home / Atlassian / atlassian/default-image Rebuilt 9.0y ago 22 critical CVEs 1 arch
$ docker pull atlassian/default-image copy Image metadata PULL COUNT
—
repository-level (not per-tag)
RUNS AS
root
image config.User
LAST PUSHED
9.0y ago
2017-10-30 00:03:49
MANIFEST DIGEST
sha256:689e2c63e20a…
from registry manifest
Latest scan 2026-11-04 05:08:25 UTC · 10d ago OPEN CVES BY SEVERITY
Grype DB 2026-11-03T06:20:47.000Z
· rubric cerodeo-v2
RUBRIC BREAKDOWN (6 signals that moved the score) -550 · Critical CVEs (fixable) -1930 · High CVEs (fixable) -1587 · Medium CVEs (fixable) -114 · High CVEs (no fix) -2953 · medium_unfixable +10 · Rebuilt in last 90 days
Raw data
Every signal above decomposes to arithmetic from inputs you can verify. Nothing in these downloads is derived or
massaged — they're the raw grype matches and the raw snapshot history exactly as our scanner wrote them.
Reproduce this score yourself
We don't use judgement to score — every signal is deterministic from the image, the manifest, and a pinned CVE DB.
Run the script below on any host with skopeo, syft,
grype, cosign, and jq installed — it fetches the versioned rubric spec, computes the same breakdown, and prints the same grade. Pin the Grype DB with --grype-db to reproduce bit-for-bit identical results.
curl -fsSLO https://ce.rodeo/verify-score.sh && chmod +x verify-score.sh
./verify-score.sh atlassian/default-image \
--rubric cerodeo-v2 \
--grype-db 2026-11-03T06:20:47.000Z
All open CVEs (500) sorted by severity, then CVSS score CVE ID SEV CVSS PACKAGE FIX
CVE-2015-4852 HIGH — libcommons-collections3-java 3.2.1-6 no fix available CVE-2015-4852 HIGH — openjdk-7-jre-headless 7u151-2.6.11-0ubuntu1.14.04.1 no fix available CVE-2015-4852 HIGH — openjdk-7-jre 7u151-2.6.11-0ubuntu1.14.04.1 no fix available CVE-2016-8735 HIGH — libservlet2.5-java 6.0.39-1 no fix available CVE-2017-12617 HIGH — libservlet3.0-java 7.0.52-1ubuntu0.11 fixed in 7.0.52-1ubuntu0.14 CVE-2018-1000001 HIGH — multiarch-support 2.19-0ubuntu6.11 fixed in 2.19-0ubuntu6.14 CVE-2018-11235 HIGH — git-man 1:1.9.1-1ubuntu0.7 fixed in 1:1.9.1-1ubuntu0.8 CVE-2018-11235 HIGH — git 1:1.9.1-1ubuntu0.7 fixed in 1:1.9.1-1ubuntu0.8 CVE-2019-3462 HIGH — libapt-pkg4.12 1.0.1ubuntu2.17 fixed in 1.0.1ubuntu2.19 CVE-2019-3462 HIGH — apt 1.0.1ubuntu2.17 fixed in 1.0.1ubuntu2.19 CVE-2019-3462 HIGH — apt-utils 1.0.1ubuntu2.17 fixed in 1.0.1ubuntu2.19 CVE-2019-3462 HIGH — libapt-inst1.5 1.0.1ubuntu2.17 fixed in 1.0.1ubuntu2.19 CVE-2020-1971 HIGH — libssl1.0.0 1.0.1f-1ubuntu2.22 no fix available CVE-2021-43527 HIGH — libnss3 2:3.28.4-0ubuntu0.14.04.3 no fix available CVE-2021-43527 HIGH — libnss3-nssdb 2:3.28.4-0ubuntu0.14.04.3 no fix available CVE-2022-0778 HIGH — libssl1.0.0 1.0.1f-1ubuntu2.22 no fix available CVE-2023-0286 HIGH — libssl1.0.0 1.0.1f-1ubuntu2.22 no fix available CVE-2007-4559 MEDIUM — libpython3.4-stdlib 3.4.3-1ubuntu1~14.04.5 no fix available CVE-2007-4559 MEDIUM — python2.7 2.7.6-8ubuntu0.3 no fix available CVE-2007-4559 MEDIUM — python2.7-minimal 2.7.6-8ubuntu0.3 no fix available CVE-2007-4559 MEDIUM — python3.4 3.4.3-1ubuntu1~14.04.5 no fix available CVE-2007-4559 MEDIUM — libpython2.7-minimal 2.7.6-8ubuntu0.3 no fix available CVE-2007-4559 MEDIUM — python3.4-minimal 3.4.3-1ubuntu1~14.04.5 no fix available CVE-2007-4559 MEDIUM — libpython2.7-stdlib 2.7.6-8ubuntu0.3 no fix available CVE-2007-4559 MEDIUM — libpython3.4-minimal 3.4.3-1ubuntu1~14.04.5 no fix available CVE-2013-6629 MEDIUM — openjdk-7-jre 7u151-2.6.11-0ubuntu1.14.04.1 no fix available CVE-2013-6629 MEDIUM — openjdk-7-jre-headless 7u151-2.6.11-0ubuntu1.14.04.1 no fix available CVE-2014-0075 MEDIUM — libservlet2.5-java 6.0.39-1 fixed in 6.0.39-1ubuntu0.1 CVE-2014-0096 MEDIUM — libservlet2.5-java 6.0.39-1 fixed in 6.0.39-1ubuntu0.1 CVE-2014-0099 MEDIUM — libservlet2.5-java 6.0.39-1 fixed in 6.0.39-1ubuntu0.1 CVE-2014-0114 MEDIUM — libcommons-beanutils-java 1.9.1-1 no fix available CVE-2014-3577 MEDIUM — libhttpclient-java 4.3.3-1 fixed in 4.3.3-1ubuntu0.1 CVE-2014-7810 MEDIUM — libservlet2.5-java 6.0.39-1 fixed in 6.0.39-1ubuntu0.1 CVE-2015-2305 MEDIUM — libllvm3.4 1:3.4-1ubuntu3 no fix available CVE-2015-3153 MEDIUM — libcurl3 7.35.0-1ubuntu2.12 no fix available CVE-2015-3153 MEDIUM — libcurl3-gnutls 7.35.0-1ubuntu2.12 no fix available CVE-2015-5262 MEDIUM — libhttpclient-java 4.3.3-1 no fix available CVE-2015-5351 MEDIUM — libservlet2.5-java 6.0.39-1 fixed in 6.0.39-1ubuntu0.1 CVE-2016-0714 MEDIUM — libservlet2.5-java 6.0.39-1 fixed in 6.0.39-1ubuntu0.1 CVE-2016-0763 MEDIUM — libservlet2.5-java 6.0.39-1 fixed in 6.0.39-1ubuntu0.1 CVE-2016-1240 MEDIUM — libservlet2.5-java 6.0.39-1 fixed in 6.0.39-1ubuntu0.1 CVE-2016-3092 MEDIUM — libservlet2.5-java 6.0.39-1 no fix available CVE-2016-3119 MEDIUM — krb5-locales 1.12+dfsg-2ubuntu5.3 fixed in 1.12+dfsg-2ubuntu5.4 CVE-2016-3119 MEDIUM — libgssapi-krb5-2 1.12+dfsg-2ubuntu5.3 fixed in 1.12+dfsg-2ubuntu5.4 CVE-2016-3119 MEDIUM — libk5crypto3 1.12+dfsg-2ubuntu5.3 fixed in 1.12+dfsg-2ubuntu5.4 CVE-2016-3119 MEDIUM — libkrb5-3 1.12+dfsg-2ubuntu5.3 fixed in 1.12+dfsg-2ubuntu5.4 CVE-2016-3119 MEDIUM — libkrb5support0 1.12+dfsg-2ubuntu5.3 fixed in 1.12+dfsg-2ubuntu5.4 CVE-2016-5018 MEDIUM — libservlet2.5-java 6.0.39-1 no fix available CVE-2016-6816 MEDIUM — libservlet2.5-java 