CVE-2021-39909

Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions sta...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"11.3.0"},{"fixed":"14.2.6"},{"introduced":"14.3.0"},{"fixed":"14.3.4"},{"introduced":"14.4.0"},{"fixed":"14.4.1"}]}]

参照URL

advisory gitlab.com
advisory hackerone.com
web gitlab.com
web nvd.nist.gov