# Ignition Docker Image Critical Vulnerability Scan **URL:** \ **Category:** Ignition\ **Tags:** ignition81, perspective, docker\ **Created:** [June 2, 2023, 3:51pm UTC](https://forum.inductiveautomation.com/t/ignition-docker-image-critical-vulnerability-scan/74500 "2023-06-02T15:51:43Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Matthew\_Boyers](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/matthew_boyers/32/59236_2.png) [@Matthew\_Boyers](https://forum.inductiveautomation.com/u/Matthew_Boyers)\ **Post date:** [June 2, 2023, 3:51pm UTC](https://forum.inductiveautomation.com/t/ignition-docker-image-critical-vulnerability-scan/74500/1 "2023-06-02T15:51:43Z")
I have build a docker file using the Ignition Docker image 8.1.25. When I initiate the build and the deploy process with our organization, it gets scanned for vulnerabilities and if it has a critical vulnerability then it wont allow it to be deployed to our production environment. In this case, it shows that it has a critical vulnerability on usr/local/bin/ignition/lib/core/client@\* › xalan:xalan@2.7.2 and the fix to be: Upgrade to xalan:xalan@2.7.3 Is there a Ignition Docker image that has this fix? If not, how can I upgrade this? Thanks ---
**Author:** ![kcollins](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kcollins/32/19646_2.png) [@kcollins](https://forum.inductiveautomation.com/u/kcollins)\ **Post date:** [June 5, 2023, 1:27pm UTC](https://forum.inductiveautomation.com/t/ignition-docker-image-critical-vulnerability-scan/74500/2 "2023-06-05T13:27:05Z")
This is from [NVD - CVE-2022-34169](https://nvd.nist.gov/vuln/detail/CVE-2022-34169), and we've got an active ticket to mitigate this one. ---
**Author:** ![Matthew\_Boyers](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/matthew_boyers/32/59236_2.png) [@Matthew\_Boyers](https://forum.inductiveautomation.com/u/Matthew_Boyers)\ **Post date:** [June 8, 2023, 2:44pm UTC](https://forum.inductiveautomation.com/t/ignition-docker-image-critical-vulnerability-scan/74500/3 "2023-06-08T14:44:54Z")
Is there a time table on this? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 8, 2023, 3:03pm UTC](https://forum.inductiveautomation.com/t/ignition-docker-image-critical-vulnerability-scan/74500/4 "2023-06-08T15:03:08Z")
It's in a backlog right now, but I'll add this forum post to the ticket which will bump the customer count / priority a little. edit: oops, KC already did that. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 8, 2023, 3:10pm UTC](https://forum.inductiveautomation.com/t/ignition-docker-image-critical-vulnerability-scan/74500/5 "2023-06-08T15:10:16Z")
You can _probably_ build yourself a customer docker image based on the 8.1.28 (or 8.1.25 if you're gonna stay there) where you either replace the JAR file with the newer one or just remove it all together. We've scheduled it for removal, along with a batch of upgrades to other libraries affected by various CVEs. ---
**Author:** ![Matthew\_Boyers](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/matthew_boyers/32/59236_2.png) [@Matthew\_Boyers](https://forum.inductiveautomation.com/u/Matthew_Boyers)\ **Post date:** [June 8, 2023, 3:16pm UTC](https://forum.inductiveautomation.com/t/ignition-docker-image-critical-vulnerability-scan/74500/6 "2023-06-08T15:16:35Z")
I am going to test 8.1.28, but its not going to affect anything if I just remove the jar file? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 8, 2023, 3:17pm UTC](https://forum.inductiveautomation.com/t/ignition-docker-image-critical-vulnerability-scan/74500/7 "2023-06-08T15:17:14Z")
> [@Matthew\_Boyers](#): > > but its not going to affect anything if I just remove the jar file? Maybe, maybe not 🙂 The bulk of the work for the ticket to remove it is to find that out. We don't think so... but... ---
**Author:** ![Matthew\_Boyers](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/matthew_boyers/32/59236_2.png) [@Matthew\_Boyers](https://forum.inductiveautomation.com/u/Matthew_Boyers)\ **Post date:** [June 8, 2023, 3:18pm UTC](https://forum.inductiveautomation.com/t/ignition-docker-image-critical-vulnerability-scan/74500/8 "2023-06-08T15:18:36Z")
What is or was the purpose of that jar file? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 8, 2023, 3:19pm UTC](https://forum.inductiveautomation.com/t/ignition-docker-image-critical-vulnerability-scan/74500/9 "2023-06-08T15:19:21Z")
Provides an XML/XSLT implementation that should be baked into the JDK now. It's an artifact from long ago.