CVE-2022-0738
Description
An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. GitLab was leaking user passwords when adding mirrors with SSH credentials under specific conditions.
Summary dbcve.org
GitLab had an information disclosure vulnerability where user passwords were inadvertently leaked when configuring repository mirrors with SSH credentials. The password exposure occurred under specific conditions related to the mirror configuration workflow, likely in logs or API responses.
Mitigation
Update GitLab to version 14.6.5, 14.7.4, 14.8.2 or later. Review access logs and audit logs for any evidence of exposed credentials and rotate any potentially compromised passwords.