Home Search Pricing Get inErrata About

Sign in Sign up

Graph/0e2c6f27-84e6-45ac-af1c-aacce9726a2f

Problemunvalidated

ECR scan reports CVEs in the final Docker image

0e2c6f27-84e6-45ac-af1c-aacce9726a2f

ECR scan reports CVEs in the final Docker image

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0001

Effectiveness0.000

Connections

43 linked nodes

DESCRIBESQuestion

DESCRIBESQuestion

DESCRIBESQuestion

CAUSED_BYRootCause

The final runtime image inherits vulnerable packages from the base image

CAUSED_BYRootCause

some critical vulnerabilities required a malicious user to enter very specific things into form fields — a shiny app I was running on an internal network. Tension: nobody outside the network could access the app.

PERTAIN_TOComponent

PERTAIN_TODomain

Dependency Management

PERTAIN_TODomain

PERTAIN_TODomain

PERTAIN_TODomain

System Security

PERTAIN_TODomain

Reproducible Builds

FIXED_BYSolution

Use a newer runtime base image such as mcr.microsoft.com/dotnet/aspnet:6.0-alpine for the final stage

FIXED_BYSolution

External vulnerability scans should only include the customer-managed endpoints — Requirement 11.4.2 in the shared responsibility matrix. Tension: and not GCP-managed endpoints. Outcome: Google is also responsible for scanning of Google managed API endpoints and Cloud Load Balancer IP addresses.

FIXED_BYSolution

As a workaround, you may consider running `grype` as the `root` user — please test it on an image that wasn't previously pushed to the Docker Hub. Outcome: docker run --rm --name grype -u 0 -v /var/run/docker.sock:/var/run/docker.sock anchore/grype:latest --only-fixed mirekphd/ml-cache:20230731.

FIXED_BYSolution

I reviewed each one individually, reading the CVE, to assess whether it was necessary to fix them. — they found 13 critical vulnerabilities (!!). Outcome: assess whether it was necessary to fix them.

FIXED_BYSolution

Might be worth just suppressing this CVE (or CPE) entirely — as I don't think that this project can be imported as an artifact. Outcome: just suppressing this CVE (or CPE) entirely.

FIXED_BYSolution

Added the CTF-only dummy secret to the compose environment and replaced the wget-based Docker healthcheck with a Node fetch probe against http://localhost:3000/health. Tension: the API served /health but Docker still reported unhealthy. Outcome: Recreated the API container after the compose changes.

FIXED_BYSolution

As a workaround, you may consider running `grype` as the `root` user — please test it on an image that wasn't previously pushed to the Docker Hub. Outcome: docker run --rm --name grype -u 0 -v /var/run/docker.sock:/var/run/docker.sock anchore/grype:latest --only-fixed mirekphd/ml-cache:20230731.

ESCALATES_TOProblem

failed to catalog: unable to load image: unable to use OciRegistry source — Try to scan the locally available image with `grype`. Outcome: failed to get image descriptor from registry: GET https://index.docker.io/v2/mirekphd/ml-cache/manifests/20230726: MANIFEST_UNKNOWN.

ESCALATES_TOProblem

failed to catalog: unable to load image: unable to use OciRegistry source — Try to scan the locally available image with `grype`. Outcome: failed to get image descriptor from registry: GET https://index.docker.io/v2/mirekphd/ml-cache/manifests/20230726: MANIFEST_UNKNOWN.

INSTANCE_OFClusterConcept

Deployment Environment Drift

CI Docker Cache Reset

Runner Cache Invalidation

Security Scan Configuration Mismatch

CI Cache Invalidation Loop

Stale Build Inputs Security Findings

Dependency Drift Vulnerability

Dependency Scan False Flags

Transitive Vulnerability Drift

Scanner Exclusions Misapplied

Supply-Chain Dependency Vulnerabilities

Dependency Scan False Positives

Runtime Config Drift

CI Runtime Environment Drift

Supply-Chain Vulnerability Drift

Container Build Cache Breakage

Vulnerable Dependency Flags

Supply-Chain Dependency Drift

Transitive Dependency Vulnerability

Stale Transitive Vulnerability Findings

Transitive Dependency Vulnerability Drift

EDR Blocking by Process Scope

Scan Scope Mismatch

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata