[SOLVED] Docker Scout CVEs have incorrect severity levels for base Microsoft .NET docker images

Docker Scout CVEs have incorrect severity levels for base Microsoft .NET docker images

I'm trying to understand what's wrong with security for base Microsoft aspnet docker images, like mcr.microsoft.com/dotnet/aspnet:6.0 or aspnet:6.0-bookworm-slim.

I pulled actual images and got information by docker scout that they have only LOW severity cve:

> docker scout quickview mcr.microsoft.com/dotnet/aspnet:6.0-bookworm-slim
 
Your image  mcr.microsoft.com/dotnet/aspnet:6.0-bookworm-slim  │    0C     0H     0M    20L

But if you look on it more precisely:

> docker scout cves mcr.microsoft.com/dotnet/aspnet:6.0-bookworm-slim

you can find cve like:

0C     0H     0M     2L  perl 5.36.0-7
pkg:deb/debian/perl@5.36.0-7?os_distro=bookworm&os_name=debian&os_version=12

    x LOW CVE-2023-31486
      https://scout.docker.com/v/CVE-2023-31486
      Affected range : >=5.36.0-7
      Fixed version  : not fixed

    x LOW CVE-2011-4116
      https://scout.docker.com/v/CVE-2011-4116
      Affected range : >=5.36.0-7
      Fixed version  : not fixed

And finally when you go to page of CVE-2023-31486 https://scout.docker.com/vulnerabilities/id/CVE-2023-31486?utm_source=desktop&utm_medium=ExternalLink

you will see on nist (This is our recommended source for this CVE), that this CVE has score 8.1 and severity HIGH!

And there're lots of such CVEs with HIGH severity in these official base images for aspnet runtime apps.

My first question, why Docker Scout is confusing with absolutely wrong level of cves in its report? And my second question, what is the best practice of using base Microsoft images for .net apps? Should I create custom image with updated components? Or maybe I should use only alpine images?

Solution

The image in your example is based on Debian Bookworm. Docker Scout prefers severities and scoring from vendors and security research teams of Linux distributions.

Hence in your concrete example, CVE-2023-31486 is marked HIGH on NIST but deemed 'unimportant' on https://security-tracker.debian.org/tracker/CVE-2023-31486.

Let me know if that helps,