Prisma vulnerable dependency not shown in maven dependency:tree

Question

Prisma scan of a spring boot application shows a vulnerability in jackson-dataformat-cbor version 2.11.0. But this version of cbor doesn't exist in the application.

I verified this by doing mvn dependency:tree and mvn dependency:list. But only 2.13.0-rc1 version of jackson-dataformat-cbor exists, not the 2.11.0.

Do anyone have any idea about this?

user_5733722 · Answer

The issue was that the vulnerability was in the base image itself. Not in the spring boot app. Thanks.

Prisma vulnerable dependency not shown in maven dependency:tree

1 Answers