Docker Scout Vulnerability Severity Assessment and Image Size Limits

dpkg 1.19.7 deb 1C 0H 0M 0L glibc 2.28-10 deb 4C 0H 0M 0L gnutls28 3.6.7-4+deb10u6 deb 2C 0H 0M 0L libbsd 0.9.1-2 deb 1C 0H 0M 0L libksba 1.3.5-2 deb 2C 0H 0M 0L libtasn1-6 4.13-3 deb 1C 0H 0M 0L lz4 1.8.3-1 deb 1C 0H 0M 0L openldap 2.4.47+dfsg-3+deb10u5 deb 1C 0H 0M 0L openssl 1.1.1d-0+deb10u4 deb 3C 0H 0M 0L zlib 1:1.2.11.dfsg-1 deb 1C 0H 0M 0L ``` For more information about these commands and how to use them, refer to the CLI reference documentation: - [`docker scout quickview`](/reference/cli/docker/scout/quickview.md) - [`docker scout cves`](/reference/cli/docker/scout/cves.md) ## Vulnerability severity assessment Docker Scout assigns a severity rating to vulnerabilities based on vulnerability data from [advisory sources](/manuals/scout/deep-dive/advisory-db-sources.md). Advisories are ranked and prioritized depending on the type of package that's affected by a vulnerability. For example, if a vulnerability affects an OS package, the severity level assigned by the distribution maintainer is prioritized. If the preferred advisory source has assigned a severity rating to a CVE, but not a CVSS score, Docker Scout falls back to displaying a CVSS score from another source. The severity rating from the preferred advisory and the CVSS score from the fallback advisory are displayed together. This means a vulnerability can have a severity rating of `LOW` with a CVSS score of 9.8, if the preferred advisory assigns a `LOW` rating but no CVSS score, and a fallback advisory assigns a CVSS score of 9.8. Vulnerabilities that haven't been assigned a CVSS score in any source are categorized as **Unspecified** (U). Docker Scout doesn't implement a proprietary vulnerability metrics system. All metrics are inherited from security advisories that Docker Scout integrates with. Advisories may use different thresholds for classifying vulnerabilities, but most of them adhere to the CVSS v3.0 specification, which maps CVSS scores to severity ratings according to the following table: | CVSS score | Severity rating | | ---------- | ---------------- | | 0.1 – 3.9 | **Low** (L) | | 4.0 – 6.9 | **Medium** (M) | | 7.0 – 8.9 | **High** (H) | | 9.0 – 10.0 | **Critical** (C) | For more information, see [Vulnerability Metrics (NIST)](https://nvd.nist.gov/vuln-metrics/cvss). Note that, given the advisory prioritization and fallback mechanism described earlier, severity ratings displayed in Docker Scout may deviate from this rating system. ## Maximum image size Image analysis on the Docker Scout platform, and analysis triggered by background indexing in Docker Desktop, has an image file size limit of 10 GB (uncompressed). To analyze images larger than that, you can either: - Attach [SBOM attestations](/manuals/build/metadata/attestations/sbom.md) at build-time - Use the [CLI](#cli) to analyze the image locally Images analyzed locally with the CLI and images with SBOM attestations have no maximum file size.

Docker Scout assigns severity ratings to vulnerabilities based on advisory sources, prioritizing OS package vulnerabilities. If a preferred source lacks a CVSS score, it falls back to other sources. Vulnerabilities without CVSS scores are marked as 'Unspecified'. Docker Scout adheres to CVSS v3.0 for severity ratings, but may deviate due to advisory prioritization. There's a 10GB uncompressed image size limit for platform analysis, which can be bypassed by using SBOM attestations or local CLI analysis.