You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello,
To appease auditor types, it would be useful to allow for comments in the whitelist.yaml file. This will allow us to version control our whitelist file, but also give some human reason for performing the whitelist. As we know, people and knowledge are lost over time, so would be nice to be able to put this information right into the whitelist file.
Suggested behavior
general:
- RHSA-2018:1345: This finding represents a collection of kernel vulnerabilities. In the container world, containers share the same kernel as the host operating system, and thus, kernel vulnerabilities can not accurately be detected at the container layer. Accurate scans for this vulnerability need to occur on the docker host itself. images:
centos:
- RHSA-2017:2479: This finding represents vulnerabilities to the basic auth function of httpd. Since we do not use basic auth in applications using the centos container, this finding is not relevant.
- RHSA-2018:0805: blahalpine:
- CVE-2017-9671: you get the pointfluent/fluent-bit:
- CVE-2017-14062: more
- CVE-2018-6485: comments
The text was updated successfully, but these errors were encountered:
Sorry, I am a moron. I did not realize you could just comment with a #. I can achieve what I want with the following.
general:
# This finding represents a collection of kernel vulnerabilities. In the container world, containers share the same kernel as the host operating system, and thus, kernel vulnerabilities can not accurately be detected at the container layer. Accurate scans for this vulnerability need to occur on the docker host itself.
- RHSA-2018:1345
images:
centos:
# This finding represents vulnerabilities to the basic auth function of httpd. Since we do not use basic auth in applications using the centos container, this finding is not relevant.
- RHSA-2017:2479
# blah
- RHSA-2018:0805
alpine:
# you get the point
- CVE-2017-9671
fluent/fluent-bit:
# more
- CVE-2017-14062
# comments
- CVE-2018-6485
Hello,
To appease auditor types, it would be useful to allow for comments in the whitelist.yaml file. This will allow us to version control our whitelist file, but also give some human reason for performing the whitelist. As we know, people and knowledge are lost over time, so would be nice to be able to put this information right into the whitelist file.
Suggested behavior
The text was updated successfully, but these errors were encountered: