An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.
Weakness
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | * | 17.10.8 (excluding) |
| Gitlab | Gitlab | 17.11.0 (including) | 17.11.4 (excluding) |
| Gitlab | Gitlab | 18.0.0 (including) | 18.0.2 (excluding) |