Chapter 14. Managing vulnerabilities

Procedure

1. To show all CVEs across all images, select Image vulnerabilities from the View image vulnerabilities list.

2. From the View image vulnerabilities list, select how you want to view the images. The following options are provided:

   • Image vulnerabilities: Displays images and deployments in which RHACS has discovered CVEs.

   • Images without vulnerabilities: Displays images that meet at least one of the following conditions:

     • Images that do not have CVEs

     • Images that report a scanner error that may result in a false negative of no CVEs

       Note

       An image that actually contains vulnerabilities can appear in this list inadvertently. For example, if Scanner was able to scan the image and it is known to RHACS, but the scan was not successfully completed, vulnerabilities cannot be detected. This scenario occurs if an image has an operating system that is not supported by the RHACS scanner. Scan errors are displayed when you hover over an image in the image list or click the image name for more information.

3. To filter CVEs by entity, select the appropriate filters and attributes.

   To select multiple entities and attributes, click the right arrow icon to add another criteria. Depending on your choices, enter the appropriate information such as text, or select a date or object.

   The filter entities and attributes are listed in the following table.

   Table 14.1. CVE filtering

   Entity	Attributes
   Image	Name: The name of the image. Operating system: The operating system of the image. Tag: The tag for the image. Label: The label for the image. Registry: The registry where the image is located.
   CVE	Name: The name of the CVE. Discovered time: The date when RHACS discovered the CVE. CVSS: The severity level for the CVE. You can select from the following options for the severity level: is greater than is greater than or equal to is equal to is less than or equal to is less than
   Image Component	Name: The name of the image component, for example, activerecord-sql-server-adapter Source: OS Python Java Ruby Node.js Go Dotnet Core Runtime Infrastructure Version: Version of the image component; for example, 3.4.21. You can use this to search for a specific version of a component, for example, in conjunction with a component name.
   Deployment	Name: Name of the deployment. Label: Label for the deployment. Annotation: The annotation for the deployment.
   Namespace	Name: The name of the namespace. Label: The label for the namespace. Annotation: The annotation for the namespace.
   Cluster	Name: The name of the cluster. Label: The label for the cluster. Type: The cluster type, for example, OCP. Platform type: The platform type, for example, OpenShift 4 cluster.

4. You can select the following options to refine the list of results:

   • Prioritize by namespace view: Displays a list of namespaces sorted according to the risk priority. You can use this view to quickly identify and address the most critical areas. In this view, click <number> deployments in a table row to return to the workload CVE list view, with filters applied to show only deployments, images and CVEs for the selected namespace.
   • Default filters: You can select filters for CVE severity and CVE status that are automatically applied when you visit the Workload CVEs page. These filters only apply to this page, and are applied when you visit the page from another section of the RHACS web portal or from a bookmarked URL. They are saved in the local storage of your browser.
   • CVE severity: You can select one or more levels.
   • CVE status: You can select Fixable or Not fixable.

Procedure

1. In the RHACS portal, click Vulnerability Management Node CVEs.

2. To view the data, do any of the following tasks:

   • To view a list of all the CVEs affecting all of your nodes, select <number> CVEs.
   • To view a list of nodes that contain CVEs, select <number> Nodes.

3. Optional: To filter CVEs according to entity, select the appropriate filters and attributes. To add more filtering criteria, follow these steps:

   1. Select the entity or attribute from the list.
   2. Depending on your choices, enter the appropriate information such as text, or select a date or object.
   3. Click the right arrow icon.

   4. Optional: Select additional entities and attributes, and then click the right arrow icon to add them. The filter entities and attributes are listed in the following table.

