CVE-2023-3509: Group member with sub-maintainer role can change title of shared private deploy keys
An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated with projects in the group.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.8.3Fixed in 16.9.1 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.7.6 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.8.3 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.9.1 - Compensating control
If you cannot upgrade immediately, restrict group sub-maintainer access so group members with the sub-maintainer role cannot change the title of shared private deploy keys (mitigates the incorrect authorization described for CVE-2023-3509).
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What versions are affected by CVE-2023-3509?
CVE-2023-3509 affects GitLab versions before 16.7.6, 16.8.0 to 16.8.2, and specifically 16.9.0.
What is the impact of CVE-2023-3509?
CVE-2023-3509 allows group members with sub-maintainer roles to change the title of privately accessible deploy keys.
How do I fix CVE-2023-3509?
To mitigate CVE-2023-3509, upgrade your GitLab instance to version 16.7.6 or apply the fixes in versions 16.8.3 and 16.9.1 or later.
Is CVE-2023-3509 a critical vulnerability?
CVE-2023-3509 is considered a moderate risk as it could lead to unauthorized changes to sensitive deploy keys.
Who can exploit CVE-2023-3509?
CVE-2023-3509 can be exploited by group members who have been assigned the sub-maintainer role.