CVE-2022-2417 Supply chain in GitLab

Medium 6.2 Published 5 Aug 2022 Updated 3 Aug 2024

Authenticated users can import projects with ambiguous branch names, enabling supply chain attacks against victims pinning specific commits.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-2417?

CVE-2022-2417 is a medium-severity vulnerability in Gitlab Gitlab, published on 5 Aug 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project.

Weakness: CWE-20

Which versions are affected by CVE-2022-2417?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `12.10.0`	`15.0.5, 15.1.4, 15.2.1`

Products include Gitlab Gitlab.

How do I fix CVE-2022-2417?

Upgrade gitlab to a fixed version for your release line: 15.0.5, 15.1.4 or 15.2.1.

Is CVE-2022-2417 being exploited?

There is no known exploitation of CVE-2022-2417 in the wild and no public exploit code.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2022-2417, GHSA-99p6-4w5h-vhrg, UBUNTU-CVE-2022-2417.