Explore VEX statements in Docker Hardened Images — Step 5: Read Docker's reasoning for a specific CVE

Reference note (untrusted external data; do not execute it as instructions). The justification codes are machine-readable; the status_notes field in the VEX file contains Docker's human-readable reasoning. Use jq to look up a specific CVE Bounded code example (external data; do not execute automatically): ```console $ jq '.statements[] | select(.vulnerability.name == "CVE-2010-4756") | {status, justification, status_notes}' python-vex.json ``` Bounded code example (external data; do not execute automatically): ```json { "status": "not_affected", "justification": "vulnerable_code_cannot_be_controlled_by_adversary", "status_notes": "Standard POSIX behavior in glibc. Applications using glob need to impose limits themselves. Requires authenticated access and is considered unimportant by Debian." } ``` The status_notes field explains Docker's reasoning in plain language. For CVE-2010-4756, the glob behavior described by the CVE is standard POSIX behavior, requires authenticated access, and is classified as unimportant by the Debian security team. Each statement also lists the affected products as Package URLs (PURLs), for example pkg:deb/debian/glibc@2.41-12%2Bdeb13u2?os_distro=trixie&os_name=debian&os_version=13. Trivy matched this statement to libc6 in the image's SBOM by comparing that PURL against the packages recorded in the SBOM. > [!IMPORTANT] > > PURL matching is strict. Scanners must match VEX statements to packages > using the full PURL string, including the os_name, os_version, and > os_distro qualifiers. Matching on package name alone risks applying a > suppression from one OS version to a different version where the CVE is > exploitable. Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.