      Table 14.2. CVE filtering

      Entity	Attributes
      Node	Name: The name of the node. Operating system: The operating system of the node, for example, Red Hat Enterprise Linux (RHEL). Label: The label of the node. Annotation: The annotation for the node. Scan time: The scan date of the node.
      CVE	Name: The name of the CVE. Discovered time: The date when RHACS discovered the CVE. CVSS: The severity level for the CVE. You can select from the following options for the severity level: is greater than is greater than or equal to is equal to is less than or equal to is less than
      Node Component	Name: The name of the component. Version: The version of the component, for example, 4.15.0-2024. You can use this to search for a specific version of a component, for example, in conjunction with a component name.
      Cluster	Name: The name of the cluster. Label: The label for the cluster. Type: The type of cluster, for example, OCP. Platform type: The type of platform, for example, OpenShift 4 cluster.

4. Optional: To refine the list of results, do any of the following tasks:

   • Click CVE severity, and then select one or more levels.
   • Click CVE status, and then select Fixable or Not fixable.
5. Optional: To view the details of the node and information about the CVEs according to the CVSS score and fixable CVEs for that node, click a node name in the list of nodes.

Procedure

1. Click Vulnerability Management Platform CVEs.

2. You can filter CVEs by entity by selecting the appropriate filters and attributes. You can select multiple entities and attributes by clicking the right arrow icon to add another criteria. Depending on your choices, enter the appropriate information such as text, or select a date or object. The filter entities and attributes are listed in the following table.

   Table 14.3. CVE filtering

   Entity	Attributes
   Cluster	Name: The name of the cluster. Label: The label for the cluster. Type: The cluster type, for example, OCP. Platform type: The platform type, for example, OpenShift 4 cluster.
   CVE	Name: The name of the CVE. Discovered time: The date when RHACS discovered the CVE. CVSS: The severity level for the CVE. You can select from the following options for the severity level: is greater than is greater than or equal to is equal to is less than or equal to is less than Type: The type of CVE: Kubernetes CVE Istio CVE OpenShift CVE

3. To filter by CVE status, click CVE status and select Fixable or Not fixable.

1. In the RHACS portal, click Vulnerability Management Workload CVEs.

2. Click the tab to view the type of CVEs. The following tabs are available:

   • Observed
   • Deferred
   • False positives
3. In the list of CVEs, click the CVE name to open the page containing the CVE details. The Affected components column lists the components that include the CVE.
4. Expand the CVE to display additional information, including the Dockerfile line that introduced the component.

Procedure

1. In the RHACS portal, click Vulnerability Management Workload CVEs.
2. Click <number> Images and select an image.

3. To view additional information, locate the CVE and click the expand icon.

   The additional information includes the component that the CVE is in and the version in which the CVE is fixed, if it is fixable.

4. Update your image to a later version.

Procedure

1. In the RHACS portal, click Vulnerability Management Vulnerability Reporting.
2. Click Create report.
3. Enter a name for your report configuration in the Report name field.
4. Optional: Enter text describing the report configuration in the Report description field.
5. In the CVE severity field, select the severity of common vulnerabilities and exposures (CVEs) that you want to include in the report configuration.
6. Select the CVE status. You can select Fixable, Unfixable, or both.
7. In the Image type field, select whether you want to include CVEs from deployed images, watched images, or both.
8. In the CVEs discovered since field, select the time period for which you want CVEs to be included in the report configuration.

9. In the Configure collection included field, you must configure at least one collection. Complete any of the following actions:

   • Select an existing collection to include. To view the collection information, edit the collection, and get a preview of collection results, click View. When viewing the collection, entering text in the field searches for collections matching that text string.

   • Click Create collection to create a new collection.

     Note

     For more information about collections, see "Creating and using deployment collections" in the "Additional resources" section.

10. Click Next to configure the delivery destinations and optionally set up a schedule for delivery.

Procedure

1. In the RHACS web portal, click Vulnerability Management Vulnerability Reporting.

2. To edit an existing vulnerability report configuration, complete any of the following actions:

   • Locate the report configuration that you want to edit in the list of report configurations. Click the overflow menu, , and then select Edit report.
   • Click the report configuration name in the list of report configurations. Then, click Actions and select Edit report.
3. Make changes to the report configuration and save.

Procedure

1. In the RHACS web portal, click Vulnerability Management Vulnerability Reporting.
2. In the list of report configurations, locate the report configuration that you want to use to create the downloadable report.

3. Generate the vulnerability report by using one of the following methods:

   • To generate the report from the list:

     1. Click the overflow menu, , and then select Generate download. The My active job status column displays the status of your report creation. After the Processing status goes away, you can download the report.

   • To generate the report from the report window:

     1. Click the report configuration name to open the configuration detail window.
     2. Click Actions and select Generate download.
4. To download the report, if you are viewing the list of report configurations, click the report configuration name to open it.
5. Click All report jobs from the menu on the header.
6. If the report is completed, click the Ready for download link in the Status column. The report is in .csv format and is compressed into a .zip file for download.

Procedure

1. In the RHACS web portal, click Vulnerability Management Vulnerability Reporting.
2. In the list of report configurations, locate the report configuration for the report that you want to send.
3. Click the overflow menu, , and then select Send report now.

Procedure

1. In the RHACS web portal, click Vulnerability Management Vulnerability Reporting.
2. Locate the report configuration that you want to clone in the list of report configurations.
3. Click Clone report.
4. Make any changes that you want to the report parameters and delivery destinations.
5. Click Create.

Procedure

1. In the RHACS web portal, click Vulnerability Management Vulnerability Reporting.
2. Locate the report configuration that you want to delete in the list of reports.
3. Click the overflow menu, , and then select Delete report.

Procedure

1. In the RHACS web portal, go to Platform Configuration System Configuration. You can configure the following settings for vulnerability report jobs:

   • Vulnerability report run history retention: The number of days that a record is kept of vulnerability report jobs that have been run. This setting controls how many days that report jobs are listed in the All report jobs tab under Vulnerability Management Vulnerability Reporting when a report configuration is selected. The entire report history after the exclusion date is deleted, with the exception of the following jobs:

     • Unfinished jobs.
     • Jobs for which prepared downloadable reports still exist in the system.
     • The last successful report job for each job type (scheduled email, on-demand email, or download). This ensures users have information about the last run job for each type.
   • Prepared downloadable vulnerability reports retention days: The number of days that prepared, on-demand downloadable vulnerability report jobs are available for download on the All report jobs tab under Vulnerability Management Vulnerability Reporting when a report configuration is selected.
   • Prepared downloadable vulnerability reports limit: The limit, in MB, of space allocated to prepared downloadable vulnerability report jobs. After the limit is reached, the oldest report job in the download queue is removed.
2. To change these values, click Edit, make your changes, and then click Save.

Procedure

1. In the RHACS portal, go to Vulnerability Management Dashboard.
2. On the Dashboard view header, select Application & Infrastructure Namespaces or Deployments.
3. From the list, search for and select the Namespace or Deployment you want to review.
4. To get more information about the application, select an entity from Related entities on the right.

Procedure

1. In the RHACS portal, go to Vulnerability Management Dashboard.
2. On the Dashboard view header, select <number> Images.

3. From the list of images, select the image you want to investigate. You can also filter the list by performing one of the following steps:

   1. Enter Image in the search bar and then select the Image attribute.
   2. Enter the image name in the search bar.
4. In the image details view, review the listed CVEs and prioritize taking action to address the impacted components.
5. Select Components from Related entities on the right to get more information about all the components that are impacted by the selected image. Or select Components from the Affected components column under the Image findings section for a list of components affected by specific CVEs.

Procedure

1. In the RHACS portal, go to Vulnerability Management Dashboard.
2. On the Dashboard view header, select Application & Infrastructure Clusters.
3. From the list of clusters, select the cluster you want to investigate.
4. Review the cluster’s vulnerabilities and prioritize taking action on the impacted nodes on the cluster.

Procedure

1. In the RHACS portal, go to Vulnerability Management Dashboard.
2. On the Dashboard view header, select Nodes.
3. From the list of nodes, select the node you want to investigate.
4. Review vulnerabilities for the selected node and prioritize taking action.
5. To get more information about the affected components in a node, select Components from Related entities on the right.

