IssueTracker

Problem you have encountered: The Maven package has been upgraded to the fixed version (has multiple versions for the fix), but a false positive is occurring as it's still being reported as vulnerable. This is due to Artifact Analysis not adhering exactly to the Maven version order specification.

What you expected to happen: After the vulnerability is fixed, it should no longer appear in image scans

Steps to reproduce: Given an example tomcat vulnerability - CVE-2024-52317 the fix is available in range of fixes 9.0.96, 10.1.31, and 11.0.0 while in Artifact Analysis the fix is marked available at the minimum of version 11.0.0 because 11.0.0-M23 is not parsed correctly.

Other information (workarounds you have tried, documentation consulted, etc): If you have already applied the recommended fixes for the latest vulnerabilities, the flagged images for that package should not be affected.

At this time, the fix is still in progress until this bug is marked as Fixed.