optiopay / klar

Integration of Clair and Docker Registry
MIT License
506 stars 138 forks source link

Feature: Klar check whitelisted CVEs and notify on CVE changed Vector (Score) #190

Open HarvyNBB opened 1 year ago

HarvyNBB commented 1 year ago

### Brief: Some CVEs when created they have a unique defined vector and base score, However whenever there are any changes noticed for these CVEs, they could end with a changed vector and hence base score.

For instance https://nvd.nist.gov/vuln/detail/CVE-2021-39212 it was published on 09/13/2021 by NVD with

Then changed on 08/05/2022 by GitHub, Inc. to be

In case this CVE is whitelisted based on the initial score which is 3.6 Low, there is no way to get notified with this change.

### Feature request: Klar checks the whitelisted CVE and notifies whenever there is a vector (score) change detected for this CVE since being whitelisted