Chapter 4. Conducting Vulnerability Scanning and verification

Procedure

1. Pull the required certification test-harness container images from the Red Hat Container Registry.

   Use the following certification test-harness images for vulnerability scanning. You are encouraged to use the latest supported versions of these images as listed in the Red Hat Container Catalog.

   Image 1:

   rhel9/python-312

   Image 2:

   openshift4/ose-console-rhel9

   Note

   Certification criteria are defined by Red Hat Product Security and Red Hat Partner Connect teams.

2. Verify that the pulled images match the specified digests to ensure you are using the correct certified versions.
3. Scan the test-harness images using the partner security product, without modifying or adjusting the scan output manually.
4. Generate a vulnerability scan report in a machine-readable format, preferably CSV. The report must reflect actual product behavior and include all vulnerabilities and related component metadata.

5. Ensure the report includes the following information for each identified vulnerability:

   • CVE identifier
   • Red Hat package name and version (with backport fix information, if applicable)
   • Red Hat security impact rating (Critical, Important, Moderate, Low)
   • Red Hat state (Fixed, Affected, or Not-Affected) and RHSA reference with URL if fixed
6. Submit the complete vulnerability scan report to the Red Hat certification team through your Certification case.
7. The Red Hat certification team will review the submitted results to ensure they meet baseline accuracy and formatting requirements. The review process may take between two to six weeks from the date of submission.
8. After successful verification, Red Hat grants certification for your scanner product.