CVE-2023-4812: 
GitLab vulnerability analysis and mitigation

A vulnerability (CVE-2023-4812) was discovered in GitLab affecting versions from 15.3 through 16.7.1. The vulnerability allows bypassing required CODEOWNERS approval by adding changes to a previously approved merge request. This security issue impacts both GitLab Community Edition (CE) and Enterprise Edition (EE) (GitLab Release, CERT-EU).

The vulnerability has been assigned a CVSS v3.1 base score of 7.6 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N. The issue stems from a flaw in the code review process where CODEOWNERS approval could be circumvented by making changes to a merge request that had already received approval (NVD, GitLab Release).

The vulnerability could allow attackers to bypass code owner approval mechanisms, potentially enabling them to introduce malicious code changes without proper review. For example, an attacker could initially submit a safe file for approval, then add malicious code after receiving approval, effectively bypassing the security review process (CERT-EU).

The vulnerability has been patched in GitLab versions 16.5.6, 16.6.4, and 16.7.2. Organizations are strongly recommended to upgrade their GitLab installations to one of these patched versions immediately. GitLab.com has already been updated with the security fix (GitLab Release).