://ubuntu.com/security/CVE-2022-0123 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/296632 · Note