Gitaly Insufficient Session Expiration vulnerability

published 2020-11-17 5 y ago modified 2026-06-17 4 mo ago also GHSA-mmmm-chjf-jmvw , EUVD-2022-4594

cvss: 2.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.

Patch / fix

fixed in 2 distros 1

rubygems gitaly 13.3.9, 13.4.5, 13.5.2
gitlab gitaly 13.3.9, 13.4.5, 13.5.2

gitaly Debian 13 13.3.9-1

debian advisories DEBIAN-CVE-2020-13353

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	2.5	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
NVD	3.1	3.2	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N
GitHub	3.1	3.2	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
rubygems	gitaly	>=1.79.0, <13.3.9 >=13.4, <13.4.5 >=13.5, <13.5.2	13.3.9 13.4.5 13.5.2

Affected products

GitLab Gitaly

Classification

Weakness

CWE-613 DEPRECATED: Insufficient Session Expiration

References

gitlab.com /gitlab-org/cves/-/blob/master/2020/CVE-2020-13353.json
web, vendor-advisory
gitlab.com /gitlab-org/gitaly/-/issues/2882
web, broken-link
nvd.nist.gov /vuln/detail/CVE-2020-13353
advisory
github.com /rubysec/ruby-advisory-db/blob/master/gems/gitaly/CVE-2020-13353.yml
web
gitlab.com /gitlab-org/gitaly
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary