from Hacker News

Gitlab – Static passwords set during OmniAuth-based registration (CVE-2022-1162)

by altharaz on 3/31/22, 9:29 PM with 22 comments

• by thcipriani on 4/1/22, 3:00 AM

  To save folks some digging on what exactly this means—it's exactly what it sounds like: https://gitlab.com/gitlab-org/gitlab/-/commit/e2fb87ec5d4e23...

• by krebsonsecurity on 4/1/22, 3:36 PM

  This appears to be related. One Github user shared an alert they got today, two days after connecting their Github account to Gitlab. Something about an app added to the account. Their Github has 2fa turned on and a very strong password:

  https://twitter.com/briankrebs/status/1509910113716514822