If a Vulnerability that goes through the NVD metadata fetcher has an
empty or Unknown Severity, then use the CVSS score to set one. This
will help to get a more consistent database when a vulnerability source
does not provide this information.
We extracted oval parser from rhel and used that for opensuse and
SUSE Linux Enterpise
Signed-off-by: Thomas Boerger <tboerger@suse.de>
Signed-off-by: Jordi Massaguer Pla <jmassaguerpla@suse.de>
Until https://github.com/coreos/clair/pull/193 is merged, having
vulnerabilities that are tagged both rhel and centos would duplicate in
the database or use a change that requires a migration.
But presently due to the fetcher logic, the rhel provided
vulnerabilities are labelled for centos, and then the namespace does not
match and therefore not tested against.
So until such a day that a vulnerability could have both rhel and centos
label, then hack this in. It'll accomplish the same during this interim.
Signed-off-by: Vincent Batts <vbatts@hashbangbash.com>
The RHEL updater currently ignores vulnerabilities for CentOS <= 5.
s the naming of the constant firstConsideredRHEL suggests it, it
should actually considers CentOS 5 and ignores CentOS < 5.
Fixes#215
By deleting an Ubuntu repository that may be in a bad state,
Clair will eventually be able to perform the update, instead of retrying naively.
Fixes#169
when clair has network problem during updating vulnerability and failed
to update vulnerability, it will keep updating and even if type ctrl^C
can't stop the clair. This patch make clair to stop updating if type
ctrl^C.
Signed-off-by: Lei Jitang <leijitang@huawei.com>
Clair will now use a YAML configuration file instead of command line
arguments as the number of parameters grows.
Also, Clair now exposes a Boot() func that allows everyone to easily
create their own project and load dynamically their own fetchers/updaters.
Avi Miller