CVE-2024-29034

Medium

Advisory

Published 25 Mar 2024In the index since 8 Sept 2026

CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 4 images.

Affected package	Affected versions	Fixed in	Images
carrierwavegem	1.3.1, 1.3.2	2.2.6	4

2 by stars

Chart

Latest

Affected images

Radar Score

openprojecthomeenterpriseinc

1 of the 1 container images this version deploys carry CVE-2024-29034.

Container image	Digest	Package	Fixed in
openproject/community :12.0.2	734743d11094	carrierwave@1.3.2	2.2.6

6,810

gitlabkubesphere

3 of the 17 container images this version deploys carry CVE-2024-29034.

Container image	Digest	Package	Fixed in
mirrorgitlabcontainers/gitlab-sidekiq-ce :v13.2.2	94d1431683fa	carrierwave@1.3.1	2.2.6
mirrorgitlabcontainers/gitlab-task-runner-ce :v13.2.2	9efd73993c34	carrierwave@1.3.1	2.2.6
mirrorgitlabcontainers/gitlab-webservice-ce :v13.2.2	30393f990f5c	carrierwave@1.3.1	2.2.6

38,133

4 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
mirrorgitlabcontainers/gitlab-sidekiq-ce :v13.2.2	94d1431683fa	carrierwave@1.3.1	2.2.6	1
mirrorgitlabcontainers/gitlab-task-runner-ce :v13.2.2	9efd73993c34	carrierwave@1.3.1	2.2.6	1
mirrorgitlabcontainers/gitlab-webservice-ce :v13.2.2	30393f990f5c	carrierwave@1.3.1	2.2.6	1
openproject/community :12.0.2	734743d11094	carrierwave@1.3.2	2.2.6	1