chore(findings): gitlab/gitlab/gitlab-rails
Summary
gitlab/gitlab/gitlab-rails has 175 new findings discovered during continuous monitoring.
Layer: redhat/ubi/ubi9-micro:9.6 is EOL, please update if possible
More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=gitlab/gitlab/gitlab-rails&tag=18.6.2&branch=master
EPSS (Exploit Prediction Scoring System) provides an estimate of the likelihood that a vulnerability will be exploited in the wild.
KEV (Known Exploited Vulnerabilities) indicates whether a vulnerability is actively being exploited according to CISA.
| id | source | severity | package | impact | workaround | epss_score | kev |
|---|---|---|---|---|---|---|---|
| CVE-2024-32002 | Anchore CVE | Critical | git-1.19.1 | 0.80112 | false | ||
| CVE-2024-46981 | Anchore CVE | Critical | redis-5.4.1 | 0.64798 | false | ||
| CVE-2024-31449 | Anchore CVE | High | redis-5.4.1 | 0.58912 | false | ||
| CVE-2024-45409 | Anchore CVE | Critical | gitlab-4.19.0 | 0.41390 | false | ||
| CVE-2025-46817 | Anchore CVE | High | redis-5.4.1 | 0.27211 | false | ||
| CVE-2025-25291 | Anchore CVE | Critical | gitlab-4.19.0 | 0.17247 | false | ||
| CVE-2024-2651 | Anchore CVE | Medium | gitlab-4.19.0 | 0.07611 | false | ||
| CVE-2024-32004 | Anchore CVE | High | git-1.19.1 | 0.06635 | false | ||
| CVE-2025-46819 | Anchore CVE | High | redis-5.4.1 | 0.06350 | false | ||
| CVE-2025-49844 | Anchore CVE | Critical | redis-5.4.1 | 0.05762 | false | ||
| CVE-2025-25292 | Anchore CVE | Critical | gitlab-4.19.0 | 0.05480 | false | ||
| CVE-2025-46818 | Anchore CVE | High | redis-5.4.1 | 0.04619 | false | ||
| CVE-2025-25293 | Anchore CVE | High | gitlab-4.19.0 | 0.02562 | false | ||
| CVE-2024-13054 | Anchore CVE | Medium | gitlab-4.19.0 | 0.01997 | false | ||
| CVE-2017-16232 | Anchore CVE | Low | libtiff-4.4.0-15.el9_7.2 | 0.01738 | false | ||
| CVE-2024-1485 | Twistlock CVE | Medium | github.com/devfile/registry-support/registry-library-v0.0.0-20240521161747-89fc566cb024 | 0.01623 | false | ||
| CVE-2025-48384 | Anchore CVE | High | git-1.19.1 | 0.00737 | true | ||
| CVE-2024-31228 | Anchore CVE | Medium | redis-5.4.1 | 0.00734 | false | ||
| CVE-2024-52006 | Anchore CVE | Low | git-1.19.1 | 0.00518 | false | ||
| CVE-2017-17973 | Anchore CVE | Medium | libtiff-4.4.0-15.el9_7.2 | 0.00486 | false | ||
| CVE-2023-6277 | Twistlock CVE | Medium | libtiff-4.4.0-15.el9_7.2 | 0.00418 | false | ||
| CVE-2023-6277 | Anchore CVE | Medium | libtiff-4.4.0-15.el9_7.2 | 0.00418 | false | ||
| CVE-2024-36623 | Anchore CVE | High | github.com/docker/docker-v25.0.6+incompatible | 0.00274 | false | ||
| CVE-2025-32023 | Anchore CVE | High | redis-5.4.1 | 0.00264 | false | ||
| CVE-2024-36620 | Anchore CVE | Medium | github.com/docker/docker-v25.0.6+incompatible | 0.00258 | false | ||
| CVE-2024-8796 | Twistlock CVE | Medium | devise-two-factor-4.1.1 | 0.00236 | false | ||
| CVE-2024-50349 | Anchore CVE | Low | git-1.19.1 | 0.00230 | false | ||
| CVE-2023-6502 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00181 | false | ||
| CVE-2025-2853 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00170 | false | ||
| CVE-2024-2818 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00156 | false | ||
| CVE-2024-52005 | Anchore CVE | High | git-1.19.1 | 0.00142 | false | ||
