GitHub Advisoryadvisory · RubyGems

GHSA-mmmm-chjf-jmvw Gitaly Insufficient Session Expiration vulnerability

LOW Published 2022-05-24 Modified 2023-01-24 Official page ↗
Aliases
CVE-2020-13353
Ecosystem
RubyGems
Packages
gitaly
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-613
Reviewed
2023-01-24

Affected packages

• RubyGems gitaly: >= 1.79.0, < 13.3.9 → fixed in 13.3.9 • RubyGems gitaly: >= 13.4, < 13.4.5 → fixed in 13.4.5 • RubyGems gitaly: >= 13.5, < 13.5.2 → fixed in 13.5.2

Description

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. Affected versions are: >=1.79.0, =13.4, =13.5, <13.5.2.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2020-13353 When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. vulnerability

References