Follow @discotekdotca
CVE-2017-17716
Current Description
GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.
Basic Data
| Published | December 17, 2017 |
|---|---|
| Last Modified | January 04, 2018 |
| Assigner | cve@mitre.org |
| Data Type | CVE |
| Data Format | MITRE |
| Data Version | 4.0 |
| Problem Type | CWE-295 |
| CVE Data Version | 4.0 |
Base Metric V2
| CVSS 2 - Version | 2.0 |
|---|---|
| CVSS 2 - Vector String | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| CVSS 2 - Access Vector | NETWORK |
| CVSS 2 - Access Complexity | MEDIUM |
| CVSS 2 - Authentication | NONE |
| CVSS 2 - Confidentiality Impact | PARTIAL |
| CVSS 2 - Availability Impact | NONE |
| CVSS 2 - Base Score | 4.3 |
| Severity | MEDIUM |
| Exploitability Score | 8.6 |
| Impact Score | 2.9 |
| Obtain All Privilege | false |
| Obtain User Privilege | false |
| Obtain Other Privilege | false |
Base Metric V3
| CVSS 3 - Version | 3.0 |
|---|---|
| CVSS 3 - Vector String | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS 3 - Attack Vector | NETWORK |
| CVSS 3 - Attack Complexity | HIGH |
| CVSS 3 - Privileges Required | NONE |
| CVSS 3 - User Interaction | NONE |
| CVSS 3 - Scope | UNCHANGED |
| CVSS 3 - Confidentiality Impact | HIGH |
| CVSS 3 - Integrity Impact | NONE |
| CVSS 3 - Availability Impact | NONE |
| CVSS 3 - Base Score | 5.9 |
| CVSS 3 - Base Severity | MEDIUM |
| Exploitability Score | 2.2 |
| Base Severity | MEDIUM |
Configurations
-
OR - Configuration 1
Cpe Version Part Vendor Product Version Update Edition Language SW Edition Target SW Target HW Other Version Start Including Version End Including Version Start Excluding Version End Excluding 2.3 Application Gitlab Gitlab 9.4.0 * * * * * * * 2.3 Application Gitlab Gitlab 9.4.0 rc1 * * * * * * 2.3 Application Gitlab Gitlab 9.4.0 rc2 * * * * * * 2.3 Application Gitlab Gitlab 9.4.0 rc3 * * * * * * 2.3 Application Gitlab Gitlab 9.4.0 rc4 * * * * * * 2.3 Application Gitlab Gitlab 9.4.0 rc5 * * * * * * 2.3 Application Gitlab Gitlab 9.4.0 rc6 * * * * * * 2.3 Application Gitlab Gitlab 9.4.1 * * * * * * *
Vulnerable Software List
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | 9.4.0, 9.4.1 |
References
| Name | Source | URL | Tags |
|---|---|---|---|
| https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verification | https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verific | MISC | Issue Tracking Vendor Advisory |
| https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/ | https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/ | MISC | Issue Tracking Vendor Advisory |
| https://gitlab.com/gitlab-org/gitlab-ce/issues/30420 | https://gitlab.com/gitlab-org/gitlab-ce/issues/30420 | MISC | Issue Tracking Patch Vendor Advisory |