Reliable information sources are key for Docker Scout's ability to surface relevant and accurate assessments of your software artifacts. Given the diversity of sources and methodologies in the industry, discrepancies in vulnerability assessment results can and do happen. This page describes how the Docker Scout advisory database and its CVE-to-package matching approach works to deal with these discrepancies.

Advisory database sources#

Docker Scout aggregates vulnerability data from multiple sources. The data is continuously updated to ensure that your security posture is represented using the latest available information, in real-time.

Docker Scout uses the following package repositories and security trackers:

When you enable Docker Scout for your Docker organization, a new database instance is provisioned on the Docker Scout platform. The database stores the Software Bill of Materials (SBOM) and other metadata about your images. When a security advisory has new information about a vulnerability, your SBOM is cross-referenced with the CVE information to detect how it affects you.

For more details on how image analysis works, see the image analysis page.

Vulnerability matching#

Traditional tools often rely on broad Common Product Enumeration (CPE) matching, which can lead to many false-positive results.

Docker Scout uses Package URLs (PURLs) to match packages against CVEs, which yields more precise identification of vulnerabilities. PURLs significantly reduce the chances of false positives, focusing only on genuinely affected packages.

Supported package ecosystems#

Docker Scout supports the following package ecosystems:

  • .NET
  • GitHub packages
  • Go
  • Java
  • JavaScript
  • PHP
  • Python
  • RPM
  • Ruby
  • alpm (Arch Linux)
  • apk (Alpine Linux)
  • deb (Debian Linux and derivatives)