Fix container scanning reported vulnerabilities

[alzimmermsft]

SYSDIG is reporting following CVE's for the docker container:

Vulnerability Severity CVSS Exploit CISA
KEV Package and version Fix version Type Vuln Age
CVE-2023-45853 Critical 9.8 v3.1 zlib1g-1:1.2.13.dfsg-1 os 2 years ago
CVE-2019-0980 High 7.5 v3.0 System.Private.Uri-4.3.0 v4.3.2 C# 6 years ago
CVE-2019-0981 High 7.5 v3.0 System.Private.Uri-4.3.0 v4.3.2 C# 6 years ago
CVE-2023-31484 High 8.1 v3.1 perl-base-5.36.0-7+deb12u2 os 2 years ago
CVE-2025-30399 High 7.5 v3.1 Microsoft.NETCore.App.Run�time.linux-x64-9.0.5 v9.0.6 C# 2 months ago
CVE-2025-40909 High 7 v3.0 perl-base-5.36.0-7+deb12u2 os 6 months ago
CVE-2025-45582 High 7.8 v3.0 tar-1.34+dfsg-1.2+deb12u1 os 5 months ago
CVE-2025-4802 High 7 v3.0 libc-bin-2.36-9+deb12u10 os 3 months ago
CVE-2025-4802 High 7 v3.0 libc6-2.36-9+deb12u10 os 3 months ago
CVE-2025-6020 High 7.8 v3.1 libpam-mod�ules-bin-1.5.2-6+deb12u1 os 2 months ago
CVE-2025-6020 High 7.8 v3.1 libpam-run�time-1.5.2-6+deb12u1 os 2 months ago
CVE-2025-6020 High 7.8 v3.1 libpam-mod�ules-1.5.2-6+deb12u1 os 2 months ago
CVE-2025-6020 High 7.8 v3.1 libpam0g-1.5.2-6+deb12u1 os 2 months ago
CVE-2019-0657 Medium 5.9 v3.0 System.Private.Uri-4.3.0 v4.3.2 C# 7 years ago
CVE-2023-50495 Medium 6.5 v3.1 libtinfo6-6.4-4 os 2 years ago
CVE-2023-50495 Medium 6.5 v3.1 ncurses-base-6.4-4 os 2 years ago
CVE-2023-50495 Medium 6.5 v3.1 ncurses-bin-6.4-4 os 2 years ago
CVE-2024-10041 Medium 4.7 v3.1 libpam-mod�ules-1.5.2-6+deb12u1 os
10 months
ago
CVE-2024-10041 Medium 4.7 v3.1 libpam-run�time-1.5.2-6+deb12u1 os
10 months
ago
CVE-2024-10041 Medium 4.7 v3.1 libpam0g-1.5.2-6+deb12u1 os
10 months
ago
CVE-2024-10041 Medium 4.7 v3.1 libpam-mod�ules-bin-1.5.2-6+deb12u1 os
10 months
ago
CVE-2024-22365 Medium 5.5 v3.1 libpam-mod�ules-1.5.2-6+deb12u1 os 2 years ago
CVE-2024-22365 Medium 5.5 v3.1 libpam-run�time-1.5.2-6+deb12u1 os 2 years ago
CVE-2024-22365 Medium 5.5 v3.1 libpam0g-1.5.2-6+deb12u1 os 2 years ago
CVE-2024-22365 Medium 5.5 v3.1 libpam-mod�ules-bin-1.5.2-6+deb12u1 os 2 years ago
CVE-2025-6297 Medium 6.5 v3.0 dpkg-1.21.22 os 1 month ago
CVE-2025-8058 Medium 6.6 v3.0 libc-bin-2.36-9+deb12u10 os 23 days ago
CVE-2025-8058 Medium 6.6 v3.0 libc6-2.36-9+deb12u10 os 23 days ago

[alzimmermsft]

Copied from Azure/azure-mcp#999

[joshfree]

@conniey please prioritize

/cc @xiangyan99

[conniey]

I scanned our latest image (mcr.microsoft.com/azure-sdk/azure-mcp:0.8.0) via trivy and docker scout. There are differences between the ones listed and of those, they do not have a fixed version.

Would you be able to provide a full report of your scan? (Updated for 0.8.0.)

Vulnerability	Library	Is in 0.8.0 scan?	Has Fix?	Status
CVE-2023-45853	zlib1g-1:1.2.13.dfsg-1	Yes	No	will_not_fix; false positive
CVE-2019-0980	System.Private.Uri-4.3.0	No
CVE-2019-0981	System.Private.Uri-4.3.0	No
CVE-2023-31484	perl-base-5.36.0-7+deb12u2	No
CVE-2025-30399	Microsoft.NETCore.App.Run�time.linux-x64-9.0.5	No
CVE-2025-40909	perl-base-5.36.0-7+deb12u2	No
CVE-2025-45582	tar-1.34+dfsg-1.2+deb12u1	Yes	No
CVE-2025-4802	libc-bin-2.36-9+deb12u10	No
CVE-2025-4802	libc6-2.36-9+deb12u10	No
CVE-2025-6020	libpam-mod�ules-bin-1.5.2-6+deb12u1	Yes	No
CVE-2025-6020	libpam-run�time-1.5.2-6+deb12u1	Yes	No
CVE-2025-6020	libpam-mod�ules-1.5.2-6+deb12u1	Yes	No
CVE-2025-6020	libpam0g-1.5.2-6+deb12u1	Yes	No
CVE-2024-10041	libpam-mod�ules-1.5.2-6+deb12u1	Yes	No	will_not_fix
CVE-2024-10041	libpam-run�time-1.5.2-6+deb12u1	Yes	No	will_not_fix
CVE-2024-10041	libpam0g-1.5.2-6+deb12u1	Yes	No	will_not_fix
CVE-2024-10041	libpam-mod�ules-bin-1.5.2-6+deb12u1	Yes	No	will_not_fix
CVE-2024-22365	libpam-mod�ules-1.5.2-6+deb12u1	Yes	No
CVE-2024-22365	libpam-run�time-1.5.2-6+deb12u1	Yes	No
CVE-2024-22365	libpam0g-1.5.2-6+deb12u1	Yes	No
CVE-2024-22365	libpam-mod�ules-bin-1.5.2-6+deb12u1	Yes	No
CVE-2025-6297	dpkg-1.21.22	Yes	No
CVE-2025-8058	libc-bin-2.36-9+deb12u10	No
CVE-2025-8058	libc6-2.36-9+deb12u10	No
CVE-2019-0657	System.Private.Uri-4.3.0	No
CVE-2023-50495	libtinfo6-6.4-4	Yes	No
CVE-2023-50495	ncurses-base-6.4-4	Yes	No
CVE-2023-50495	ncurses-bin-6.4-4	Yes	No

[jason-johnson]

@alzimmermsft do you have a more detailed report? @conniey Do you have more formal justification for the CVE-2023-45853 "false positive" status? I need a way to prove it so it can be accepted as a false positive.