I understand the position that these old containers are not and cannot be supported, but I disagree with the argument that this is a vulnerability in unmaintained software and therefore should not be fixed. It’s malware. One should not knowingly host malware even if the activation of that malware isn’t likely.