Vulnerable image mcr.microsoft.com/dotnet/sdk:6.0

[oronboni]

Describe the Bug

Base on Qualys scanning the image: mcr.microsoft.com/dotnet/sdk:6.0 has the following CVEs

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0820
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34716
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8292
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24112

Steps to Reproduce

Other Information

Output of docker version

Output of docker info

[mjprager]

DOTNET team - it's possible these are false positives? A fellow security peer offered that "It appears this is because the path where SDK is installed gets misclassified and the scanner assumes it’s looking at an application. The scanner proceeds to read *.deps.json files in this path and treats them as application metadata about referenced assemblies. This approach doesn’t work if it’s an SDK. Even if the deps.json files referenced a vulnerable package, no vulnerable assemblies are shipped with the SDK."

It would be good to have this affirmed if true, or the vulns must be fixed if not.

[mthalman]

Duplicate of dotnet/sdk#30659