This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 60%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMS%3C/text%3E%3C/svg%3E)
Hi,
Microsoft Defender for Cloud has a recommendation, "Container registry images should have vulnerability findings resolved." where all the vulnerabilities (CVEs) in container images get listed. Normally all these entries have a list (1:n) of references to CVE on https://cve.mitre.org/. Since a few days, the relation switched to (0:n), and many existing entries lost the reference to the CVEs. I know this because I have software which loads this so-called "SecuritySubAssessment" via the java SDK. Does somebody have an idea why this happened?
Edit:
After more analyses, it looks like it's somehow connected to the property "Vendor references" under "Additional information". In all cases where a CVE is set, there is also a "Vendor references" set.
On the other hand, if no CVE reference is set, only < 1% of the findings have a "Vendor references" set...
Thank you for your detailed post and follow-ups!
I've reached out to our Microsoft Defender for Cloud team to see if they can look into your issue and will update as soon as possible.
If you'd like to work with our support team through a one-time free technical support request, so they can take a closer look into your issue and environment, please let me know.
Since I haven't received a response from our Microsoft Defender for Cloud team, if you'd like to work with our support team through a one-time free technical support request, so they can take a closer look into your issue and environment, please let me know.
Thank you for your time and patience throughout this issue.
I'm already in contact with the support Team through a support request over our azure subscription partner.
Thanks.
I'm already in contact with the support Team through a support request over our azure subscription partner.
Thanks
Thank you for following up on this!
Would you be able to share your SR number, if you feel comfortable? I'll monitor your SR and update this thread as needed once a solution is found.
If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
I also noticed that your recent experience was not helpful, and to better improve our processes and learn from our customers, I'm eager to know what could have been done better.
What is the SR number? Do you mean the TrackingID?
If you mean this question, I tried to test the suggested answer but wasn't successful. Maybe there is a way to do it like suggested I just hadn't the time to try further. So, perfect would have been if you had an example how to do it, but I understand that you can't do everything.
@Michael Schnider Thank you for the quick follow up on this!
You're correct, the SR number is your Support Request number, or it could be your Tracking ID. This would be the number / ID associated with the support request you created. If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
JamesTran-MSFT Sure, the TrackingId is 2303301420001166.
@Michael Schnider Thank you for following up on this! Since you're working with our support team on this, I'll monitor your support request and update this thread as needed once a solution is found. If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 24%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMA%3C/text%3E%3C/svg%3E)
Hi
When you see the list of FINDINGS
There is category option which may have PREVIEW - for this kind , CVE reference is no there.
I think its in preview thats why. Other than all seem normal.
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Hi,
Thanks for the fast response.
For me, it seems that's not the cause.
As you can see here, I have findings with the category [Preview] SCA, which have a CVE reference:
On the other hand, I have findings in the category RedHat without Preview, which don't have a CVE reference:
Wierd , Its opposite for me.
I got both.
There are also findings with Category Preview without a reference:
And findings without Preview with a reference:
It seems strange.
After more analyses, it looks like it's somehow connected to the property "Vendor references" under "Additional information". In all cases where a CVE is set, there is also a "Vendor references" set.
On the other hand, if no CVE reference is set, only < 1% of the findings have a "Vendor references" set...