CVE-2021-22218: 
GitLab vulnerability analysis and mitigation

All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits (Debian Security).

The vulnerability stems from improper validation of x509 certificates in GitLab's commit signing verification process. The system incorrectly displayed commits signed with x509 certificates as 'Verified' without properly checking the email associated with the certificate, allowing for potential identity spoofing in commit signatures (GitLab Issue).

This vulnerability allows attackers to impersonate other users in the GitLab web interface by creating commits that appear to be verified and signed by other users. The issue specifically affects the commit verification system, where commits signed with x509 certificates for any email address would be displayed as 'Verified' regardless of the email's association with the GitLab account (GitLab Issue).

The issue has been fixed in GitLab versions 13.10.5, 13.11.5, and 13.12.2. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Debian Security).