CVE-2023-4379
Description
An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.
Summary dbcve.org
In GitLab EE, when a merge request's target branch is updated (e.g., merging main into a feature branch), code owner approvals from the previous target branch state were incorrectly retained instead of being cleared. This allowed merge requests to potentially be merged without proper approvals if the approvals were tied to an older branch state.
Mitigation
Upgrade GitLab EE to version 16.2.8, 16.3.5, or 16.4.1 or later. Alternatively, manually review and remove stale code owner approvals from affected merge requests as a temporary mitigation.