Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 29 Packages Projects Releases Wiki Activity

add note about support for fedora and centos coming (#32095)

Browse Source 
# Checklist for submitter

Closes #32027

---------

Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
This commit is contained in:
Jahziel Villasana-Espinoza
2025-08-19 16:49:26 -04:00
committed by GitHub
co-authored by Noah Talerman
parent a07f8f5344
commit e50d913bc0
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
articles/vulnerability-processing.md
+5 -6
View File
@@ -17,20 +17,19 @@ Fleet detects vulnerabilities for these software types:
| Type | macOS | Windows | Linux |
| ------------------- | ------------------------------------------ | ------------------------------------------------ |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Apps | ✅ | ✅ | ❌ |
| Operating system (OS) | ✅ | ✅ | ✅ |
| Browser plugins | Chrome extensions, Firefox extensions | Chrome extensions, Firefox extensions | ❌ |
| Packages | Python, Homebrew | Python, Atom, Chocolatey | <p>For Ubuntu, Debian, RHEL (including CentOS), and Fedora: packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files.</p><p>For Amazon Linux, packages maintained by Amazon by checking [ALAS advisories](https://alas.aws.amazon.com/).</p> |
| IDE extensions | VS Code extensions | VS Code extensions | VS Code extensions |
Linux OS vulnerabilites are the kernel vulnerabilities. Currently, Ubuntu, Debian, and Amazon Linux are supported. CentOS and Fedora [coming soon](https://github.com/fleetdm/fleet/issues/31495).
Linux kernel vulnerabilities with known variants (ie. `-generic` or `kernel`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
Currently, only software names with all ASCII characters are supported. Vulnerabilities won't be detected for software with names featuring non-ASCII characters, such as Cyrillic, or software that has been renamed from its default name (e.g. "Chrome 2" instead of "Google Chrome"). For some software, Fleet uses [custom rules](https://github.com/fleetdm/fleet/blob/main/server/vulnerabilities/nvd/cpe_translations.json) to mitigate these issues on an app-by-app basis.
If you find that Fleet is incorrectly marking software as vulnerable (false positive) or missing a vulnerability (false negative), please file a [bug](https://github.com/fleetdm/fleet/issues/new?template=bug-report.md). When false positives are fixed, it may take two hours for the false positive to disappear after upgrading Fleet.
### Linux kernels
For Ubuntu, Debian, and Amazon Linux, kernel vulnerabilities with known variants (ie. `-generic` or `kernel`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
Linux kernel vulnerabilities are surfaced as OS-level vulnerabilities in the **Software > OS** page. Fleet shows the total number of vulnerability occurences across all hosts.
## Sources
Fleet combines multiple sources to get accurate and up-to-date CVE information: