# Jenkins Docker Images - Vulnerabilities being Flagged by AWS ECR Scanner

**URL:** <https://community.jenkins.io/t/jenkins-docker-images-vulnerabilities-being-flagged-by-aws-ecr-scanner/15147>\
**Category:** Using Jenkins\
**Tags:** sig-security\
**Created:** [May 15, 2024, 3:43pm UTC](https://community.jenkins.io/t/jenkins-docker-images-vulnerabilities-being-flagged-by-aws-ecr-scanner/15147 "2024-05-15T15:43:59Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\
**Post date:** [May 16, 2024, 5:54pm UTC](https://community.jenkins.io/t/jenkins-docker-images-vulnerabilities-being-flagged-by-aws-ecr-scanner/15147/2 "2024-05-16T17:54:45Z")

</div>

> [@Is there a Jenkins Docker image without security vulnerabilities?](https://community.jenkins.io/t/is-there-a-jenkins-docker-image-without-security-vulnerabilities/6771/7):
>
> Yes, that is correct. The Jenkins security officer has said: Instead of announcing a continuous flow of non-impacting vulnerabilities, our approach is to publish information only for those that we consider interesting, like critical score, widely spread, etc. For them you will find an article in our [blog](https://www.jenkins.io/node), like: [Log4Shell](https://www.jenkins.io/blog/2021/12/10/log4j2-rce-CVE-2021-44228/) or [SpringShell](https://www.jenkins.io/blog/2022/03/31/spring-rce-CVE-2022-22965/%5B).

---

_[View the full topic](https://community.jenkins.io/t/jenkins-docker-images-vulnerabilities-being-flagged-by-aws-ecr-scanner/15147)._