CVE-2022-2417
Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an au...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project.
Paquets affectés
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"12.10.0"},{"fixed":"15.0.5"},{"introduced":"15.1.0"},{"fixed":"15.1.4"},{"introduced":"15.2.0"},{"fixed":"15.2.1"}]}]
Références
- advisory gitlab.com
- advisory gitlab.com
- web nvd.nist.gov