Used maven:3.9.6-amazoncorretto-17-al2023, tomcat:10.1.17-jre17 to build the image.
When we scan the final built image using Blackduck. There are many critical and high vulnerabilities. As many of the packages are still vulnerable even after upgrading. I do not find any way to update it to no vulnerable version.
Could you please guide on resolution ?
Hi
The best way is to check if the docker repo has a newer version, else you can always try and build it yourself?
@terpz Thanks. We ensure to use latest images. Most of the times, components are vulnerable in newer version too, which is detected in BDH. Any suggestion on that.
Hi Team,
Updated my image to tomcat:10.1.23-jre17. Still there are vulnerability found in the final image by Blackduck hub.
For ex. GNU PG 2.2.7 showing low vulnerability by docker hub, the same version is showing critical vulnerability in BDH. Could you please fix that or provide the solution ?
I recently downloaded nicolaka/netshoot latest image but it has critical vulnerabilities. When can we expect that to be addressed ? @nicolaka