Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-0123: GitLab may let attackers intercept CI traffic

CVE-2022-0123 · published 4 years ago

Summary

Versions of GitLab before 14.4.5, as well as 14.5.0‑14.5.3 and 14.6.0‑14.6.1, do not check SSL certificates for some external continuous‑integration services. This gap could let a malicious party eavesdrop or alter data sent to those services. Update GitLab to a patched version or restrict CI integrations to trusted, correctly‑certified endpoints.

What to do

Update gitlab to version 14.6.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Bitnami	–	gitlab	>= 14.6.0, < 14.6.1 Fix: upgrade to 14.6.1
–	gitlab	gitlab	< 14.4.5 >= 14.5.0, < 14.5.3 >= 14.6.0, < 14.6.1 `cpe:2.3:a:gitlab:gitlab::::::::`

Original advisory text

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0123.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0123 Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/296632 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

5.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-295Improper Certificate Validation

Timeline

Published28 Mar 2022

Updated4 Nov 2026

First seen23 Aug 2026

Sources

CVE-2022-0123 · OSV

CVE-2022-0123 · NVD

BIT-gitlab-2022-0123 · OSV

Track software like this

Free during beta