CVE-2017-17716 — Improper Certificate Validation in Gitlab

CWE-295 — Improper Certificate Validation4 documents4 sources
Severity
5.9MEDIUMNVD
EPSS
0.1%
top 75.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedDec 17
Latest updateMay 14

Description

GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages3 packages

▶NVDgitlab/gitlab9.4.0, 9.4.1+1
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

Patches

Patch: gitlab.com ↗Patch: gitlab.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-3493-8hqx-h937: GitLab 9↗2022-05-14
▶

📋Vendor Advisories

2
GitLab
CVE-2017-17716: GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release a↗2017-12-17
▶
Debian
CVE-2017-17716: gitlab - GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, bu...↗2017
▶