Does AWS inspector find vulnerabilities in removed but still in dpkg list for ubuntu?

Question

I have an instance with UBUNTU 20.04 and AWS inspector2 installed. Inspector reported a vulnerability in `rsyslog` package and I checked the VM and found the package in the `dpkg` list but the vulnerable package was installed but it is no longer, and only config files remain. As a result also the solution didn't work as `apt` does not upgrade a removed package.

Is this expected or a failure in AWS inspector?

```root@server:/root# dpkg -l | head -n5; dpkg -l | grep rsyslog
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                               Version                           Architecture Description
+++-==================================-=================================-============-===============================================================================
rc  rsyslog                            8.2001.0-1ubuntu1.1               amd64        reliable system and kernel logging daemon
```

Answer

`rc` in the first column is key here, it says that the package has been removed but the configuration files remain on the system. Rather than attempt to upgrade it, it can be completely removed from the system with `apt-get remove --purge`, and then reinstalled from fresh.

Does AWS inspector find vulnerabilities in removed but still in dpkg list for ubuntu?

Relevant content