| CVE-2024-2874 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00116 | false | ||
| CVE-2025-21605 | Anchore CVE | High | redis-5.4.1 | 0.00107 | false | ||
| CVE-2023-49090 | Twistlock CVE | Medium | carrierwave-1.3.4 | 0.00104 | false | ||
| CVE-2025-1677 | Anchore CVE | High | gitlab-4.19.0 | 0.00092 | false | ||
| CVE-2025-5996 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00090 | false | ||
| CVE-2025-0993 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00089 | false | ||
| CVE-2025-58181 | Twistlock CVE | Medium | golang.org/x/crypto/ssh-v0.35.0 | 0.00082 | false | ||
| CVE-2023-6678 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00082 | false | ||
| CVE-2024-5528 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00076 | false | ||
| CVE-2024-29034 | Twistlock CVE | Medium | carrierwave-1.3.4 | 0.00075 | false | ||
| CVE-2022-1056 | Twistlock CVE | Low | libtiff-4.4.0-15.el9_7.2 | 0.00074 | false | ||
| CVE-2022-1056 | Anchore CVE | Low | libtiff-4.4.0-15.el9_7.2 | 0.00074 | false | ||
| CVE-2025-48367 | Anchore CVE | High | redis-5.4.1 | 0.00072 | false | ||
| CVE-2024-53382 | Twistlock CVE | Medium | prism-1.28.0 | 0.00065 | false | ||
| CVE-2022-27943 | Anchore CVE | Low | libstdc++-11.5.0-11.el9 | 0.00050 | false | ||
| CVE-2025-10858 | Anchore CVE | High | gitlab-4.19.0 | 0.00049 | false | ||
| CVE-2025-66293 | Twistlock CVE | High | libpng-2:1.6.37-12.el9 | 0.00046 | false | ||
| CVE-2025-66293 | Anchore CVE | High | libpng-2:1.6.37-12.el9 | 0.00046 | false | ||
| CVE-2024-32020 | Anchore CVE | Low | git-1.19.1 | 0.00046 | false | ||
| CVE-2024-13978 | Twistlock CVE | Low | libtiff-4.4.0-15.el9_7.2 | 0.00042 | false | ||
| CVE-2024-13978 | Anchore CVE | Low | libtiff-4.4.0-15.el9_7.2 | 0.00042 | false | ||
| CVE-2023-6371 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00042 | false | ||
| CVE-2024-32465 | Anchore CVE | High | git-1.19.1 | 0.00037 | false | ||
| CVE-2023-5117 | Anchore CVE | Low | gitlab-4.19.0 | 0.00036 | false | ||
| CVE-2025-8961 | Twistlock CVE | Low | libtiff-4.4.0-15.el9_7.2 | 0.00034 | false | ||
| CVE-2025-8961 | Anchore CVE | Low | libtiff-4.4.0-15.el9_7.2 | 0.00034 | false | ||
| CVE-2025-64720 | Twistlock CVE | High | libpng-2:1.6.37-12.el9 | 0.00033 | false | ||
| CVE-2025-64720 | Anchore CVE | High | libpng-2:1.6.37-12.el9 | 0.00033 | false | ||
| CVE-2025-58185 | Twistlock CVE | Low | encoding/asn1-1.24.6 | 0.00033 | false | ||
| CVE-2025-58185 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00033 | false | ||
| CVE-2025-58185 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00033 | false | ||
| CVE-2025-46686 | Anchore CVE | Low | redis-5.4.1 | 0.00030 | false | ||
| CVE-2025-58186 | Twistlock CVE | Low | net/http-1.24.6 | 0.00029 | false | ||
| CVE-2025-58186 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00029 | false | ||
| CVE-2025-58186 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00029 | false | ||
| CVE-2025-2246 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00029 | false | ||
| CVE-2025-9165 | Anchore CVE | Low | libtiff-4.4.0-15.el9_7.2 | 0.00028 | false | ||
| CVE-2025-8851 | Twistlock CVE | Medium | libtiff-4.4.0-15.el9_7.2 | 0.00028 | false | ||
| CVE-2025-8851 | Anchore CVE | Medium | libtiff-4.4.0-15.el9_7.2 | 0.00028 | false | ||
