search

aquasecurity / vuln-list-update

Apache License 2.0
174 stars 99 forks source link

advisories for amazonlinux extras are missing #267

Open piax93 opened 9 months ago

piax93 commented 9 months ago

In AmazonLinux2 there are a few packages, including some kernel versions, which can be installed via the "extras" mechanism, and that happens through individual mirrors which are separate from the one which is currently used to fetch the update advisories. This means that some advisories like this one as currently not present in the vuln-list output.

The list of packages included in the extras can be pulled from

https://cdn.amazonlinux.com/2/extras-catalog-${arch}.json

with each mirror link then being found at

https://cdn.amazonlinux.com/2/extras/${extras_name}/latest/${arch}/mirror.list

As far as I am aware, this only applies to Amazon Linux 2 at the time of writing.