CVE-2021-22170: High severity gitlab vulnerability
Published Dec 6, 2021
·Updated
Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content
Affected Software
3 affected components
GitLab GitLab>=11.6.0<13.5.6
GitLab GitLab>=13.6.0<13.6.4
GitLab GitLab>=13.7.0<13.7.2
Event History
Dec 6, 2021
CVE Published
via MITRE·05:35 PM
Data Sourced
via MITRE·05:35 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22170?
CVE-2021-22170 is rated as a medium severity vulnerability due to the potential for data exposure through nonce reuse.
2
How do I fix CVE-2021-22170?
To fix CVE-2021-22170, update your GitLab instance to a version newer than 13.7.2, 13.6.4, or 13.5.6.
3
What versions of GitLab are affected by CVE-2021-22170?
CVE-2021-22170 affects GitLab versions from 11.6.0 up to but not including 13.5.6, 13.6.0 to 13.6.4, and 13.7.0 to 13.7.2.
4
What could an attacker do if they exploit CVE-2021-22170?
If exploited, an attacker could decrypt some of the database's encrypted content due to nonce reuse issues.
5
Is there a workaround for CVE-2021-22170?
There is no specific workaround for CVE-2021-22170; the recommended action is to update to a patched version of GitLab.