3 ms·

So the same CVEs show up for debian but not redhat even though they're not being fixed upstream. Is IBM/redhat paying someone here? I don't understand why it w

• raesene9 6y ago
  AFAIK the reason it's different is that Debian/Ubuntu publish lists of unpatched CVEs but I don't believe that RH do. What scanners are often doing is pulling the published Sec-db for a distribution and using that as their data source. So as a result they can only report on things that are in the data source.
  • dec0dedab0de 6y ago
    Maybe I just don't understand CVEs. I thought it would be published at a third party and linked to glibc, not to a specific distro.
    • CameronNemo 6y ago
      Trivy is open source. You can check where they get their data from. But I imagine they use this for Debian: https://security-tracker.debian.org/tracker/ https://security-tracker.debian.org/tracker/
    • raesene9 6y ago
      There is a list of CVEs available via NVD or similar, however the challenge for a scanner is "how do I know if the binaries I'm seeing have been patched" The common way to do that is to lean on the linux distribution's package management system, which is why the way it works varies from distro to distro.
• deleted 6y ago
  [deleted]