Gitaly Insufficient Session Expiration vulnerability

2022-05-2417:34:24

Google

osv.dev

0.0004 Low

EPSS

Percentile

12.8%

JSON

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. Affected versions are: >=1.79.0, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

CPENameOperatorVersion
gitalyeq13.3.0.pre.rc4
gitalyeq1.82.0
gitalyeq13.3.0.pre.rc3
gitalyeq13.1.0.pre.rc3
gitalyeq13.2.0.pre.rc1
gitalyeq1.84.0
gitalyeq13.2.0.pre.rc2
gitalyeq12.9.0.pre.rc4
gitalyeq1.85.0
gitalyeq13.0.0.pre.rc1

Name	Operator	Version
gitaly	eq	13.3.0.pre.rc4
gitaly	eq	1.82.0
gitaly	eq	13.3.0.pre.rc3
gitaly	eq	13.1.0.pre.rc3
gitaly	eq	13.2.0.pre.rc1
gitaly	eq	1.84.0
gitaly	eq	13.2.0.pre.rc2
gitaly	eq	12.9.0.pre.rc4
gitaly	eq	1.85.0
gitaly	eq	13.0.0.pre.rc1