# Is there a Jenkins Docker image without security vulnerabilities? **URL:** \ **Category:** Using Jenkins\ **Created:** [April 8, 2023, 10:50am UTC](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771 "2023-04-08T10:50:49Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Babbili](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/babbili/32/3893_2.png) [@Babbili](https://community.jenkins.io/u/Babbili)\ **Post date:** [April 8, 2023, 10:50am UTC](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771/1 "2023-04-08T10:50:49Z")
I have tried all these Jenkins docker images and scanned them from security vulnerabilities, but unfortunately they all have lots of vulnerabilities even the `alpine` tag ```plaintext # FROM jenkins/jenkins:lts-alpine-jdk17 # FROM jenkins/jenkins:lts-alpine FROM jenkins/jenkins:alpine # FROM jenkins/jenkins:2.332.3-jdk11 # FROM jenkins/jenkins:lts # FROM jenkins/jenkins:latest # FROM bitnami/jenkins:latest # FROM bitnami/jenkins:2-debian-11 ``` is there a Jenkins Docker image without security vulnerabilities ? ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [April 8, 2023, 11:38am UTC](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771/2 "2023-04-08T11:38:07Z")
> [@Babbili](#): > > is there a Jenkins Docker image without security vulnerabilities ? I think your question implies “is there a Jenkins container image that contains no component that alerts my security scanner?” If that is your question, then the answer is, “most likely not, since your security scanner is probably flagging security vulnerabilities in the container that do not affect Jenkins”. The [advanced image analysis of jenkins/jenkins:2.387.2-jdk17](https://hub.docker.com/layers/jenkins/jenkins/2.387.2-alpine-jdk17/images/sha256-f0bdefd0edfdd7120c51ff780671246a6a3d2c26c295f49eae780afd40ab4921?context=repo&tab=vulnerabilities) as provided on [hub.docker.com](http://hub.docker.com) by Docker Scout (early access) can be used as an example of the types of reports usually raised for Jenkins container images. It reports - snakeyaml 1.32 affected by a CVE (that does not affect Jenkins) - snakeyaml 1.33 affected by a CVE (that does not affect Jenkins) - Jenkins core 2.387.2 claimed to be affected by 5 CVEs (that are all resolved in 2.375.4 and 2.387.1) - … more “vulnerabilities” that do not affect Jenkins The Jenkins security team has issued advisories in the past for vulnerabilities in containers. The [Feb 9, 2023 advisory](https://www.jenkins.io/security/advisory/2023-02-09/) was issued for vulnerabilities in command line git. With regard to CVE’s in dependencies, the Jenkins security officer has said: > When a CVE has an impact to the security of Jenkins, we include it in an advisory, like [CVE-2022-2048 in Jetty](https://www.jenkins.io/security/advisory/2022-09-09/#SECURITY-2868) or [CVE-2021-43859 in XStream](https://www.jenkins.io/security/advisory/2022-02-09/#SECURITY-2602) > > Instead of announcing a continuous flow of non-impacting vulnerabilities, our approach is to publish information only for those that we consider interesting, like critical score, widely spread, etc. > For them you will find an article in our [blog](https://www.jenkins.io/node), like: [Log4Shell](https://www.jenkins.io/blog/2021/12/10/log4j2-rce-CVE-2021-44228/) or [SpringShell](https://www.jenkins.io/blog/2022/03/31/spring-rce-CVE-2022-22965/%5B). Of the images that you listed, one of them has known vulnerabilities that affect Jenkins. You should not use `jenkins/jenkins:2.332-jdk11` since there are known vulnerabilities in that version. That is a Jenkins long term support release that was delivered 11 months ago and is affected by Jenkins security advisories: - [Jenkins Security Advisory 2023-03-08](https://www.jenkins.io/security/advisory/2023-03-08/) - [Jenkins Security Advisory 2022-09-09](https://www.jenkins.io/security/advisory/2022-09-09/) - [Jenkins Security Advisory 2022-06-22](https://www.jenkins.io/security/advisory/2022-06-22/) ---
**Author:** ![Babbili](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/babbili/32/3893_2.png) [@Babbili](https://community.jenkins.io/u/Babbili)\ **Post date:** [April 8, 2023, 11:52am UTC](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771/3 "2023-04-08T11:52:13Z")
Thank you Mark for your reply, which one please do you advice me to use ? ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [April 8, 2023, 12:00pm UTC](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771/4 "2023-04-08T12:00:06Z")
> [@Babbili](#): > > which one please do you advice me to use ? If you plan to update weekly, then I recommend [jenkins/jenkins:2.399-alpine-jdk17](https://hub.docker.com/layers/jenkins/jenkins/2.399-alpine-jdk17/images/sha256-5c7a8b4aadc8095f2f26aec469bdc60d2dc88dc7074efe7098abdce1c27ac8dc?context=explore) as the starting point, then next week you’ll update to 2.400, and the week after that 2.401. If you plan to update monthly, then I recommend [jenkins/jenkins:2.387.2-alpine-jdk17](https://hub.docker.com/layers/jenkins/jenkins/2.387.2-alpine-jdk17/images/sha256-f0bdefd0edfdd7120c51ff780671246a6a3d2c26c295f49eae780afd40ab4921?context=explore), then in about a month you’ll update to 2.387.3-alpine-jdk17, then a month after that you’ll update to the next LTS release. More information is available at: > **[Jenkins download and deployment](https://www.jenkins.io/download/)** > > Jenkins – an open source automation server which enables developers around the world to reliably build, test, and deploy their software ---
**Author:** ![ohbei](https://avatars.discourse-cdn.com/v4/letter/o/cab0a1/32.png) [@ohbei](https://community.jenkins.io/u/ohbei)\ **Post date:** [May 11, 2023, 12:30am UTC](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771/6 "2023-05-11T00:30:47Z")
Thanks for the detailed response. To confirm, is the only way to validate that a vulnerability (e.g., in snakeyaml) does not affect Jenkins is to check that there is no advisory for it? ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [May 11, 2023, 5:56pm UTC](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771/7 "2023-05-11T17:56:54Z")
> [@ohbei](#): > > To confirm, is the only way to validate that a vulnerability (e.g., in snakeyaml) does not affect Jenkins is to check that there is no advisory for it? Yes, that is correct. The Jenkins security officer has said: > Instead of announcing a continuous flow of non-impacting vulnerabilities, our approach is to publish information only for those that we consider interesting, like critical score, widely spread, etc. > For them you will find an article in our [blog](https://www.jenkins.io/node), like: [Log4Shell](https://www.jenkins.io/blog/2021/12/10/log4j2-rce-CVE-2021-44228/) or [SpringShell](https://www.jenkins.io/blog/2022/03/31/spring-rce-CVE-2022-22965/%5B).