title: How to fix vulnerabilities found in DevOps container scans when they appear to come from dotnet-core runtime config files and not my actual project?
body: <p>So when running a Trivy container scan on my dockerised dotnet 6 app during my devops pipeline, many times I discover critical vulnerabilities which break the build and I am not sure how to fix as they do not relate to files or dependencies in my project, but from DevOps or dotnet runtime configs itself.</p>
  <p>Here are 3 critical vulnerabilities which are inside the runtime configuration files I think, but we do not use <code>starkbank-ecdsa</code> anywhere, and the senior dev also has no idea why it is there either.</p>
  <p><a href="https://i.stack.imgur.com/DyCXt.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DyCXt.png" alt="screenshot of trivy container scan from devops" /></a></p>
  <p>I can easily disable the scanning as I do when a deployment needs to happen, but this is not the ideal solution as I would rather have any issues fixed.</p>
  <p>I have searched online but cant seem to find a straight forward answer to how I can fix these issues. Any help or some clarity on this would be greatly appreciated.</p>