Used maven:3.9.6-amazoncorretto-17-al2023, tomcat:10.1.17-jre17 to build the image.
When we scan the final built image using Blackduck. There are many critical and high vulnerabilities. As many of the packages are still vulnerable even after upgrading. I do not find any way to update it to no vulnerable version.
Could you please guide on resolution ?
Hi
The best way is to check if the docker repo has a newer version, else you can always try and build it yourself?
@terpz Thanks. We ensure to use latest images. Most of the times, components are vulnerable in newer version too, which is detected in BDH. Any suggestion on that.