| CVE-2025-61725 | Twistlock CVE | Low | net/mail-1.24.6 | 0.00026 | false | ||
| CVE-2025-61725 | Anchore CVE | High | stdlib-go1.24.6 | 0.00026 | false | ||
| CVE-2025-61725 | Anchore CVE | High | stdlib-go1.24.6 | 0.00026 | false | ||
| CVE-2025-61723 | Twistlock CVE | Low | encoding/pem-1.24.6 | 0.00026 | false | ||
| CVE-2025-61723 | Anchore CVE | High | stdlib-go1.24.6 | 0.00026 | false | ||
| CVE-2025-61723 | Anchore CVE | High | stdlib-go1.24.6 | 0.00026 | false | ||
| CVE-2023-25433 | Twistlock CVE | Medium | libtiff-4.4.0-15.el9_7.2 | 0.00026 | false | ||
| CVE-2023-25433 | Anchore CVE | Medium | libtiff-4.4.0-15.el9_7.2 | 0.00026 | false | ||
| CVE-2025-61724 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00025 | false | ||
| CVE-2025-61724 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00025 | false | ||
| CVE-2025-61724 | Twistlock CVE | Low | net/textproto-1.24.6 | 0.00025 | false | ||
| CVE-2025-47912 | Twistlock CVE | Low | net/url-1.24.6 | 0.00025 | false | ||
| CVE-2025-47912 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00025 | false | ||
| CVE-2025-47912 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00025 | false | ||
| CVE-2025-5101 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00023 | false | ||
| CVE-2025-48385 | Anchore CVE | High | git-1.19.1 | 0.00023 | false | ||
| CVE-2025-22870 | Twistlock CVE | Medium | golang.org/x/net/proxy-v0.33.0 | 0.00023 | false | ||
| CVE-2025-30258 | Twistlock CVE | Low | gnupg2-2.3.3-4.el9 | 0.00022 | false | ||
| CVE-2025-30258 | Anchore CVE | Low | gnupg2-2.3.3-4.el9 | 0.00022 | false | ||
| CVE-2025-61727 | Twistlock CVE | Low | crypto/x509-1.24.6 | 0.00021 | false | ||
| CVE-2025-61727 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00021 | false | ||
| CVE-2025-61727 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00021 | false | ||
| CVE-2025-64329 | Twistlock CVE | Medium | github.com/containerd/containerd-v1.7.13 | 0.00020 | false | ||
| CVE-2025-58189 | Twistlock CVE | Low | crypto/tls-1.24.6 | 0.00019 | false | ||
| CVE-2025-58189 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00019 | false | ||
| CVE-2025-58189 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00019 | false | ||
| CVE-2025-65018 | Twistlock CVE | High | libpng-2:1.6.37-12.el9 | 0.00018 | false | ||
| CVE-2025-65018 | Anchore CVE | High | libpng-2:1.6.37-12.el9 | 0.00018 | false | ||
| CVE-2024-0232 | Twistlock CVE | Low | sqlite-3.34.1-9.el9_7 | 0.00018 | false | ||
| CVE-2024-0232 | Anchore CVE | Low | sqlite-libs-3.34.1-9.el9_7 | 0.00018 | false | ||
| CVE-2023-1916 | Anchore CVE | Low | libtiff-4.4.0-15.el9_7.2 | 0.00017 | false | ||
| CVE-2025-61729 | Twistlock CVE | Low | crypto/x509-1.24.6 | 0.00016 | false | ||
| CVE-2025-61729 | Anchore CVE | High | stdlib-go1.24.6 | 0.00016 | false | ||
| CVE-2025-61729 | Anchore CVE | High | stdlib-go1.24.6 | 0.00016 | false | ||
| CVE-2025-49112 | Anchore CVE | Low | redis-5.4.1 | 0.00016 | false | ||
| CVE-2025-8556 | Twistlock CVE | Low | github.com/cloudflare/circl-v1.3.7 | 0.00015 | false | ||
| CVE-2025-58187 | Twistlock CVE | Low | crypto/x509-1.24.6 | 0.00015 | false | ||
| CVE-2025-58187 | Anchore CVE | High | stdlib-go1.24.6 | 0.00015 | false | ||
