VEXKeycloak
Keycloak
1 declaración, emitidas el .Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.
@id https://quench-works.com/vex/keycloak/2026-11-09
CVE-2025-59250
no afectado · código vulnerable ausente- mssql-jdbc 13.2.1
Measured 2026-11-09 on a local build of keycloak 26.7.5. The image ships lib/lib/main/com.microsoft.sqlserver.mssql-jdbc-13.2.1.jre11.jar, whose sha1 (406aa00b60c1b30e1bb02e469530dd2e21f2eace) is identical to Maven Central's mssql-jdbc 13.2.1.jre11 artifact. GHSA-m494-w24q-6f7w names 13.2.1.jre11 as the fixed release of the 13.2 line (>= 13.2.0.jre11, < 13.2.1.jre11). Trivy reads the jar's Bundle-Version and pom.properties version, 13.2.1 without the .jre11 qualifier, and so does not match it against the qualified fixed versions; the code that ships is the fixed release. The jar is kept, not deleted, because kc.sh build (the custom-provider flow) needs every jar in the Quarkus application model; the --db=postgres build never loads the SQL Server driver at runtime.