How does Prisma Cloud Compute determine fixed versions for applications when they are missing on NVD?
3485
Created On 04/26/24 14:00 PM - Last Modified 11/04/24 22:04 PM
Question
- How does Prisma Cloud Compute determine fix versions when they are missing on NVD (National Vulnerability Database)?
Environment
- Prisma Cloud Compute Edition
- Prisma Cloud Enterprise Edition
- Application vulnerabilities on Images and/or Hosts
Answer
- CPE dictionary determines the "Fix" status, by mapping a CPE (Common Platform Enumeration) to its corresponding version.
- This mapping process establishes fix statuses for Java, JAR, and Python packages for CVEs lacking a fix status which contains rules that enable Prisma Compute to infer the version (such as <=, ==, or <).
Additional Information
- In case of detecting an incorrect fixed version reach out to support to review the fix status and escalate to NVD if needed.
- Until the fix status is updated on NVD a workaround is to add a custom vulnerability to override the specific CVE.