Summary
generated automatically from NVD dataGitLab 9.4.x before 9.4.2 (affected versions 9.4.0 and 9.4.1) lacks LDAP SSL certificate verification, even though the 9.4 release announcement referenced a verify_certificates LDAP option. The cause was code that was never merged, and it relates to the omniauth-ldap library and the gitlab_omniauth-ldap gem. Because certificates are not validated (CWE-295), LDAP connections could be exposed to confidentiality loss; the CVSS v3.0 score is 5.9 (MEDIUM).
NVD description
GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.
EPSS · FIRST.org
0.93%probability of exploitation in the next 30 days
Higher than 60% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-29, recomputed daily by FIRST.org.
CVSS v3.0 Score
Information
- Published
- 17 déc. 2017
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (6)
- https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verificationIssue TrackingVendor Advisory
- https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/Issue TrackingVendor Advisory
- https://gitlab.com/gitlab-org/gitlab-ce/issues/30420Issue TrackingPatchVendor Advisory
- https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verificationIssue TrackingVendor Advisory
- https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/Issue TrackingVendor Advisory
- https://gitlab.com/gitlab-org/gitlab-ce/issues/30420Issue TrackingPatchVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-295
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.