Need to understand why CVE-2017-20151 - com.itextpdf:itext-parent is shown as an ECR vulnerability although have latest version for it [5.5.13.4]

Hello,

We tried internally to reproduce the scan results by downloading the binary linked here [1]. However, we could not see the vulnerability mentioned.

Kindly could you produce the report that indicates vulnerability, please see our public documentation linked here [2] which takes us through how we can retrieve findings for basic scans in Amazon ECR, I have included command below for reference that would output the report to 'findings.txt'

aws ecr describe-image-scan-findings --repository-name name --image-id imageDigest=sha256_hash --region region > findings.txt

Once you have the report, I kindly request that you open a support case with our support team through the aws management console as linked here [3] where you can securely share the report and our support team will further investigate where the vulnerability is coming from.

Link(s):

[1] CVE Binary: https://github.com/itext/itextpdf/releases/tag/5.5.13.4

[2] Retrieving findings for basic scans in Amazon ECR : https://docs.aws.amazon.com/AmazonECR/latest/userguide/describe-scan-findings.html

[3] Creating support cases and case management: https://docs.aws.amazon.com/awssupport/latest/user/case-management.html

Good Day Juhi,

There couldn't a mistake in scanning, because vulnerability also depend upon the base image you might be using. I would suggest to use Docker Scout as well once from the "Docker Desktop" to filter out line by line, where the vulnerability might be there and visit respective Docker Hub Link of that image.

I had such issues with lot of other customers as well, thereby I use above method to filter the instances and isolate the issue completely.

For example for Python base image, they do reflect their vulnerability of each release tag, so you can also check for your base image/Dockerfile in Local Docker Scout Feature of Desktop Software to isolate, once done > ECR Scanning won't throw any vulnerability.