hard20 pts · first answer countsdevsecopscontainer-securityvulnerability-management

CVE in a package the app never uses

An image ships ImageMagick only because an old base image included it. The app never calls it, and a critical CVE has no fix yet. What is the best action?

A.Accept it permanently, since the app never calls itB.Remove the package from the image so the finding is goneC.Wait for the upstream fix and do nothing until thenD.Block the CVE ID in the scanner for all images

Discussion 0

Join free to post in the discussion.

CVE in a package the app never uses

Discussion 0

Related questions