0 critical · 0 high · 0 medium · 0 low · 0 total (deduped by CVE) · 3 reviewed not-affected
Image datagrok/jkg_r:bleeding-edge · digest sha256:7c570864611fbfd26ba0208686828bab0eb37a65204faf6745f218985c354bdc
OpenVEX status affected (an upstream fix exists — the action is to
apply it) or under_investigation (no upstream fix is available yet; a version match
alone does not establish exploitability).
| Vulnerability | Status | Severity | Package | Installed | Fixed in | CVSS | Description |
|---|
No open vulnerabilities were reported for this image.
Manually reviewed findings with OpenVEX status not_affected. Each row
carries the spec justification label and the evidence for why the vulnerable code does not affect
this image's functionality (and where that was verified). Excluded from the severity counts above;
present as full statements in the OpenVEX document.
| Vulnerability | Severity | Package | Installed | Justification | Evidence / where |
|---|---|---|---|---|---|
| CVE-2018-10237 | MEDIUM | com.google.guava:guava | 19.0 | vulnerable_code_not_in_execute_path | guava 19.0 is vendored inside the r2pmml CRAN package's bundled Java converter jar (inst/java). The image ships no Java runtime, so the jar can never be loaded; r2pmml's Java conversion path is inert in this image. |
| CVE-2020-8908 | LOW | com.google.guava:guava | 19.0 | vulnerable_code_not_in_execute_path | guava 19.0 vendored in the r2pmml converter jar; no Java runtime in the image — same rationale as CVE-2018-10237. |
| CVE-2023-2976 | MEDIUM | com.google.guava:guava | 19.0 | vulnerable_code_not_in_execute_path | guava 19.0 vendored in the r2pmml converter jar; no Java runtime in the image — same rationale as CVE-2018-10237. |