Prisma Cloud Runtime Security: High number of false positives when scanning images from registry.access.redhat.com/ubi9/ubi:9.5

When scanning the ubi:9.5 image, you may observe:

• Over 200 false positive vulnerabilities detected.
• These false positives were not present when scanning the older ubi:9.4 image.
• Examples of frequently reported false positives include:

  • CVE-2015-0204

  • CVE-2015-7497

  • CVE-2016-5420

  • CVE-2024-5535

• Prisma Cloud Enterprise Edition with Runtime Security Enabled

The high number of false positives is due to a known issue in the redhat-vex builder.

This builder incorrectly processes CPE (Common Platform Enumeration) strings, leading to the erroneous association of vulnerabilities across all Red Hat distribution releases.

Consequently, the ubi:9.5 image triggers these incorrect alerts.

This issue will be resolved with the Quinn release of Prisma Cloud.

The Quinn release includes fixes that address the mishandling of CPE strings in the redhat-vex builder, which will significantly reduce the number of false positives.