CVE-2017-17716

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verificationIssue Tracking, Vendor Advisory
https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/Issue Tracking, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/30420Issue Tracking, Patch, Vendor Advisory
https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verificationIssue Tracking, Vendor Advisory
https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/Issue Tracking, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/30420Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Dec 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-177179.8Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature CVE-2017-177185.9The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation.CVE-2017-177196.1A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary w CVE-2017-17726.1IBM Worklight (IBM MobileFirst Platform Foundation 6.3, 7.0, 7.1, and 8.0) is vulnerable to cross-site scripting. This vulnerability allows CVE-2017-177219.8CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, dom CVE-2017-177226.5In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service CVE-2017-177238.1In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attackers can exploit thi CVE-2017-177246.5In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, related to the "!= 0x1c" CVE-2017-177256.5In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp. Remote at CVE-2017-177278.8DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templ CVE-2017-17734.0IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS responses to perform D CVE-2017-177309.8DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.