SB2017121706 - Improper Certificate Validation in GitLab, Gitlab Community Edition

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Certificate Validation (CVE-ID: CVE-2017-17716)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.

Remediation

Install update from vendor's website.

References

• https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verification
• https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/
• https://gitlab.com/gitlab-org/gitlab-ce/issues/30420