jfrog / jfrog/jfrog-cli-security
False positives CVE-2025-58050
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
Hey,
CVE-2025-58050 only affects version 10.45 of PCRE2. Other versions should not report any vulnerability.
Current behavior
jf docker scan nginxinc/nginx-unprivileged:1.29.1-alpine-slim shows:
Reproduction steps
jf docker scan nginxinc/nginx-unprivileged:1.29.1-alpine-slim
Expected behavior
No CVE reported.
JFrog CLI-Security version
jf version 2.78.10
JFrog CLI version (if applicable)
jf version 2.78.10
Operating system type and version
Ubuntu 24.04
JFrog Xray version
3.118.23
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Docker scan path exercised by jf docker scan nginxinc/nginx-unprivileged:1.29.1-alpine-slim and trace how CVE-2025-58050 is matched against the image's PCRE2 version. Compare behavior for PCRE2 10.45 and other versions, then verify that unaffected versions produce no CVE report while 10.45 remains reportable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100