False Positives for Docker binary on macOS

[rebeccaui]

Fleet version: 4.60.0

Web browser and operating system: macOS 15.2

---

💥  Actual behavior

The Homebrew package shows a bunch of vulnerabilities, but the native app bundle does not. It is listed as vulnerable to CVE-2018-10892, CVE-2019-13139, CVE-2019-13509, +5 more.

🧑‍💻  Steps to reproduce

1. TODO
2. TODO

🕯️ More info (optional)

N/A

[JoStableford]

Linked to Unthread ticket:

False positives in docker binary on macOS #4184

[iansltx]

Resolution here would be to upgrade to 4.62+, as #22944 removes the duplicate Homebrew package when we track the same title via apps, and that would take care of this. If the customer can still repro this after an upgrade to at least 4.62, we can dig further.

[lukeheath]

@rebeccaui It sounds like getting the customer up to 4.62.0 should resolve this. Please let us know if it doesn't.

@mostlikelee FYI, I'm moving this off the software board and on to the customer success board so they can track.

[rebeccaui]

@lukeheath @iansltx They upgraded to 4.62.2, and the issue does not appear to have changed.

[iansltx]

@rebeccaui Given that they're using the default vulnerabilities interval of one hour, it will take two hours for false positives to fall off of the list. Has it been that long?

[rebeccaui]

@iansltx You are correct, and I've been given confirmation that this issue is resolved!

[fleet-release]

Docker bug in sight,
False positives cloud the view,
Fleet brings the light.