UNCLASSIFIED - NO CUI

chore(findings): gitlab/gitlab/gitlab-exporter

Summary

gitlab/gitlab/gitlab-exporter has 18 new findings discovered during continuous monitoring.

Layer: redhat/ubi/ubi9-micro:9.6 is EOL, please update if possible

More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=gitlab/gitlab/gitlab-exporter&tag=18.6.2&branch=master

EPSS (Exploit Prediction Scoring System) provides an estimate of the likelihood that a vulnerability will be exploited in the wild.

KEV (Known Exploited Vulnerabilities) indicates whether a vulnerability is actively being exploited according to CISA.

id source severity package impact workaround epss_score kev
CVE-2024-46981 Anchore CVE Critical redis-4.8.1 0.64798 false
CVE-2024-31449 Anchore CVE High redis-4.8.1 0.58912 false
CVE-2025-46817 Anchore CVE High redis-4.8.1 0.27211 false
CVE-2025-46819 Anchore CVE High redis-4.8.1 0.06350 false
CVE-2025-49844 Anchore CVE Critical redis-4.8.1 0.05762 false
CVE-2025-46818 Anchore CVE High redis-4.8.1 0.04619 false
CVE-2024-31228 Anchore CVE Medium redis-4.8.1 0.00734 false
CVE-2025-32023 Anchore CVE High redis-4.8.1 0.00264 false
CVE-2024-21510 Twistlock CVE Medium sinatra-3.2.0 0.00183 false
CVE-2025-21605 Anchore CVE High redis-4.8.1 0.00107 false
CVE-2025-61921 Twistlock CVE High sinatra-3.2.0 0.00103 false
CVE-2025-48367 Anchore CVE High redis-4.8.1 0.00072 false
CVE-2025-46686 Anchore CVE Low redis-4.8.1 0.00030 false
CVE-2025-49112 Anchore CVE Low redis-4.8.1 0.00016 false
GHSA-mr3q-g2mv-mr4q Anchore CVE Low sinatra-3.2.0 N/A N/A
GHSA-hxx2-7vcw-mqr3 Anchore CVE Medium sinatra-3.2.0 N/A N/A
CCE-88048-4 OSCAP Compliance Medium N/A N/A
CCE-83613-0 OSCAP Compliance Low N/A N/A

More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=gitlab/gitlab/gitlab-exporter&tag=18.6.2&branch=master

Tasks

Contributor:

  • Apply the StatusReview label to this issue for a merge request review and wait for feedback

OR

  • Provide justifications for findings in the VAT (docs)
  • Apply the StatusVerification label to this issue for a VAT justifications review and wait for feedback

Iron Bank:

  • Review findings and justifications

Note: If the above process is rejected for any reason, the Review or Verification label will be removed and the issue will be sent back to To-Do. Any comments will be listed in this issue for you to address. Once they have been addressed, you must re-add the Review or Verification label.

Questions?

Contact the Iron Bank team by commenting on this issue with your questions or concerns. If you do not receive a response, add /cc @ironbank-notifications/onboarding.

Additionally, Iron Bank hosts an AMA working session every Wednesday from 1630-1730EST to answer questions.

Edited by CHORE_TOKEN
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information