An image scan suddenly reports a dozen new Critical CVEs on an image that hasn't changed in months
The Dockerfile and source code are unchanged, but a scheduled re-scan in CI now fails. Explain why and the correct response. Expected reasoning: the image's pinned base image and dependencies haven't changed, but the vulnerability database has — new CVEs are continuously discovered and published against existing software versions. The correct response is not to disable scanning, but to evaluate each finding (patch availability, exploitability, exposure), upgrade the affected base image/dependency where a fix exists, and document any accepted-risk exceptions with an expiry date for re-review.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response