0 critical · 0 high · 0 medium · 0 low · 0 total (deduped by CVE) · 3 reviewed not-affected
Image datagrok/jkg_r:bleeding-edge · digest sha256:0197035925fb2c57cd83457d73a154411411cce81a5428e7d32c88337cc1cafb
OpenVEX status affected (an upstream fix exists — the action is to
apply it) or under_investigation (no upstream fix is available yet; a version match
alone does not establish exploitability).
| Vulnerability | Status | Severity | Package | Installed | Fixed in | CVSS | Description |
|---|
No open vulnerabilities were reported for this image.
Manually reviewed findings with OpenVEX status not_affected. Each row
carries the spec justification label and the evidence for why the vulnerable code does not affect
this image's functionality (and where that was verified). Excluded from the severity counts above;
present as full statements in the OpenVEX document.
| Vulnerability | Severity | Package | Installed | Justification | Evidence / where |
|---|---|---|---|---|---|
| CVE-2018-10237 | MEDIUM | com.google.guava:guava | 19.0 | vulnerable_code_not_in_execute_path | guava 19.0 is vendored inside the r2pmml CRAN package's bundled Java converter jar (inst/java). The image ships no Java runtime, so the jar can never be loaded; r2pmml's Java conversion path is inert in this image. |
| CVE-2020-8908 | LOW | com.google.guava:guava | 19.0 | vulnerable_code_not_in_execute_path | guava 19.0 vendored in the r2pmml converter jar; no Java runtime in the image — same rationale as CVE-2018-10237. |
| CVE-2023-2976 | MEDIUM | com.google.guava:guava | 19.0 | vulnerable_code_not_in_execute_path | guava 19.0 vendored in the r2pmml converter jar; no Java runtime in the image — same rationale as CVE-2018-10237. |