Description
An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication. Smartcard authentication is an experimental feature and has to be manually enabled by an administrator.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 11.6 – < 16.4.4, 16.5 – < 16.5.4, 16.6 – < 16.6.2 | 16.4.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gitlab | No fix yet | — |
Advisories 1
- WID-SEC-2023-3153 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 13, 2023
References
- GitLab Issue #421607 issue-tracking