2019-06-07 13:55:22 +00:00
---
2021-10-06 18:12:19 +00:00
stage: Manage
2022-01-27 03:14:06 +00:00
group: Authentication and Authorization
2020-11-26 06:09:20 +00:00
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
2019-06-07 13:55:22 +00:00
type: reference
---
2021-06-13 21:10:11 +00:00
# How we manage the TLS protocol CRIME vulnerability **(FREE SELF)**
2015-12-19 21:16:50 +00:00
2020-04-08 03:09:31 +00:00
[CRIME ](https://en.wikipedia.org/w/index.php?title=CRIME&oldid=692423806 ) is a security exploit against
2015-12-25 13:23:06 +00:00
secret web cookies over connections using the HTTPS and SPDY protocols that also
use data compression. When used to recover the content of secret
authentication cookies, it allows an attacker to perform session hijacking on an
2015-12-19 21:16:50 +00:00
authenticated web session, allowing the launching of further attacks.
2019-06-07 13:55:22 +00:00
## Description
2015-12-19 21:16:50 +00:00
2019-06-07 14:33:31 +00:00
The TLS Protocol CRIME Vulnerability affects systems that use data compression
over HTTPS. Your system might be vulnerable to the CRIME vulnerability if you use
2020-04-21 15:21:10 +00:00
SSL Compression (for example, Gzip) or SPDY (which optionally uses compression).
2015-12-19 21:16:50 +00:00
2022-05-24 00:08:13 +00:00
GitLab supports both Gzip and [SPDY ](https://nginx.org/en/docs/http/ngx_http_spdy_module.html ) and mitigates the CRIME
2020-04-21 15:21:10 +00:00
vulnerability by deactivating Gzip when HTTPS is enabled. The sources of the
2019-06-07 14:33:31 +00:00
files are here:
2015-12-19 21:16:50 +00:00
2021-06-08 18:10:23 +00:00
- [Source installation NGINX file ](https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/support/nginx/gitlab-ssl )
2020-04-21 15:21:10 +00:00
- [Omnibus installation NGINX file ](https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/files/gitlab-cookbooks/gitlab/templates/default/nginx-gitlab-http.conf.erb )
2015-12-19 21:16:50 +00:00
2015-12-25 13:23:06 +00:00
Although SPDY is enabled in Omnibus installations, CRIME relies on compression
(the 'C') and the default compression level in NGINX's SPDY module is 0
(no compression).
2015-12-19 21:16:50 +00:00
2019-06-07 13:55:22 +00:00
## Nessus
2015-12-19 21:16:50 +00:00
2020-04-21 15:21:10 +00:00
The Nessus scanner, [reports a possible CRIME vulnerability ](https://www.tenable.com/plugins/index.php?view=single&id=62565 ) in GitLab
2015-12-25 13:23:06 +00:00
similar to the following format:
2015-12-19 21:16:50 +00:00
2020-03-03 03:08:31 +00:00
```plaintext
2015-12-25 13:23:06 +00:00
Description
2015-12-19 21:16:50 +00:00
2015-12-25 13:23:06 +00:00
This remote service has one of two configurations that are known to be required for the CRIME attack:
SSL/TLS compression is enabled.
TLS advertises the SPDY protocol earlier than version 4.
2015-12-19 21:16:50 +00:00
2015-12-25 13:23:06 +00:00
...
2015-12-19 21:16:50 +00:00
2015-12-25 13:23:06 +00:00
Output
2015-12-19 21:16:50 +00:00
2015-12-25 13:23:06 +00:00
The following configuration indicates that the remote service may be vulnerable to the CRIME attack:
SPDY support earlier than version 4 is advertised.
```
2015-12-19 21:16:50 +00:00
2015-12-25 13:23:06 +00:00
From the report above it is important to note that Nessus is only checking if
2019-06-07 14:33:31 +00:00
TLS advertises the SPDY protocol earlier than version 4. It does not perform an
attack nor does it check if compression is enabled. The Nessus scanner alone
2015-12-19 21:16:50 +00:00
cannot tell that SPDY's compression is disabled and not subject to the CRIME
2015-12-25 13:23:06 +00:00
vulnerability.
2019-06-07 13:55:22 +00:00
## References
2015-12-19 21:16:50 +00:00
2022-05-24 00:08:13 +00:00
- NGINX ["Module `ngx_http_spdy_module`" ](https://nginx.org/en/docs/http/ngx_http_spdy_module.html )
2020-04-21 15:21:10 +00:00
- Tenable Network Security, Inc. ["Transport Layer Security (TLS) Protocol CRIME Vulnerability" ](https://www.tenable.com/plugins/index.php?view=single&id=62565 )
- Wikipedia contributors, ["CRIME" ](https://en.wikipedia.org/wiki/CRIME ) Wikipedia, The Free Encyclopedia
2019-06-07 14:33:31 +00:00
<!-- ## Troubleshooting
Include any troubleshooting steps that you can foresee. If you know beforehand what issues
one might have when setting this up, or when something is changed, or on upgrading, it's
important to describe those, too. Think of things that may go wrong and include them here.
This is important to minimize requests for support, and to avoid doc comments with
questions that you know someone might ask.
Each scenario can be a third-level heading, e.g. `### Getting error message X` .
If you have none to add when creating a doc, leave this section in place
but commented out to help encourage others to add to it in the future. -->