Too many Fixed Version is empty.

[wangfan0524]

Question

I scanned my image through trivy image and there are a large number of CVEs in the report that do not have corresponding Fixed Versions. Is this correct? Is there no Fixed Version because the official does not provide a corresponding fixed version? thank you.

Target

None

Scanner

None

Output Format

None

Mode

None

Operating System

No response

Version

Version: 0.57.1

[DmitriyLewen]

Hello @wangfan0524
Thanks for your interest to Trivy!

For rpm packages we use OS vendor advisories - https://trivy.dev/latest/docs/scanner/vulnerability/#data-source-selection

Is this correct?

This seems correct. If the vendor's advisory has fixedVersion, but Trivy doesn't show it, let me know - I'll investigate.

Is there no Fixed Version because the official does not provide a corresponding fixed version?

There are cases when fixedVersion for vulnerability doesn't exist. You can see status to understand reason (e.g. will not fixed or out of support).
e.g.:
https://access.redhat.com/security/cve/cve-2005-2541
https://access.redhat.com/security/cve/cve-2021-20193