oss-security - [GitLab, Inc.] Update: Gitlab, LDAP integration vulnerable to MITM attack

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <NZZ7VKP4WW_5a3ae0d5ea16f_173b53fbfb8ecb988831843_sprut@zendesk.com>
Date: Wed, 20 Dec 2017 22:14:46 +0000
From: "Kwang (GitLab Support)" <security@...lab.com>
Cc: Open Source Security <oss-security@...ts.openwall.com>
Subject: [GitLab, Inc.] Update: Gitlab, LDAP integration vulnerable to MITM
 attack

##- Please type your reply above this line -##

You are registered as a CC on this support request (86379). Reply to this email to add a comment to the request.

----------------------------------------------

Kwang, Dec 20, 17:14 EST

Hi Raphael,

Thank you for the heads-up. We will note that on the public issue tracker page.

Regards,
GitLab Security Team

----------------------------------------------

Raphael Geissert, Dec 17, 15:26 EST

Hi,

This is just a heads up that I requested a CVE id for issue #30420[1]: gitlab
between 9.4 and before 9.4.2 does not verify the identity of the LDAP server.

This has been assigned CVE-2017-17716.

[1]https://gitlab.com/gitlab-org/gitlab-ce/issues/30420
(needless to say, this wasn't reported by me)

Cheers,
--
Raphael Geissert

--------------------------------
This email is a service from GitLab, Inc..

[NZZ7VK-P4WW]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.