CVE-2023-1178: 
GitLab vulnerability analysis and mitigation

CVE-2023-1178 is a security vulnerability discovered in GitLab affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, and all versions starting from 15.11 before 15.11.1. The vulnerability relates to file integrity issues when downloading source code or installation packages from tags or releases (GitLab Security Release).

The vulnerability stems from a lack of proper file integrity verification in the GitLab web interface when downloading source code or installation packages from a tag or release. This is classified as a medium severity issue with a CVSS score of 5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N). The issue specifically occurs when source code or installation packages are pulled from a tag or from a release containing a ref to another commit (GitLab Security Release).

The vulnerability allows attackers to potentially compromise file integrity when users download source code or installation packages. When a user downloads source code files from a tag or release, they might receive content different from what is displayed in the GitLab web interface, potentially leading to the execution of unintended or malicious code (GitLab Security Release).

The vulnerability has been fixed in GitLab versions 15.11.1, 15.10.5, and 15.9.6. Users are strongly recommended to upgrade their GitLab installations to one of these patched versions immediately. GitLab.com has already been updated with the patched version (GitLab Security Release).