Overview
Anaconda Platform Cloud surfaces Common Vulnerabilities and Exposures (CVE) data for packages in your channels. CVE information powers the security policy filters that help you control which packages are available to your users. This article explains how CVE scores and statuses work so you can set meaningful thresholds in your policies.
CVE severity scores
CVEs are scored using the Common Vulnerability Scoring System (CVSS). Scores range from 0.0 to 10.0, with higher scores indicating more severe vulnerabilities. Anaconda maps these scores to severity labels for easy reference.
| Severity | Score range | Meaning |
|---|---|---|
| None | 0.0 | No vulnerability impact. |
| Low | 0.1 to 3.9 | Limited impact. Exploitation typically requires specific conditions. |
| Medium | 4.0 to 6.9 | Moderate impact. May allow partial access or data exposure. |
| High | 7.0 to 8.9 | Significant impact. Could allow unauthorized access or data loss. |
| Critical | 9.0 to 10.0 | Severe impact. Exploitation is straightforward and consequences are serious. |
CVE statuses
In addition to a score, each CVE in the Anaconda platform carries a status that reflects the current state of the issue. You can filter packages by status in your security policies.
| Status | Meaning |
|---|---|
| Active | The CVE is confirmed and no fix or mitigation is in place for this package version. |
| Reported | The CVE has been identified and is under review. A fix or determination has not yet been issued. |
| Mitigated | A workaround or patch exists. The package may still carry the CVE but the risk has been reduced. |
| Disputed | The applicability of the CVE to this package is being questioned by the maintainer or security community. |
| Cleared | The CVE has been assessed and determined not to apply to this package or version. |
Using CVE data in policies
To exclude vulnerable packages from a channel:
- Create or edit a policy and add a CVE Score filter.
- Set the maximum allowable CVSS score (for example, 6.9 to block High and Critical packages).
- Optionally add a CVE Status filter to block packages with Active or Reported CVEs regardless of score.
- Apply the policy to your Virtual channel.
Note: Anaconda updates CVE data regularly. When a package's CVE status changes (for example, from Active to Mitigated), Channel Tracking will notify you if you have notifications enabled for that channel.