False positive for GHSA-gmc6-fwg3-75m5 on MimeKitLite?

[pjanotti]

Hi, both docker scout and grype are reporting GHSA-gmc6-fwg3-75m5 on mcr.microsoft.com/windows/servercore:ltsc2022 Docker image, the file being:

/Files/Program Files/Windows Defender Advanced Threat Protection/Classification/Dprt/MimeKitLite.dll

per my reading of:

• GHSA-447r-wph3-92pm
• aef4eda

This is a false positive. Could you please confirm if that is really the case?

[jstedfast]

Yes, it is a false reading. It only affects MimeKit (I published a release of MimeKitLite, though, just to keep versions identical)