| CVE-2025-58187 | Anchore CVE | High | stdlib-go1.24.6 | 0.00015 | false | ||
| CVE-2025-58188 | Twistlock CVE | Low | crypto/x509-1.24.6 | 0.00014 | false | ||
| CVE-2025-58188 | Anchore CVE | High | stdlib-go1.24.6 | 0.00014 | false | ||
| CVE-2025-58188 | Anchore CVE | High | stdlib-go1.24.6 | 0.00014 | false | ||
| CVE-2025-58183 | Twistlock CVE | Low | archive/tar-1.24.6 | 0.00014 | false | ||
| CVE-2025-58183 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00014 | false | ||
| CVE-2025-58183 | Anchore CVE | Medium | stdlib-go1.24.6 | 0.00014 | false | ||
| CVE-2025-4979 | Anchore CVE | High | gitlab-4.19.0 | 0.00014 | false | ||
| CVE-2024-32021 | Anchore CVE | Low | git-1.19.1 | 0.00014 | false | ||
| CVE-2024-40635 | Twistlock CVE | Medium | github.com/containerd/containerd-v1.7.13 | 0.00013 | false | ||
| CVE-2025-64506 | Twistlock CVE | Medium | libpng-2:1.6.37-12.el9 | 0.00012 | false | ||
| CVE-2025-64506 | Anchore CVE | Medium | libpng-2:1.6.37-12.el9 | 0.00012 | false | ||
| CVE-2025-64505 | Twistlock CVE | Medium | libpng-2:1.6.37-12.el9 | 0.00012 | false | ||
| CVE-2025-64505 | Anchore CVE | Medium | libpng-2:1.6.37-12.el9 | 0.00012 | false | ||
| CVE-2022-3219 | Twistlock CVE | Low | gnupg2-2.3.3-4.el9 | 0.00012 | false | ||
| CVE-2022-3219 | Anchore CVE | Low | gnupg2-2.3.3-4.el9 | 0.00012 | false | ||
| CVE-2025-48386 | Anchore CVE | Medium | git-1.19.1 | 0.00011 | false | ||
| CVE-2024-1347 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00011 | false | ||
| CVE-2025-54410 | Twistlock CVE | Low | github.com/docker/docker-v25.0.6 | 0.00007 | false | ||
| CVE-2024-9512 | Anchore CVE | Medium | gitlab-4.19.0 | 0.00007 | false | ||
| CVE-2024-25621 | Twistlock CVE | High | github.com/containerd/containerd-v1.7.13 | 0.00005 | false | ||
| CVE-2025-52099 | Anchore CVE | Medium | sqlite-libs-3.34.1-9.el9_7 | N/A | false | ||
| CVE-2022-3857 | Anchore CVE | Low | libpng-2:1.6.37-12.el9 | N/A | false | ||
| b4337f21f7bd782b4b213936b00998df | Anchore Compliance | Critical | N/A | N/A | |||
| GHSA-x8qc-rrcw-4r46 | Anchore CVE | High | npm-1.0.1 | N/A | N/A | ||
| GHSA-wx77-rp39-c6vg | Anchore CVE | Low | markdown-1.0.0 | N/A | N/A | ||
| GHSA-w457-6q6x-cgp9 | Anchore CVE | Critical | handlebars-1.0.0 | N/A | N/A | ||
| GHSA-vvgc-356p-c3xw | Anchore CVE | Medium | golang.org/x/net-v0.33.0 | N/A | N/A | ||
| GHSA-vfmv-jfc5-pjjw | Anchore CVE | Medium | carrierwave-1.3.4 | N/A | N/A | ||
| GHSA-v3jv-wrf4-5845 | Anchore CVE | Low | npm-1.0.1 | N/A | N/A | ||
| GHSA-qxp5-gwg8-xv66 | Anchore CVE | Medium | golang.org/x/net-v0.33.0 | N/A | N/A | ||
| GHSA-qqgx-2p2h-9c37 | Anchore CVE | High | ini-1.0.0 | N/A | N/A | ||
| GHSA-qjxf-mc72-wjr2 | Anchore CVE | Medium | devise-two-factor-4.1.1 | N/A | N/A | ||
| GHSA-q42p-pg8m-cqh6 | Anchore CVE | High | handlebars-1.0.0 | N/A | N/A | ||
| GHSA-q2c6-c6pm-g3gh | Anchore CVE | High | handlebars-1.0.0 | N/A | N/A | ||
| GHSA-pwhc-rpq9-4c8w | Anchore CVE | High | github.com/containerd/containerd-v1.7.13 | N/A | N/A | ||
| GHSA-ph34-pc88-72gc | Anchore CVE | High | npm-1.0.1 | N/A | N/A | ||
| GHSA-p493-635q-r6gr | Anchore CVE | Medium | pug-1.0.0 | N/A | N/A | ||
| GHSA-m6hq-p25p-ffr2 | Anchore CVE | Medium | github.com/containerd/containerd-v1.7.13 | N/A | N/A | ||
