{
  "schema_version": 1,
  "repository": "https://github.com/jenkinsci/jenkins",
  "commit_source": "release_tag_resolution_and_digest_pinned_official_image_metadata",
  "commit_sha": "9095ea3a5c5e7dcd392695a5dd880af1c9910ddf",
  "submitted_target": {
    "target_kind": "commit",
    "commit_sha": "9095ea3a5c5e7dcd392695a5dd880af1c9910ddf",
    "version": "2.579",
    "ref": "jenkins-2.579",
    "display": "Jenkins 2.579 / jenkins/jenkins@sha256:a7342867ea33efaacf825229d50b7fc77c144ecada9719ab4e32419f5d7412be"
  },
  "variant_target": {
    "target_kind": "commit",
    "commit_sha": "497de4961ad80d97e26bfdeb0d2e40442a84ecb0",
    "version": "2.580",
    "ref": "jenkins-2.580",
    "display": "Jenkins 2.580 / jenkins/jenkins@sha256:0e50a5b11ac14f3b84e529d725ed3a1c4b17ba16188dfa8d9a0189428b0839b1"
  },
  "notes": "The distinct FingerprintAction carrier was confirmed on the submitted 2.579 target. The exact 2.580 newer-version sibling was also tested and blocked the candidate, so this is an alternate vulnerable-version trigger rather than a fix bypass. Runtime image IDs and digests are in bundle/logs/vuln_variant/fixed_version.txt."
}