Skip to main content

Image SCA (Image Vulnerabilities)

What is actually installed in the deployed image is the real exposure surface. Even OS package vulnerabilities from the base image, which never appear in the source manifest, are revealed here. This checks known vulnerabilities (CVEs) in the OS packages and application dependencies contained in the container image. Used by the Container image service.

Difference from source SCA

Source SCA reads the package manifest in the code, while image SCA looks at what is actually installed in the completed image layers. That is why it also reveals OS package vulnerabilities pulled in by the base image. (Source SCA)

What it finds​

  • OS packages : CVEs in system packages installed in the base image (alpine/debian/ubuntu, etc.).
  • App dependencies : CVEs in application libraries bundled inside the image.
  • Supported ecosystems : OS packages (Alpine / Debian / Ubuntu / RHEL / Amazon Linux, etc.) and app ecosystems (npm · PyPI · RubyGems · Maven / Gradle · Go · Cargo · Composer · NuGet, etc.).

Prioritization information​

Each CVE is classified by severity, and the following information is attached to help decide the remediation order.

  • KEV A vulnerability with confirmed active exploitation. Handle it first.
  • CRITICAL HIGH Priority by severity.
  • EPSS (exploitation probability) and CWE (type classification) are shown together in the details.

Image SCA results

Continuous monitoring​

Image components are continuously monitored even after a scan. Even without a rescan, when a new CVE is published it is reflected in the inventory and you are alerted.

Handling results​

Remediate by removing the vulnerable package or updating the base image. If there is no real impact, mark it as accepted risk and export the rationale as VEX.

Next steps​

Use the resultsVulnerability managementReview findings, mark false positive/accepted riskUse the resultsReports · VEXExport a not-affected rationaleUse the resultsSecurity NewsContinuous monitoring alerts for new CVEsSame typeSBOM · HardeningComponent list and image configuration violationsOverviewContainer imagesRegistration and rescan methods