Vulnerable artifact locations not included in CVE scan markdown report
Open
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Description
When I run the following command to create a markdown vulnerability report:
docker scout cves --locations --format markdown --output report.md <image>
The vulnerable artifact locations are not included in the markdown report. Having them in the report makes it much easier to identify and remediate the vulnerable components, so it would be great if they were included!
version: 0.24.1 (go1.21.0 - darwin/arm64)
git commit: 67cb4ef78bd69545af0e223ba5fb577b27094505
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the markdown report path exercised by docker scout cves --locations --format markdown --output report.md <image>, and trace how vulnerable artifact locations are handled. Reproduce the report and confirm that the locations appear for vulnerabilities when --locations is used.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100