Insufficient session expiration in GitLab Gitaly
Priority LOW 15CWE-613Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-613.
Summary
When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.
Why it matters now
EPSS 0.00277 20th percentileScored 2026-11-07
Fix Fixed Gitaly (GitLab): 13.3.9, 13.4.5, 13.5.2gitaly (RubyGems): 13.3.9, 13.4.5, 13.5.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GitLab | Gitaly | 1.79.0 to before 13.3.9; 13.4 to before 13.4.5; 13.5 to before 13.5.2 | 13.3.9, 13.4.5, 13.5.2 | Patch available | CNA |
| — | gitaly (RubyGems) | 1.79.0 to before 13.3.9 | 13.3.9 | Patch available | GHSA-mmmm-chjf-jmvw |
| — | gitaly (RubyGems) | 13.4 to before 13.4.5 | 13.4.5 | Patch available | GHSA-mmmm-chjf-jmvw |
| — | gitaly (RubyGems) | 13.5 to before 13.5.2 | 13.5.2 | Patch available | GHSA-mmmm-chjf-jmvw |
- Gitaly VendorGitLab Affected 1.79.0 to before 13.3.9; 13.4 to before 13.4.5; 13.5 to before 13.5.2 Fixed in 13.3.9, 13.4.5, 13.5.2 Patch available CNA
- gitaly (RubyGems) Vendor— Affected 1.79.0 to before 13.3.9 Fixed in 13.3.9 Patch available GHSA-mmmm-chjf-jmvw
- gitaly (RubyGems) Vendor— Affected 13.4 to before 13.4.5 Fixed in 13.4.5 Patch available GHSA-mmmm-chjf-jmvw
- gitaly (RubyGems) Vendor— Affected 13.5 to before 13.5.2 Fixed in 13.5.2 Patch available GHSA-mmmm-chjf-jmvw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gitlab:gitaly:*:*:*:*:*:*:*:* | 1.79.0 to before 13.3.9; 13.4.0 to before 13.4.5; 13.5.0 to before 13.5.2 | Vulnerable | GitLab |
- cpe:2.3:a:gitlab:gitaly:*:*:*:*:*:*:*:* Versions 1.79.0 to before 13.3.9; 13.4.0 to before 13.4.5; 13.5.0 to before 13.5.2 Vulnerable ·GitLab
Remediation
- Fix · CNA Gitaly (GitLab) Fixed in 13.3.9, 13.4.5, 13.5.2
- Fix · GHSA-mmmm-chjf-jmvw gitaly (RubyGems) Fixed in 13.3.9 Advisory →
- Fix · GHSA-mmmm-chjf-jmvw gitaly (RubyGems) Fixed in 13.4.5 Advisory →
- Fix · GHSA-mmmm-chjf-jmvw gitaly (RubyGems) Fixed in 13.5.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-13353
- 2026-10-03 Alias added: GHSA-mmmm-chjf-jmvw
References
Advisory 2
Sources
- CVE-2020-13353 · CVE Program
- CVE-2020-13353 · NVD
- FIRST EPSS
- GHSA-mmmm-chjf-jmvw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences