8 ms·
AFAIK the reason it's different is that Debian/Ubuntu publish lists of unpatched CVEs but I don't believe that RH do. What scanners are often doing is pulling
by raesene9 6y ago
AFAIK the reason it's different is that Debian/Ubuntu publish lists of unpatched CVEs but I don't believe that RH do.
What scanners are often doing is pulling the published Sec-db for a distribution and using that as their data source. So as a result they can only report on things that are in the data source.
- dec0dedab0de 6y agoMaybe I just don't understand CVEs. I thought it would be published at a third party and linked to glibc, not to a specific distro.
- CameronNemo 6y agoTrivy is open source. You can check where they get their data from. But I imagine they use this for Debian: https://security-tracker.debian.org/tracker/ https://security-tracker.debian.org/tracker/
- raesene9 6y agoThere is a list of CVEs available via NVD or similar, however the challenge for a scanner is "how do I know if the binaries I'm seeing have been patched" The common way to do that is to lean on the linux distribution's package management system, which is why the way it works varies from distro to distro.