0

I'm trying to get information about CVE-2022-1175 which is corrected in gitlab versions 14.9.2, 14.8.5 and 14.7.7 (https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/)

However, in NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-1175/cpes?expandCpeRanges=true they say that also version 14.6.3 is impacted, however in the same site I don't find the same CVE for version 14.6.4 even when gitlab hasn't published a fix for this version.

Furthermore, NIST won't give any reference about gitlab versions higher than 14.6.4

Looking for issues in gitlab official repositories I find nothing for CVE-2022-1175 and Gitlab v 14.6.7

After executing a security scan tool like Trivy, I don't find this gitlab version as impacted, but I really don't know if this is due to it is actually not impacted or just because this version is not referenced anywhere.

Is there some other way to know if CVE-2022-1175 impacts Gitlab 14.6.7 ?

1 Answer 1

2

Gitlab 14.6.7 was released on April 1, 2022 right after the disclosure, so I'm pretty sure that it's not affected by these vulnerabilities.

Meanwhile the 14th branch has seen many more updates including critical security fixes, so you must upgrade anyways.

1
  • What seems strange to me it's that even older 14.6 versions don't mention this CVE. I wonder if 14.6.x versions have ever been affected. Commented Aug 17, 2022 at 11:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .