4 ms·
This article shows an interesting contrast between how different types of scanning tools address the issue of valid CVEs for which there are no updates. The qu
by raesene9 6y ago
This article shows an interesting contrast between how different types of scanning tools address the issue of valid CVEs for which there are no updates.
The question is "do you want to know about a valid CVE if there's no patch available"?
For high security environments, the answer might be yes (you want to evaluate individual patches to see if they impact your application)
For many environments the answer is likely (as is the case with OP) no, you only want to know about issues for which there is an updated package available.
Interestingly (well to me :) ) more established scanning tools (e.g. Tenable Nessus) default to "no" on this question and container scanning tools mostly default to "yes". (I did an example comparison https://raesene.github.io/blog/2020/11/22/When_Is_A_Vulnerability_Not_A_Vulnerability/ https://raesene.github.io/blog/2020/11/22/When_Is_A_Vulnerab...)
The important part is that your organization makes an informed choice about which works best for them.
As a sidenote there are also differences in severities and how vulnerabilities are counted (e.g. if you have multiple issues in a package do you count each one or just count once for that package) which can lead to different numbers of issues being reported by different scanners. https://raesene.github.io/blog/2020/06/21/Container_Vulnerability_Scanning_Fun/ https://raesene.github.io/blog/2020/06/21/Container_Vulnerab...
- WrtCdEvrydy 6y agoHere's the question, if you default to "yes", wouldn't you want to throw "There might be CVEs in this image that don't have a CVE assigned" for every container...
- raesene9 6y agowell I'd say there's a difference there, I guess between "no patch but CVE" and "no known CVE" :)
- thaeli 6y agoThe logic I really want is "hide old unfixed but show me unfixed that's less than X days old" so new stuff surfaces briefly but these zombie vulns aren't constant noise.
- raesene9 6y agoI don't think I've seen that exact logic, but it probably could be implemented via scanners that have a "white-list" feature. you could build lists of things you know about but don't want flagged, but I'd guess the maintenance could be a pain.
- wizzwizz4 6y agoAptitude's “new packages” feature works fine.
- acdha 6y agoThe big thing for me is _why_ no patch is available: the maintainer concluding there’s no meaningful impact is different than nobody actually working on the project. I’m especially thinking about things like (IIRC) that old Debian man packaging issue where the exploit only affected the post-install script and since it was so late in the life of that release they basically said they wouldn’t ship an update unless there was another issue forcing it.
- jascii 6y agoJust because there are no patches available, doesn't necessarily mean no mitigating actions can be taken. So, yeah, I do want to know about them.