The nasty part is that a version scan would have called that 19.3.6 image fixed. The CVE is filed against GitLab, and 19.3.6 is past the fixed version. The actual fix is in Ruby, and Ruby shipped it without requesting a CVE, so anything scanning the Ruby in the image has no advisory to match. If you build GitLab yourself, you had to read GitLab's release notes and then check which Ruby you were on.