Procedure

1. Go to the RHACS portal and click Vulnerability Management Dashboard from the navigation menu.
2. From the Vulnerability Management view header, select Application & Infrastructure Image Components.
3. In the Image Components view, select the Image CVEs column header to arrange the components in descending order (highest first) based on the CVEs count.

Procedure

1. In the RHACS portal, go to Vulnerability Management Dashboard.
2. From the Vulnerability Management view header, under Filter CVEs, click Fixable.

Procedure

1. Go to the RHACS portal and click Vulnerability Management Dashboard from the navigation menu.
2. From the Vulnerability Management view header, select Images.
3. View the base operating system (OS) and OS version for all images under the Image OS column.
4. Select an image to view its details. The base operating system is also available under the Image Summary Details and Metadata section.

Procedure

1. Go to the RHACS portal and click Vulnerability Management Dashboard from the navigation menu.

2. Select the Top Risky widget header to choose between riskiest images, deployments, clusters, and namespaces.

   The small circles on the chart represent the chosen object (image, deployment, cluster, namespace). Hover over the circles to see an overview of the object they represent. And select a circle to view detailed information about the selected object, its related entities, and the connections between them.

   For example, if you are viewing Top Risky Deployments by CVE Count and CVSS score, each circle on the chart represents a deployment.

   • When you hover over a deployment, you see an overview of the deployment, which includes deployment name, name of the cluster and namespace, severity, risk priority, CVSS, and CVE count (including fixable).
   • When you select a deployment, the Deployment view opens for the selected deployment. The Deployment view shows in-depth details of the deployment and includes information about policy violations, common vulnerabilities, CVEs, and riskiest images for that deployment.
3. Select View All on the widget header to view all objects of the chosen type. For example, if you chose Top Risky Deployments by CVE Count and CVSS score, you can select View All to view detailed information about all deployments in your infrastructure.

Procedure

1. Go to the RHACS portal and click Vulnerability Management from the navigation menu.

2. Select the Top Riskiest Images widget header to choose between the riskiest images and components. If you are viewing Top Riskiest Images:

   • When you hover over an image in the list, you see an overview of the image, which includes image name, scan time, and the number of CVEs along with severity (critical, high, medium, and low).
   • When you select an image, the Image view opens for the selected image. The Image view shows in-depth details of the image and includes information about CVEs by CVSS score, top riskiest components, fixable CVEs, and Dockerfile for the image.
3. Select View All on the widget header to view all objects of the chosen type. For example, if you chose Top Riskiest Components, you can select View All to view detailed information about all components in your infrastructure.

Procedure

1. In the RHACS portal, go to Vulnerability Management Dashboard.
2. Select an image from either the Top Riskiest Images widget or click the Images button at the top of the dashboard and select an image.
3. In the Image details view, next to Dockerfile, select the expand icon to see a summary of instructions, values, creation date, and components.
4. Select the expand icon for an individual component to view more information.

Procedure

1. Go to the RHACS portal and click Vulnerability Management Dashboard from the navigation menu.
2. Select an image from either the Top Riskiest Images widget or click the Images button at the top of the dashboard and select an image.
3. In the Image details view, next to Dockerfile, select the expand icon to see a summary of image components.
4. Select the expand icon for specific components to get more details about the CVEs affecting the selected component.

Procedure

1. In the RHACS portal, click Vulnerability Management→ Dashboard. The Clusters with most orchestrator and Istio vulnerabilities widget shows a list of clusters, ranked by the number of Kubernetes, Red Hat OpenShift, and Istio vulnerabilities (deprecated) in each cluster. The cluster on top of the list is the cluster with the highest number of vulnerabilities.

2. Click on one of the clusters from the list to view details about the cluster. The Cluster view includes:

   • Cluster Summary section, which shows cluster details and metadata, top risky objects (deployments, namespaces, and images), recently detected vulnerabilities, riskiest images, and deployments with the most severe policy violations.
   • Cluster Findings section, which includes a list of failing policies and list of fixable CVEs.
   • Related Entities section, which shows the number of namespaces, deployments, policies, images, components, and CVEs the cluster contains. You can select these entities to view more details.
3. Click View All on the widget header to view the list of all clusters.