6.0.39-1 no fix available CVE-2016-8745 MEDIUM — libservlet2.5-java 6.0.39-1 no fix available CVE-2017-1000158 MEDIUM — libpython3.4-stdlib 3.4.3-1ubuntu1~14.04.5 fixed in 3.4.3-1ubuntu1~14.04.6 CVE-2017-1000158 MEDIUM — libpython3.4-minimal 3.4.3-1ubuntu1~14.04.5 fixed in 3.4.3-1ubuntu1~14.04.6 CVE-2017-1000158 MEDIUM — libpython2.7-stdlib 2.7.6-8ubuntu0.3 fixed in 2.7.6-8ubuntu0.4 CVE-2017-1000158 MEDIUM — libpython2.7-minimal 2.7.6-8ubuntu0.3 fixed in 2.7.6-8ubuntu0.4 CVE-2017-1000158 MEDIUM — python2.7-minimal 2.7.6-8ubuntu0.3 fixed in 2.7.6-8ubuntu0.4 CVE-2017-1000158 MEDIUM — python3.4 3.4.3-1ubuntu1~14.04.5 fixed in 3.4.3-1ubuntu1~14.04.6 CVE-2017-1000158 MEDIUM — python3.4-minimal 3.4.3-1ubuntu1~14.04.5 fixed in 3.4.3-1ubuntu1~14.04.6 CVE-2017-10355 MEDIUM — openjdk-7-jre 7u151-2.6.11-0ubuntu1.14.04.1 fixed in 7u151-2.6.11-2ubuntu0.14.04.1 CVE-2017-10355 MEDIUM — openjdk-7-jre-headless 7u151-2.6.11-0ubuntu1.14.04.1 fixed in 7u151-2.6.11-2ubuntu0.14.04.1 CVE-2017-12616 MEDIUM — libservlet3.0-java 7.0.52-1ubuntu0.11 fixed in 7.0.52-1ubuntu0.14 CVE-2017-5647 MEDIUM — libservlet2.5-java 6.0.39-1 no fix available CVE-2017-5647 MEDIUM — libservlet3.0-java 7.0.52-1ubuntu0.11 fixed in 7.0.52-1ubuntu0.13 CVE-2017-5648 MEDIUM — libservlet3.0-java 7.0.52-1ubuntu0.11 fixed in 7.0.52-1ubuntu0.13 CVE-2017-5664 MEDIUM — libservlet3.0-java 7.0.52-1ubuntu0.11 fixed in 7.0.52-1ubuntu0.13 CVE-2017-5664 MEDIUM — libservlet2.5-java 6.0.39-1 no fix available CVE-2017-6056 MEDIUM — libservlet2.5-java 6.0.39-1 no fix available CVE-2017-7674 MEDIUM — libservlet3.0-java 7.0.52-1ubuntu0.11 fixed in 7.0.52-1ubuntu0.13 CVE-2017-8817 MEDIUM — libcurl3 7.35.0-1ubuntu2.12 fixed in 7.35.0-1ubuntu2.13 CVE-2017-8817 MEDIUM — curl 7.35.0-1ubuntu2.12 fixed in 7.35.0-1ubuntu2.13 CVE-2017-8817 MEDIUM — libcurl3-gnutls 7.35.0-1ubuntu2.12 fixed in 7.35.0-1ubuntu2.13 CVE-2017-9233 MEDIUM — libexpat1 2.1.0-4ubuntu1.3 fixed in 2.1.0-4ubuntu1.4 CVE-2017-9462 MEDIUM — mercurial-common 2.8.2-1ubuntu1.3 fixed in 2.8.2-1ubuntu1.4 CVE-2017-9462 MEDIUM — mercurial 2.8.2-1ubuntu1.3 fixed in 2.8.2-1ubuntu1.4 CVE-2017-9936 MEDIUM — libtiff5 4.0.3-7ubuntu0.7 fixed in 4.0.3-7ubuntu0.8 CVE-2018-0494 MEDIUM — wget 1.15-1ubuntu1.14.04.3 fixed in 1.15-1ubuntu1.14.04.4 CVE-2018-0739 MEDIUM — openssl 1.0.1f-1ubuntu2.22 fixed in 1.0.1f-1ubuntu2.24 CVE-2018-0739 MEDIUM — libssl1.0.0 1.0.1f-1ubuntu2.22 fixed in 1.0.1f-1ubuntu2.24 CVE-2018-1000007 MEDIUM — libcurl3-gnutls 7.35.0-1ubuntu2.12 fixed in 7.35.0-1ubuntu2.14 CVE-2018-1000007 MEDIUM — libcurl3 7.35.0-1ubuntu2.12 fixed in 7.35.0-1ubuntu2.14 CVE-2018-1000120 MEDIUM — libcurl3 7.35.0-1ubuntu2.12 