Package
gitlab-rails-ce-fips-19.2
Component
github.com/docker/docker
Latest update
6.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The vulnerable component is github.com/docker/docker v28.0.0+incompatible, statically compiled into the devfile binary at /srv/gitlab/vendor/bundle/ruby/3.3.0/gems/devfile-0.5.3-/out/devfile--linux. Per https://github.com/advisories/GHSA-pxq6-2prw-chj9 there is no patched version for github.com/docker/docker (vulnerable range <29.3.1, no fixed version recorded); the advisory's only patched entry is the separate module path github.com/moby/moby/v2 at 2.0.0-beta.8. No release on the github.com/docker/docker path resolves this: proxy.golang.org reports the latest available version as v28.5.2+incompatible, which remains inside the vulnerable range. Resolving this requires the upstream devfile library to migrate its import to github.com/moby/moby/v2, which is a change in the upstream application source. Deferring to upstream to address this CVE in a subsequent release.
Status