CVE-2021-39909: Medium severity gitlab vulnerability
Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39909?
CVE-2021-39909 is rated as a high severity vulnerability due to its potential to allow unauthorized merge requests without proper approvals.
How do I fix CVE-2021-39909?
To fix CVE-2021-39909, you should upgrade GitLab EE to versions 14.2.6, 14.3.4, or 14.4.1 or later where the vulnerability has been resolved.
What versions of GitLab are affected by CVE-2021-39909?
CVE-2021-39909 affects GitLab EE versions from 11.3 to before 14.2.6, 14.3 from 14.3.0 to before 14.3.4, and 14.4 from 14.4.0 to before 14.4.1.
What is the impact of CVE-2021-39909?
The impact of CVE-2021-39909 is that an attacker can bypass the CODEOWNERS approval mechanism, potentially merging code without necessary oversight.
Is there a workaround for CVE-2021-39909?
There are no official workarounds for CVE-2021-39909; updating to the fixed versions is the only recommended action.