# Jenkins Docker Images - Vulnerabilities being Flagged by AWS ECR Scanner

**URL:** <https://community.jenkins.io/t/jenkins-docker-images-vulnerabilities-being-flagged-by-aws-ecr-scanner/15147>\
**Category:** Using Jenkins\
**Tags:** sig-security\
**Created:** [May 15, 2024, 3:43pm UTC](https://community.jenkins.io/t/jenkins-docker-images-vulnerabilities-being-flagged-by-aws-ecr-scanner/15147 "2024-05-15T15:43:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![abdulrafaykhan](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/abdulrafaykhan/32/8228_2.png) [@abdulrafaykhan](https://community.jenkins.io/u/abdulrafaykhan)\
**Post date:** [May 15, 2024, 3:43pm UTC](https://community.jenkins.io/t/jenkins-docker-images-vulnerabilities-being-flagged-by-aws-ecr-scanner/15147/1 "2024-05-15T15:43:59Z")

</div>

Jenkins setup: jenkins/jenkins:lts-almalinux Docker Image

Hi Team,

New comer here ! Looking for some support in the following:

Recently, our vulnerability scanner is flagging some vulneabilities in this containers. Some of these vulnerabilities are mentioned as Critical & High.

We updated the image, however the scanner is still flagging the vulnerabilities

Also I found a thread related to this here:[Is there a Jenkins Docker image without security vulnerabilities? - #6 by ohbei](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771/6)

From the above link, I gather that the scanners are mostly just identifying vulns related to the underlying packages & libraries and not related to Jenkins itself, or not even how Jenkins uses it

In that sense, we might mark the vulnerability as Not Applicable in our case

The reason Im raising is just to confirm whether or not this is the case

I apologize if this is not the right place to raise the query, but I want to be sure before marking the findings as Not Applicable

Thank you & Hope you guys have a great day ahead 🙂

Best Regards,

---

<div class="post-metadata">

**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\
**Post date:** [May 16, 2024, 5:54pm UTC](https://community.jenkins.io/t/jenkins-docker-images-vulnerabilities-being-flagged-by-aws-ecr-scanner/15147/2 "2024-05-16T17:54:45Z")

</div>

> [@Is there a Jenkins Docker image without security vulnerabilities?](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771/7):
>
> Yes, that is correct. The Jenkins security officer has said: Instead of announcing a continuous flow of non-impacting vulnerabilities, our approach is to publish information only for those that we consider interesting, like critical score, widely spread, etc. For them you will find an article in our [blog](https://www.jenkins.io/node), like: [Log4Shell](https://www.jenkins.io/blog/2021/12/10/log4j2-rce-CVE-2021-44228/) or [SpringShell](https://www.jenkins.io/blog/2022/03/31/spring-rce-CVE-2022-22965/%5B).