# Is there a Jenkins Docker image without security vulnerabilities?

**URL:** <https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771>\
**Category:** Using Jenkins\
**Created:** [April 8, 2023, 10:50am UTC](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771 "2023-04-08T10:50:49Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\
**Post date:** [May 11, 2023, 5:56pm UTC](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771/7 "2023-05-11T17:56:54Z")

</div>

> [@ohbei](#):
>
> To confirm, is the only way to validate that a vulnerability (e.g., in snakeyaml) does not affect Jenkins is to check that there is no advisory for it?

Yes, that is correct. The Jenkins security officer has said:

> Instead of announcing a continuous flow of non-impacting vulnerabilities, our approach is to publish information only for those that we consider interesting, like critical score, widely spread, etc.  
> For them you will find an article in our [blog](https://www.jenkins.io/node), like: [Log4Shell](https://www.jenkins.io/blog/2021/12/10/log4j2-rce-CVE-2021-44228/) or [SpringShell](https://www.jenkins.io/blog/2022/03/31/spring-rce-CVE-2022-22965/%5B).

---

_[View the full topic](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771)._