Bug 2052909 (CVE-2021-39943)

Summary:	CVE-2021-39943 gitlab: An authorization logic error in the External Status Check API in GitLab EE
Product:	[Other] Security Response	Reporter:	Vipul Nair <vinair>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bmontgom, eparis, jburrell, jokerman, nstielau, sponnaga
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-02 20:20:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2052906

Description Vipul Nair 2022-02-10 09:30:54 UTC

An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call

https://about.gitlab.com/releases/2022/02/03/security-release-gitlab-14-7-1-released/
https://gitlab.com/gitlab-org/gitlab/-/issues/343604
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39943.json
https://hackerone.com/reports/1375393

Comment 2 Product Security DevOps Team 2022-03-02 20:20:21 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-39943