This release lets you check a single CVE against your whole fleet. Txlog now stores the CVEs that each distribution advisory covers. It reports which active assets are still vulnerable to a CVE and which ones are already fixed, through the dashboard and the REST API.
Features
- Check a CVE across the fleet in the new CVE Exposure card on Analytics > Security & Mitigations.
- Query the same data from
GET /v1/vulnerabilities/{cve}/assets. The response lists the advisories that cover the CVE and gives every active asset one status:vulnerable,fixed,unknownornot_affected. - See the affected package builds still installed on each vulnerable asset, and the date the last affected build was removed from each fixed asset. Each build is evaluated on its own, so installonly packages such as the kernel are reported correctly.
- Find AlmaLinux, Rocky Linux and Red Hat advisories (
ALSA,RLSA,RHSA) by their CVE. The OSV update job now stores the upstream identifiers of each advisory.
Fixes
- Wait up to 30 seconds for PostgreSQL to accept connections at startup. Before, the database migrations were skipped when PostgreSQL was still booting, and the server kept running on an outdated schema.
Upgrade Notes
- Run the OSV update once after upgrading (from the admin panel or by waiting for the scheduled job). Until it runs, every CVE lookup reports that no advisory covers the CVE.
Full Changelog: v1.38.2...v1.39.0