fixed in 7.35.0-1ubuntu2.15 CVE-2018-1000120 MEDIUM — libcurl3-gnutls 7.35.0-1ubuntu2.12 fixed in 7.35.0-1ubuntu2.15 CVE-2018-1000121 MEDIUM — libcurl3 7.35.0-1ubuntu2.12 fixed in 7.35.0-1ubuntu2.15 CVE-2018-1000121 MEDIUM — libcurl3-gnutls 7.35.0-1ubuntu2.12 fixed in 7.35.0-1ubuntu2.15 CVE-2018-1000122 MEDIUM — libcurl3-gnutls 7.35.0-1ubuntu2.12 fixed in 7.35.0-1ubuntu2.15 CVE-2018-1000122 MEDIUM — libcurl3 7.35.0-1ubuntu2.12 fixed in 7.35.0-1ubuntu2.15 CVE-2018-1000517 MEDIUM — busybox-initramfs 1:1.21.0-1ubuntu1 fixed in 1:1.21.0-1ubuntu1.4 CVE-2018-1000802 MEDIUM — libpython3.4-stdlib 3.4.3-1ubuntu1~14.04.5 fixed in 3.4.3-1ubuntu1~14.04.7 CVE-2018-1000802 MEDIUM — libpython2.7-minimal 2.7.6-8ubuntu0.3 fixed in 2.7.6-8ubuntu0.5 CVE-2018-1000802 MEDIUM — python3.4-minimal 3.4.3-1ubuntu1~14.04.5 fixed in 3.4.3-1ubuntu1~14.04.7 CVE-2018-1000802 MEDIUM — python3.4 3.4.3-1ubuntu1~14.04.5 fixed in 3.4.3-1ubuntu1~14.04.7 CVE-2018-1000802 MEDIUM — python2.7-minimal 2.7.6-8ubuntu0.3 fixed in 2.7.6-8ubuntu0.5 CVE-2018-1000802 MEDIUM — libpython3.4-minimal 3.4.3-1ubuntu1~14.04.5 fixed in 3.4.3-1ubuntu1~14.04.7 CVE-2018-1000802 MEDIUM — libpython2.7-stdlib 2.7.6-8ubuntu0.3 fixed in 2.7.6-8ubuntu0.5 CVE-2018-1002200 MEDIUM — libplexus-archiver-java 1.2-1 fixed in 1.2-1+deb8u1build14.04.1 CVE-2018-1049 MEDIUM — udev 204-5ubuntu20.24 fixed in 204-5ubuntu20.26 CVE-2018-1049 MEDIUM — libudev1 204-5ubuntu20.24 fixed in 204-5ubuntu20.26 CVE-2018-1123 MEDIUM — procps 1:3.3.9-1ubuntu2.2 fixed in 1:3.3.9-1ubuntu2.3 CVE-2018-1123 MEDIUM — libprocps3 1:3.3.9-1ubuntu2.2 fixed in 1:3.3.9-1ubuntu2.3 CVE-2018-11236 MEDIUM — libc-dev-bin 2.19-0ubuntu6.13 no fix available CVE-2018-11236 MEDIUM — multiarch-support 2.19-0ubuntu6.11 no fix available CVE-2018-11784 MEDIUM — libservlet3.0-java 7.0.52-1ubuntu0.11 fixed in 7.0.52-1ubuntu0.16 CVE-2018-12015 MEDIUM — perl 5.18.2-2ubuntu1.1 fixed in 5.18.2-2ubuntu1.6 CVE-2018-12015 MEDIUM — perl-base 5.18.2-2ubuntu1.1 fixed in 5.18.2-2ubuntu1.6 CVE-2018-12015 MEDIUM — perl-modules 5.18.2-2ubuntu1.1 fixed in 5.18.2-2ubuntu1.6
Scan history 1 total · first 10d ago SCANNED AT GRADE SCORE CRIT HIGH MED GRYPE DB
10d ago F 0 22 231 3482 2026-11-03T06:20:47.000Z
Methodology:
This image is re-matched against the fresh Grype vulnerability DB every hour. Snapshot rows marked
(same SBOM) reuse the prior scan's content via a pointer — about
90% of hourly cycles do. New CVE disclosures land in a new content row and bump the grade on the next match.
Full rubric at /about/grades ; for publishers wanting to
raise their grade, see /about/for-publishers .
Discussion
No comments yet. Be the first.