Package
gitlab-rails-ce-19.2
Component
github.com/containerd/containerd
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The vulnerable component is github.com/containerd/containerd v1.7.33, statically compiled into the devfile binary at /srv/gitlab/vendor/bundle/ruby/3.3.0/gems/devfile-0.5.3-/out/devfile--linux. Per https://github.com/advisories/GHSA-rgh6-rfwx-v388, the fix exists only in the renamed github.com/containerd/containerd/v2 module (2.1.9 / 2.2.5 / 2.3.2); no fixed release exists on the v1 module line, which is listed as affected from 0 with no patched version. The newest v1 release, 1.7.34, was published after those v2 fixes and does not contain them, so no bump within the v1 line resolves this finding. Reaching a fixed release requires the upstream devfile library to migrate its import to github.com/containerd/containerd/v2, which is a change in the upstream application source. Deferring to upstream to address this CVE in a subsequent release.
Status