Closed adambakalar closed 3 years ago
After speaking with @shpendk I pushed some changes to the vuln checks:
CVE-2020-11978:
CVE-2020-17526:
status
to potential
from confirmed
: Since this check is based on a version check Shpend requested this changerequire_enrichment
at the start of the check, that will make it work with the Uri
entity type, so I removed the NetworkService
entity type.
Adding vulnerability checks for the following Apache Airflow CVEs:
CVE-2020-11978
CVE-2020-13927
CVE-2020-17526
Jira ticket for more details: https://intriguesecurity.atlassian.net/browse/COR-104
One note:
When working on the vulnerability task for
CVE-2020-17526
I tried making it work with both theNetworkService
andUri
entity types, but when testing with theUri
type Core was never able to properly grab thefingerprint
detail, even though when I looked up the entity itself the fingerprints were there, including the Apache Airflow fingerprint.