topic Issue in reported vulnerability in Prisma Cloud Discussions

Issue in reported vulnerability

NSrinivasan — Thu, 10 Feb 2022 13:10:19 GMT

Hi Prismacloud team,

We are getting below three golang vulnerabilities in all images and hosts which don't have golang installed.

These go vulnerabilities are reported even in all the node based docker images and also in all hosts which don’t have any jar or application related to golang.

Could you please explain to us why we are getting these vulnerabilities in all hosts and images. Please refer to the screenshot attached.

CVE-2021-45046

CVE-2020-29652

CVE-2021-44716

Re: Issue in reported vulnerability

david_michael — Thu, 10 Feb 2022 20:39:52 GMT

Are you able to find the vulnerable package by searching within the "Package Info" tab?

Re: Issue in reported vulnerability

NSrinivasan — Fri, 11 Feb 2022 04:48:02 GMT

Let me check. Thanks for the reply.

Re: Issue in reported vulnerability

RPrasadi — Wed, 13 Jul 2022 21:45:10 GMT

Sometimes a CVE can belong to a different application, we need to understand what images they are scanning if they can give us the pull URL, we can download the image from the repo and scan it individually and see what's going on.