CVE-2023-31485: gitlab – CVSS 5.9 · Watchpost

← All vulnerabilities

CVE-2023-31485

보통 5.9CVE-2023-31485 · Published 29/04/2023 · updated 17/06/2026

요약

CVE-2023-31485은(는) (gitlab)에 영향을 주는 보통 (CVSS 5.9) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.65%, 전체 취약점의 51.3%보다 높음.
아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package	Affected versions	Patched versions
gitlab	`≤ 0.26`	No fix yet

Description

GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks.

References

openwall.com/lists/oss-security/2023/04/29/1 · Mailing List
openwall.com/lists/oss-security/2023/05/03/3 · Mailing List
openwall.com/lists/oss-security/2023/05/03/5 · Mailing List
openwall.com/lists/oss-security/2023/05/07/2 · Mailing List
blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules · Mitigation
bluefeet/GitLab-API-v4#57 · Issue Tracking
chansen/p5-http-tiny#151 · Issue Tracking
openwall.com/lists/oss-security/2023/04/18/14 · Mailing List

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free