11.1.2.3 Image CVE Detection
A focused guide to Image CVE Detection, connecting core concepts with practical Docker and container operations.
Image CVE detection identifies specific, publicly documented Common Vulnerabilities and Exposures within an image's installed packages, matching package versions against a maintained vulnerability database to surface exactly which known, identifiable security issues an image's content might be exposed to.
How CVE Detection Works
A scanning tool compares each installed package's exact version against a database of known CVEs affecting that specific package, reporting any matches found.
docker scout cves myapp:1.0
CVE-2024-12345 HIGH openssl 3.0.1 Fixed in 3.0.8
This finding identifies a specific, publicly documented vulnerability affecting this exact version of openssl, along with the version where it's been fixed.
Why Knowing the Specific CVE Identifier Is Useful
A specific CVE identifier allows looking up detailed, authoritative information about that exact vulnerability — its actual mechanism, exploitability, and any known mitigations — beyond what a scan's summary alone might convey.
docker scout cves myapp:1.0 --format only-fixed
Filtering specifically to findings with a known fix helps prioritize remediation toward issues that can actually be directly addressed by an available update.
Why CVE Databases Are Continuously Updated
New vulnerabilities are discovered and published on an ongoing basis, meaning a scan run today might surface findings that wouldn't have appeared in a scan of the exact same image run weeks earlier, before those particular CVEs were known.
docker scout cves myapp:1.0
Running this scan periodically, even against an image that hasn't changed, can surface newly disclosed CVEs affecting its existing, unchanged package versions.
Why Image CVE Detection Matters
Detecting specific, identifiable CVEs provides concrete, actionable findings — tied to authoritative, publicly documented vulnerability information — that general awareness of "scanning for vulnerabilities" alone doesn't convey, making this specific detection capability central to meaningful image security practice.