4 ms·
Quay.io's scanning feature does one really cool thing: it tells you the version of the package that actually fixes the CVE, eg: CVE-2017-15232 libjpeg-turbo C
by robszumski 8y ago
Quay.io's scanning feature does one really cool thing: it tells you the version of the package that actually fixes the CVE, eg:
CVE-2017-15232 libjpeg-turbo
Current version: 1.5.2-r0
Fixed version: 1.5.3-r0
This actually helps you get actionable data. You can even sort by "stuff I can fix".
- DCKing 8y agoAlthough I'm giving Snyk (at least their marketing guys) a hard time for this, their tool does the same. An awesome feature is that they can actually open pull requests with fixed versions (if available) in your repository to get this stuff fixed. Depending on your setup, this means you immediately get continuous integration results and that a developer can quickly determine to perform an automerge (which in case of minor version updates you usually can). Really cool stuff.