CVE-2020-13353: 
Ruby vulnerability analysis and mitigation

When importing repositories via URL in Gitaly version 1.79.0 or above, one-time use git credentials were persisted beyond their intended time window, creating a potential security risk. The vulnerability was discovered internally by the GitLab team and was assigned the identifier CVE-2020-13353. The issue was addressed in GitLab versions 13.5.2, 13.4.5, and 13.3.9 released on November 2, 2020 (GitLab Release).

The vulnerability affects Gitaly versions 1.79.0 and above, where git credentials used for repository imports were incorrectly persisted to disk beyond their intended one-time use window. This created a potential security exposure of sensitive authentication credentials (CVE Details).

The persistence of git credentials beyond their intended lifetime could potentially expose sensitive authentication information to unauthorized parties, potentially compromising the security of affected GitLab installations (GitLab Release).

The vulnerability was discovered internally by the GitLab security team, and no public exploits were reported at the time of disclosure (GitLab Release).

GitLab strongly recommended that all installations running affected versions be upgraded to the latest version (13.5.2, 13.4.5, or 13.3.9) as soon as possible to address this vulnerability. The fix was included in these security releases published on November 2, 2020 (GitLab Release).