.NET SDK images have (false positive) .NET CVEs

[richlander]

This should never happen. The scanners are reporting false positives (in part) due to stale dependencies.

This has been reported multiple times. I'm starting a new tracking issue. There are lots of scanners. I'm using Docker Scout because it is easy for me to use. Nice product!

.NET SDK 8.0.203 image:

There are a mixture of .NET SDK, PowerShell (due to .NET dependencies), and Debian CVEs.

.NET SDK 8.0.300-preview.24201.7 (from https://github.com/dotnet/installer?tab=readme-ov-file#table):

A number of the (false positive) .NET CVEs are resolved in 8.0.300, which should be released in May.

Outstanding issues:

• CVE-2023-29331
  • System.Security.Cryptography.Pkcs 7.0.0
  • /usr/share/dotnet/sdk/8.0.300-preview.24201.7/DotnetTools/dotnet-watch/8.0.300-preview.24201.10/tools/net8.0/any/BuildHost-netcore/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.deps.json
• CVE-2024-0057
  • NuGet.Packaging 6.7.0.127
  • /usr/share/powershell/.store/powershell.linux.x64/7.4.1/powershell.linux.x64/7.4.1/tools/net8.0/any/Modules/Microsoft.PowerShell.PSResourceGet/dependencies/NuGet.Packaging.dll
  • /usr/share/powershell/.store/powershell.linux.x64/7.4.1/powershell.linux.x64/7.4.1/tools/net8.0/any/Modules/Microsoft.PowerShell.PSResourceGet/_manifest/spdx_2.2/manifest.spdx.json
• CVE-2024-0056
  • System.Data.SqlClient 4.8.5
  • /usr/share/powershell/.store/powershell.linux.x64/7.4.1/powershell.linux.x64/7.4.1/tools/net8.0/any/Modules/PSReadLine/_manifest/spdx_2.2/manifest.spdx.json

The remaining Debian issues are low severity and have a mix of fix available and not at the time of writing:

• CVE-2022-0563
• CVE-2024-28085

The CVE with a fix available should be resolved the next time we rebuild our Debian images.

[lbussell]

Related: dotnet/sdk#30659

[mrhussaini]

Any tentative date when these images will be available to download that has no vulnerabilities?

[richlander]

The May images should have a marked improvement.

[mrhussaini]

Sorry not sure If I understand. IF you do not know the tentative date, can you able to confirm this is will be available to download in beginning or mid or end of the May month?