False positive?

Question

kwaazaar opened this issue 5 years ago · 2 comments

I use Twistlock image vulnerability scanning and it finds a new CVE since sunday. Is this a false positive?

Vulnerabilities

Image ID CVE Package Version Severity Status CVSS

tomcat:9-jdk8-openjdk-slim 54b465e3c80e21ac CVE-2017-10140 db5.3 5.3.28+dfsg1-0.5 high fixed in 5.3.28-13.1 7.8

Answer 1 · 2019-10-30T12:04:12.000Z

I just noticed this CVE was previously classified by Twistlock as medium, now it's high. I'll check with them why it has changed.

Answer 2 · 2019-10-30T16:23:25.000Z

Confirmed by Twistlock the issue is in their tooling. A recent update removed this false positive