# Questions about Vault 1.9.0 Docker Image Vulnerabilities

**URL:** <https://discuss.hashicorp.com/t/questions-about-vault-1-9-0-docker-image-vulnerabilities/35085>\
**Category:** Vault\
**Created:** [February 1, 2022, 7:09pm UTC](https://discuss.hashicorp.com/t/questions-about-vault-1-9-0-docker-image-vulnerabilities/35085 "2022-02-01T19:09:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dhongyt](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/dhongyt/32/25615_2.png) [@dhongyt](https://discuss.hashicorp.com/u/dhongyt)\
**Post date:** [February 1, 2022, 7:09pm UTC](https://discuss.hashicorp.com/t/questions-about-vault-1-9-0-docker-image-vulnerabilities/35085/1 "2022-02-01T19:09:49Z")

</div>

Hello,

I have been running Anchore security scans against Vault 1.9.0 and 1.9.2 Docker images and have identified a couple of vulnerabilities.

[github.com/hashicorp/nomad/api](http://github.com/hashicorp/nomad/api)  
CVE-2020-7956  
CVE-2020-7218  
CVE-2021-3283  
CVE-2021-37218

> **[GitHub - influxdata/influxdb: Scalable datastore for metrics, events, and...](https://github.com/influxdata/influxdb)**
>
> Scalable datastore for metrics, events, and real-time analytics - GitHub - influxdata/influxdb: Scalable datastore for metrics, events, and real-time analytics

CVE-2019-20933

[google.golang.org/protobuf](http://google.golang.org/protobuf)  
CVE-2015-5237

Based off the report, could any of these findings be mitigated, resolved, or plans to be fix in the next version of Vault?

Thank you for your time.

---

<div class="post-metadata">

**Author:** ![mickael](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mickael/32/20186_2.png) [@mickael](https://discuss.hashicorp.com/u/mickael)\
**Post date:** [March 7, 2022, 7:13pm UTC](https://discuss.hashicorp.com/t/questions-about-vault-1-9-0-docker-image-vulnerabilities/35085/2 "2022-03-07T19:13:28Z")

</div>

Hello, @dhongyt , thanks for your message.

Per our [security policy](https://www.hashicorp.com/security), [security@hashicorp.com](mailto:security@hashicorp.com) is the preferred communication method for future vulnerability reports.

We take a risk-based approach to adopting dependency updates including security fixes as part of our ongoing product development lifecycle. You’ll generally see these addressed in future releases.

- [github.com/hashicorp/nomad/api](http://github.com/hashicorp/nomad/api): The vulnerabilities listed affect the Nomad service, and not the client API. The use of the Nomad API client in Vault does not introduce further risk to Vault.
- [github.com/influxdata/influxdb](http://github.com/influxdata/influxdb) (CVE-2019-20933): The vulnerability affects the server component, whereas Vault uses the [influxDB client](https://github.com/hashicorp/vault/blob/a9b5776f5737bad6ba8345e6ce8b322eb26919b2/plugins/database/influxdb/influxdb.go#L13) when enabled by an operator. The library has been updated in [Update influxdb client by tsaarni · Pull Request #12262 · hashicorp/vault · GitHub](https://github.com/hashicorp/vault/pull/12262) and will be released in Vault 1.10 (to be released in the coming days).
- [google.golang.org/protobuf](http://google.golang.org/protobuf) This is a transitive dependency introduced via etcd, and [used for tests only](https://github.com/hashicorp/vault/blob/a9b5776f5737bad6ba8345e6ce8b322eb26919b2/helper/testhelpers/etcd/etcdhelper.go#L12).