CVE-2022-0090
Description
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way that it doesn't ignore replacement references with git sub-commands, allowing a malicious user to spoof the contents of their commits in the UI.
Summary dbcve.org
GitLab fails to properly ignore replacement references when processing git sub-commands, allowing attackers to replace legitimate commit objects with malicious ones. This causes the GitLab UI to display spoofed commit contents while the underlying git repository remains unchanged.
Mitigation
Upgrade GitLab to version 14.4.5, 14.5.4, 14.6.2, or later which properly ignore replacement references. Review git configuration settings related to git-replace functionality.