Skip to content

Vulnerability Report

Scan RPM packages in a repository version for known CVEs by querying the OSV database.

Results are linked to the repository version and individual packages.

New in pulp_rpm>=3.38.0

New in pulp-cli>=0.41.0 (optional)

Prerequisites

Before scanning, ensure you have:

  1. An RPM repository with synced or uploaded content.
  2. Connectivity to the OSV API (https://api.osv.dev/v1/query).
  3. The repository configured with an osv_config specifying which ecosystem(s) to query.

Supported ecosystems

The following ecosystems from the OSV ecosystem list are supported:

Ecosystem Expected releases format
AlmaLinux Release number (e.g. 9)
Azure Linux Release number (e.g. 3.0)
Mageia Release number (e.g. 9)
openEuler YY.MM numeric version (e.g. 22.03)
openSUSE PRETTY_NAME from /etc/os-release (e.g. openSUSE Leap 15.5)
Photon OS Release number (e.g. 4.0)
Red Hat CPE (e.g. cpe:/o:redhat:enterprise_linux:9::baseos)
Rocky Linux Release number (e.g. 9)
SUSE PRETTY_NAME from /etc/os-release (e.g. SUSE Linux Enterprise Server 15 SP5)

Usage

Configure the repository

The repository needs to be configured so the vulnerability scan knows what RPM ecosystem it will use.

The configuration is a list of {name, releases} entries, where name is the name of the ecosystem and releases is a list of release identifiers. These identifiers scope the OSV query to specific product/ecosystem releases, as shown in Supported ecosystems.

Each release entry triggers a separate query to OSV. This means configuring two releases (for the same ecosystem or not) will generate one report per release for each package.

Set osv_config on the repository before triggering a scan:

pulp rpm repository update \
  --name "$REPOSITORY" \
  --osv-config '[{"name": "AlmaLinux", "releases": ["9"]}]'

Multiple ecosystems can be combined for multiple scans:

pulp rpm repository update \
  --name "$REPOSITORY" \
  --osv-config='[
    {"name": "Red Hat", "releases": ["cpe:/o:redhat:enterprise_linux:9::baseos"]},
    {"name": "AlmaLinux", "releases": ["9"]}
  ]'

Set osv_config to null to opt the repository back out. Note that removing the config does not delete existing scan results already stored for prior versions.

pulp rpm repository update \
  --name "$REPOSITORY" \
  --osv-config=""

Generate a Vulnerability Report

Scan a RepositoryVersion by passing the repository or repository version:

# Use the latest version
pulp rpm repository version scan --repository "$REPOSITORY"

# Or a specify a version
pulp rpm repository version scan --repository "$REPOSITORY" --version 2

Viewing Scan Results

After a scan completes, vulnerability information is available in two places:

  1. The RepositoryVersion includes a vuln_report field. It contains an href that shows all vulnerabilities found in that version
  2. Individual packages includes a vuln_report field. It contains an href that shows all vulnerabilities associated with that package
pulp rpm repository version show --repository "$REPOSITORY" --version 1

The response includes a vuln_report field:

{
  "pulp_href": "/pulp/api/v3/repositories/rpm/rpm/.../versions/1/",
  "number": 1,
  ...
  "vuln_report": "/pulp/api/v3/vuln-reports/..."
}

pulp rpm content -t package list

Each package in the response includes:

{
    "pulp_href": "/pulp/api/v3/content/rpm/packages/.../",
    ...
    "vuln_report": "/pulp/api/v3/vuln-reports/...",
}

To view the actual vulnerability data, retrieve the vulnerability report href from an RepositoryVersion or a Package. This will return a list of vulnerability report resources:

pulp show --href $VULN_REPORT_HREF

Each individual report include:

  • Data provided by the OSV format (e.g, CVE identifiers, fixed versions, ...)
  • Pulp RepositoryVersion and Content impacted
{
  "prn": "prn:core.vulnerabilityreport:...",
  "content": "/pulp/api/v3/content/rpm/packages/.../",  # associated Package
  "repo_versions": [...]  # Impacted repository versions
  "vulns": [...]  # osv data
}

Example Workflow

Here's a complete example of scanning a repository for vulnerabilities:

REPOSITORY=myrepo
KERNEL_URL="https://vault.centos.org/7.0.1406/os/x86_64/Packages/kernel-3.10.0-123.el7.x86_64.rpm"
OSV_CONFIG='[{"name": "Red Hat", "releases": ["cpe:/o:redhat:enterprise_linux:7::workstation"]}]'

# Create a repository and put a package in
pulp rpm repository create \
  --name "$REPOSITORY" --osv-config="$OSV_CONFIG"
pulp rpm content -t package create \
  --repository "$REPOSITORY" --file-url "$KERNEL_URL"

# Trigger the scan
pulp rpm repository version scan --repository "$REPOSITORY"

# Show reports for the latest repository version
VULN_REPORT=$(pulp rpm repository version show --repository "$REPOSITORY" | jq -r '.vuln_report')
pulp show --href "$VULN_REPORT"