CVE-2023-2001: 
GitLab vulnerability analysis and mitigation

A vulnerability was discovered in GitLab CE/EE (CVE-2023-2001) affecting multiple versions including all versions before 15.10.8, versions from 15.11 before 15.11.7, and versions from 16.0 before 16.0.2. The vulnerability was reported on March 15, 2023, and allows attackers to bypass tag protection mechanisms in GitLab repositories (GitLab Issue).

The vulnerability allows attackers to spoof protected tags by exploiting a reference resolution flaw in GitLab's tag management system. When creating a tag with a specific reference format (refs/tags/), the system fails to properly enforce tag protection rules, resulting in unauthorized tag creation. While accessing the created tag directly results in a 404 error, the source code download feature still processes the malicious tag, falling back to the content of a similarly named branch (GitLab Issue).

The vulnerability enables attackers to bypass GitLab's tag protection mechanisms, potentially leading victims to download malicious code. This circumvention of security controls could result in unauthorized code distribution and compromise the integrity of protected repository content (GitLab Issue).

The vulnerability can be exploited by creating a branch with a specific name pattern and then creating a tag using the 'refs/tags/' prefix. The attack requires the attacker to have basic repository access permissions, though not necessarily the elevated permissions typically required for protected tag operations (GitLab Issue).

GitLab has addressed this vulnerability in versions 15.10.8, 15.11.7, and 16.0.2. Users are advised to upgrade to these or later versions to protect against this security issue (CVE Details).