CVE-2020-17516: Authentication Bypass by Spoofing
(updated )
When using ‘dc’ or ‘rack’ internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.
References
Detect and mitigate CVE-2020-17516 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →