search

anchore / vunnel

Tool for collecting vulnerability data from various sources (used to build the grype database)
Apache License 2.0
69 stars 25 forks source link

Switch RedHat vulnerability provider from OVAL to CSAF #323

Open westonsteimel opened 11 months ago

westonsteimel commented 11 months ago

What would you like to be added:

The RedHat provider currently uses the v2 OVAL files for RedHat vulnerability data; however, those will only continue to be updated until the end of 2024. We need to transition to using the new CSAF endpoints per https://www.redhat.com/en/blog/future-red-hat-security-data

westonsteimel commented 8 months ago

I was hoping that the CSAF data would include the data about non-fixed and not affected packages so that we could drop having to also rely on the CVE api, but unfortunately it doesn't. There is currently only CSAF data available for entries that do have advisories issued. This means that even with the switch to CSAF we'll still need to first call the summary api to get all applicable cves, download the full cve json, parse the entries from the cve json, and then enhance the entries that have RHSA with the data from the CSAF document for that RHSA.

westonsteimel commented 8 months ago

It will also end up being more network calls for the CSAF data since each CSAF RHSA is stored as a separate json whereas the OVAL data was stored as a bulk xml per rhel release