| GHSA-m6cx-g6qm-p2cx | Anchore CVE | High | npm-1.0.1 | N/A | N/A | ||
| GHSA-m5h6-hr3q-22h5 | Anchore CVE | High | npm-1.0.1 | N/A | N/A | ||
| GHSA-j5w8-q4qc-rx2x | Anchore CVE | Medium | golang.org/x/crypto-v0.35.0 | N/A | N/A | ||
| GHSA-h6ch-v84p-w6p9 | Anchore CVE | High | diff-1.0.0 | N/A | N/A | ||
| GHSA-gxhx-g4fq-49hj | Anchore CVE | Medium | carrierwave-1.3.4 | N/A | N/A | ||
| GHSA-g9r4-xpmj-mj65 | Anchore CVE | High | handlebars-1.0.0 | N/A | N/A | ||
| GHSA-f6x5-jh6r-wrfv | Anchore CVE | Medium | golang.org/x/crypto-v0.35.0 | N/A | N/A | ||
| GHSA-f2jv-r9rf-7988 | Anchore CVE | Critical | handlebars-1.0.0 | N/A | N/A | ||
| GHSA-9prh-257w-9277 | Anchore CVE | Medium | handlebars-1.0.0 | N/A | N/A | ||
| GHSA-93f3-23rq-pjfp | Anchore CVE | Medium | npm-1.0.1 | N/A | N/A | ||
| GHSA-765h-qjxv-5f44 | Anchore CVE | Critical | handlebars-1.0.0 | N/A | N/A | ||
| GHSA-6v2p-p543-phr9 | Anchore CVE | High | golang.org/x/oauth2-v0.16.0 | N/A | N/A | ||
| GHSA-4vq8-7jfc-9cvp | Anchore CVE | Low | github.com/docker/docker-v25.0.6+incompatible | N/A | N/A | ||
| GHSA-4328-8hgf-7wjr | Anchore CVE | High | npm-1.0.1 | N/A | N/A | ||
| GHSA-3cqr-58rm-57f8 | Anchore CVE | High | handlebars-1.0.0 | N/A | N/A | ||
| GHSA-3c6g-pvg8-gqw2 | Anchore CVE | High | json-1.0.0 | N/A | N/A | ||
| GHSA-3965-hpx2-q597 | Anchore CVE | Medium | pug-1.0.0 | N/A | N/A | ||
| GHSA-2x5j-vhc8-9cwm | Anchore CVE | Low | github.com/cloudflare/circl-v1.3.7 | N/A | N/A | ||
| GHSA-2cf5-4w76-r9qv | Anchore CVE | High | handlebars-1.0.0 | N/A | N/A | ||
| GHSA-265r-hfxg-fhmg | Anchore CVE | Medium | github.com/containerd/containerd-v1.7.13 | N/A | N/A | ||
| CCE-88048-4 | OSCAP Compliance | Medium | N/A | N/A | |||
| CCE-83613-0 | OSCAP Compliance | Low | N/A | N/A | |||
| 9d45a8e938140f46af01fe87fa4003fa | Anchore Compliance | Critical | N/A | N/A | |||
| 85567da27ab943cdfb6f54ec28a6fb7d | Anchore Compliance | Critical | N/A | N/A | |||
| 82146aec4e12f16ec2c3fe690f9484e5 | Anchore Compliance | Critical | N/A | N/A | |||
| 30cfb17e730480765f1bc2bad28a81c8 | Anchore Compliance | Critical | N/A | N/A | |||
| 2a31d02643eaefbbe4c387f3922a0fe7 | Anchore Compliance | Critical | N/A | N/A | |||
| 21fa99e6694d546b7f2d4e436f4d1ba4 | Anchore Compliance | Critical | N/A | N/A |
More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=gitlab/gitlab/gitlab-rails&tag=18.6.2&branch=master
Tasks
Contributor:
-
Apply the StatusReview label to this issue for a merge request reviewand wait for feedback
OR
-
Provide justifications for findings in the VAT (docs) -
Apply the StatusVerification label to this issue for a VAT justifications reviewand wait for feedback
Iron Bank:
-
Review findings and justifications
Note: If the above process is rejected for any reason, the
RevieworVerificationlabel will be removed and the issue will be sent back toTo-Do. Any comments will be listed in this issue for you to address. Once they have been addressed, you must re-add theRevieworVerificationlabel.
Questions?
Contact the Iron Bank team by commenting on this issue with your questions or concerns. If you do not receive a response, add /cc @ironbank-notifications/onboarding.
Additionally, Iron Bank hosts an AMA working session every Wednesday from 1630-1730EST to answer questions.
Edited by CHORE_TOKEN