Procedure

1. In the RHACS portal, go to Vulnerability Management Dashboard.
2. Select Nodes on the header to view a list of all the CVEs affecting your nodes.

3. Select a node from the list to view details of all CVEs affecting that node.

   1. When you select a node, the Node details panel opens for the selected node. The Node view shows in-depth details of the node and includes information about CVEs by CVSS score and fixable CVEs for that node.
   2. Select View All on the CVEs by CVSS score widget header to view a list of all the CVEs in the selected node. You can also filter the list of CVEs.
   3. To export the fixable CVEs as a CSV file, select Export as CSV under the Node Findings section.

Procedure

1. Click CVEs from the Vulnerability Management view header.
2. You can select the checkboxes for one or more CVEs, and then click Add selected CVEs to Policy (add icon) or move the mouse over a CVE in the list, and select the Add icon.

3. For Policy Name:

   • To add the CVE to an existing policy, select an existing policy from the drop-down list box.
   • To create a new policy, enter the name for the new policy, and select Create <policy_name>.
4. Select a value for Severity, either Critical, High, Medium, or Low.
5. Choose the Lifecycle Stage to which your policy is applicable, from Build, or Deploy. You can also select both life-cycle stages.
6. Enter details about the policy in the Description box.
7. Turn off the Enable Policy toggle if you want to create the policy but enable it later. The Enable Policy toggle is on by default.
8. Verify the listed CVEs which are included in this policy.
9. Click Save Policy.

Procedure

1. Run one of the following commands to update the compliance container.

   • For a default compliance container with metrics disabled, run the following command:

     $ oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"containers":[{"name":"compliance","env":[{"name":"ROX_METRICS_PORT","value":"disabled"},{"name":"ROX_NODE_SCANNING_ENDPOINT","value":"127.0.0.1:8444"},{"name":"ROX_NODE_SCANNING_INTERVAL","value":"4h"},{"name":"ROX_NODE_SCANNING_INTERVAL_DEVIATION","value":"24m"},{"name":"ROX_NODE_SCANNING_MAX_INITIAL_WAIT","value":"5m"},{"name":"ROX_RHCOS_NODE_SCANNING","value":"true"},{"name":"ROX_CALL_NODE_INVENTORY_ENABLED","value":"true"}]}]}}}}'

   • For a compliance container with Prometheus metrics enabled, run the following command:

     $ oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"containers":[{"name":"compliance","env":[{"name":"ROX_METRICS_PORT","value":":9091"},{"name":"ROX_NODE_SCANNING_ENDPOINT","value":"127.0.0.1:8444"},{"name":"ROX_NODE_SCANNING_INTERVAL","value":"4h"},{"name":"ROX_NODE_SCANNING_INTERVAL_DEVIATION","value":"24m"},{"name":"ROX_NODE_SCANNING_MAX_INITIAL_WAIT","value":"5m"},{"name":"ROX_RHCOS_NODE_SCANNING","value":"true"},{"name":"ROX_CALL_NODE_INVENTORY_ENABLED","value":"true"}]}]}}}}'

2. Update the Collector DaemonSet (DS) by taking the following steps:

   1. Add new volume mounts to Collector DS by running the following command:

      $ oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"volumes":[{"name":"tmp-volume","emptyDir":{}},{"name":"cache-volume","emptyDir":{"sizeLimit":"200Mi"}}]}}}}'

