From e50d913bc04026c047a3ea9027137ae626162d9b Mon Sep 17 00:00:00 2001 From: Jahziel Villasana-Espinoza Date: Tue, 19 Aug 2025 16:49:26 -0400 Subject: [PATCH] add note about support for fedora and centos coming (#32095) # Checklist for submitter Closes #32027 --------- Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> --- articles/vulnerability-processing.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/articles/vulnerability-processing.md b/articles/vulnerability-processing.md index b2ef6f1cdc..61e3606922 100644 --- a/articles/vulnerability-processing.md +++ b/articles/vulnerability-processing.md @@ -17,20 +17,19 @@ Fleet detects vulnerabilities for these software types: | Type | macOS | Windows | Linux | | ------------------- | ------------------------------------------ | ------------------------------------------------ |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Apps | ✅ | ✅ | ❌ | +| Operating system (OS) | ✅ | ✅ | ✅ | | Browser plugins | Chrome extensions, Firefox extensions | Chrome extensions, Firefox extensions | ❌ | | Packages | Python, Homebrew | Python, Atom, Chocolatey |

For Ubuntu, Debian, RHEL (including CentOS), and Fedora: packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files.

For Amazon Linux, packages maintained by Amazon by checking [ALAS advisories](https://alas.aws.amazon.com/).

| | IDE extensions | VS Code extensions | VS Code extensions | VS Code extensions | +Linux OS vulnerabilites are the kernel vulnerabilities. Currently, Ubuntu, Debian, and Amazon Linux are supported. CentOS and Fedora [coming soon](https://github.com/fleetdm/fleet/issues/31495). + +Linux kernel vulnerabilities with known variants (ie. `-generic` or `kernel`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD. + Currently, only software names with all ASCII characters are supported. Vulnerabilities won't be detected for software with names featuring non-ASCII characters, such as Cyrillic, or software that has been renamed from its default name (e.g. "Chrome 2" instead of "Google Chrome"). For some software, Fleet uses [custom rules](https://github.com/fleetdm/fleet/blob/main/server/vulnerabilities/nvd/cpe_translations.json) to mitigate these issues on an app-by-app basis. If you find that Fleet is incorrectly marking software as vulnerable (false positive) or missing a vulnerability (false negative), please file a [bug](https://github.com/fleetdm/fleet/issues/new?template=bug-report.md). When false positives are fixed, it may take two hours for the false positive to disappear after upgrading Fleet. -### Linux kernels - -For Ubuntu, Debian, and Amazon Linux, kernel vulnerabilities with known variants (ie. `-generic` or `kernel`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD. - -Linux kernel vulnerabilities are surfaced as OS-level vulnerabilities in the **Software > OS** page. Fleet shows the total number of vulnerability occurences across all hosts. - ## Sources Fleet combines multiple sources to get accurate and up-to-date CVE information: