CVE-2022-4205: 
GitLab vulnerability analysis and mitigation

In GitLab Enterprise Edition (EE) and Community Edition (CE) versions before 15.6.1, 15.5.5, and 15.4.6, a security vulnerability was identified where using a branch with a hexadecimal name could override an existing hash. The vulnerability was discovered internally by the GitLab team and was assigned the identifier CVE-2022-4205 (GitLab Security Release, CVE Mitre).

The vulnerability was related to the repository import functionality where branches with 40 hexadecimal names could be imported, potentially overriding existing hashes. The issue was rated as medium severity with a CVSS score of 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) (GitLab Security Release).

The vulnerability could allow an attacker to override existing hashes in the repository through branch manipulation during the import process. This could potentially lead to integrity issues in the affected GitLab installations (GitLab Security Release).

The vulnerability has been fixed in GitLab versions 15.6.1, 15.5.5, and 15.4.6. Users are strongly recommended to upgrade to these or later versions immediately. GitLab.com was already running the patched version at the time of disclosure (GitLab Security Release).