   2. Add the new NodeScanner container by running the following command:

      $ oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"containers":[{"command":["/scanner","--nodeinventory","--config=",""],"env":[{"name":"ROX_NODE_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"spec.nodeName"}}},{"name":"ROX_CLAIR_V4_SCANNING","value":"true"},{"name":"ROX_COMPLIANCE_OPERATOR_INTEGRATION","value":"true"},{"name":"ROX_CSV_EXPORT","value":"false"},{"name":"ROX_DECLARATIVE_CONFIGURATION","value":"false"},{"name":"ROX_INTEGRATIONS_AS_CONFIG","value":"false"},{"name":"ROX_NETPOL_FIELDS","value":"true"},{"name":"ROX_NETWORK_DETECTION_BASELINE_SIMULATION","value":"true"},{"name":"ROX_NETWORK_GRAPH_PATTERNFLY","value":"true"},{"name":"ROX_NODE_SCANNING_CACHE_TIME","value":"3h36m"},{"name":"ROX_NODE_SCANNING_INITIAL_BACKOFF","value":"30s"},{"name":"ROX_NODE_SCANNING_MAX_BACKOFF","value":"5m"},{"name":"ROX_PROCESSES_LISTENING_ON_PORT","value":"false"},{"name":"ROX_QUAY_ROBOT_ACCOUNTS","value":"true"},{"name":"ROX_ROXCTL_NETPOL_GENERATE","value":"true"},{"name":"ROX_SOURCED_AUTOGENERATED_INTEGRATIONS","value":"false"},{"name":"ROX_SYSLOG_EXTRA_FIELDS","value":"true"},{"name":"ROX_SYSTEM_HEALTH_PF","value":"false"},{"name":"ROX_VULN_MGMT_WORKLOAD_CVES","value":"false"}],"image":"registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8:4.5.4","imagePullPolicy":"IfNotPresent","name":"node-inventory","ports":[{"containerPort":8444,"name":"grpc","protocol":"TCP"}],"volumeMounts":[{"mountPath":"/host","name":"host-root-ro","readOnly":true},{"mountPath":"/tmp/","name":"tmp-volume"},{"mountPath":"/cache","name":"cache-volume"}]}]}}}}'

Procedure

1. In the RHACS portal, go to Vulnerability Management Dashboard.
2. Select Nodes on the header to view a list of all the CVEs affecting your nodes.

3. Select a node from the list to view details of all CVEs affecting that node.

   1. When you select a node, the Node details panel opens for the selected node. The Node view shows in-depth details of the node and includes information about CVEs by CVSS score and fixable CVEs for that node.
   2. Select View All on the CVEs by CVSS score widget header to view a list of all the CVEs in the selected node. You can also filter the list of CVEs.
   3. To export the fixable CVEs as a CSV file, select Export as CSV under the Node Findings section.

Procedure

1. In the RHACS portal, click Vulnerability Management Node CVEs.

2. To view the data, do any of the following tasks:

   • To view a list of all the CVEs affecting all of your nodes, select <number> CVEs.
   • To view a list of nodes that contain CVEs, select <number> Nodes.

3. Optional: To filter CVEs according to entity, select the appropriate filters and attributes. To add more filtering criteria, follow these steps:

   1. Select the entity or attribute from the list.
   2. Depending on your choices, enter the appropriate information such as text, or select a date or object.
   3. Click the right arrow icon.

   4. Optional: Select additional entities and attributes, and then click the right arrow icon to add them. The filter entities and attributes are listed in the following table.

      Table 14.6. CVE filtering

      Entity	Attributes
      Node	Name: The name of the node. Operating system: The operating system of the node, for example, Red Hat Enterprise Linux (RHEL). Label: The label of the node. Annotation: The annotation for the node. Scan time: The scan date of the node.
      CVE	Name: The name of the CVE. Discovered time: The date when RHACS discovered the CVE. CVSS: The severity level for the CVE. You can select from the following options for the severity level: is greater than is greater than or equal to is equal to is less than or equal to is less than
      Node Component	Name: The name of the component. Version: The version of the component, for example, 4.15.0-2024. You can use this to search for a specific version of a component, for example, in conjunction with a component name.
      Cluster	Name: The name of the cluster. Label: The label for the cluster. Type: The type of cluster, for example, OCP. Platform type: The type of platform, for example, OpenShift 4 cluster.

4. Optional: To refine the list of results, do any of the following tasks:

   • Click CVE severity, and then select one or more levels.
   • Click CVE status, and then select Fixable or Not fixable.
5. Optional: To view the details of the node and information about the CVEs according to the CVSS score and fixable CVEs for that node, click a node name in the list of nodes.