Purpose
The objective of this document is to provide guidance on how to review Known CVEs in third-party libraries used in Netskope products.
Scope
This guide is applicable to:
- Netskope products packages as OVA, Container package
- NPA Publisher
- Virtual Appliance
- Cloud Exchange
- Virtual Private Edge
- DLP as a Service
- SASE Appliance
- Log Streaming Client
- AI Gateway
- Or any product running on Ubuntu as OS
How Ubuntu Handles CVEs
Netskope products that are deployable as OVA or Container packages are based on the Ubuntu operating system. Canonical tracks vulnerabilities per package version and release for Ubuntu.
Key facts:
- Canonical backports security fixes without changing the upstream version number
- A CVE marked “fixed” can still show older upstream versions
- Ubuntu releases security advisory as Ubuntu Security Notices (USNs)
- The official CVE tracker for Ubuntu is - https://ubuntu.com/security/cves
The Problem
Security tools often find the upstream package versions of the components deployed or used on Ubuntu and report CVEs based on the upstream version. This often provides incorrect results and causes false positives.
Running commands such as the below example will give the upstream version only and not the Ubuntu package version:
#command
$openssl version
#output
OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)
Identify Installed Components and Versions on Host Ubuntu
Linux/Ubuntu provides multiple ways to find the installed components and versions. Below are some of those methods:
OS information
#Show OS version
$lsb_release -a
or
$cat /etc/os-release
#kernel version
$uname -rInstalled packages informationInstalled packages information
#summary of all installed packages
$pro security-status
#Output
Total number of installed packages
- number of installed packages from Ubuntu Main/Restricted repository
- number of installed packages from Universe/Multiverse repository
- number of installed packages from third parties
#List of installed packages from third parties
$pro security-status --thirdparty
#output
names of third-party packages
#provides list of all packages on the
$dpkg -l
#output
List of all components with a code
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
Code (code gives combination from Desired and Status)
- ii (Desired = i and Status = i)
- rc Removed but config files remain
- iU Installed but unpacked (not configured)
- iF Half-configured (problem during install)
- rH Marked for removal and held
Name
Version
Architecture
Description
#provide information about a specific package
$dpkg -l <pkg-name>
# output
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
Code (code gives combination from Desired and Status)
- ii (Desired = i and Status = i)
- rc Removed but config files remain
- iU Installed but unpacked (not configured)
- iF Half-configured (problem during install)
- rH Marked for removal and held
Name
Version
Architecture
Description
# Alternatively use
$apt-cache policy <pkg-name>
# Output
package name
installed version
candidate version
Installed package version information
Below is how to see the package version information:
# command
$dpkg -l <pkg-name> # will give a version field
#example 1
$dpkg -l openssl
#output
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-=================-============-====================================================
ii openssl 3.0.2-0ubuntu1.21 amd64 Secure Sockets Layer toolkit - cryptographic utility
# Version details
- 3.0.2-0ubuntu1.21
-- 3.0.2 => upstream version of openssl
-- 0ubuntu1 => ubuntu package version
-- .21 => the security patch numnber
#example 2
$dpkg -l docker-compose-plugin
#output
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-=====================-==========================-============-==============================================
ii docker-compose-plugin 5.0.2-1~ubuntu.22.04~jammy amd64 Docker Compose (V2) plugin for the Docker CLI.
# Version details
- 5.0.2-1~ubuntu.22.04~jammy
-- 5.0.2 => upstream version number
-- 1~ubuntu => ubuntu version number
-- 22.04 => packaged for ubuntu release version
-- jammy => ubuntu codename
Checking for available versions of the package:
#command
$apt-cache show <pkg-name> | grep -e "Package" -e "Version"
#output
- will give the available packages which can be installedIdentify Installed Components and Versions on Docker Container Ubuntu
To find the installed packages and versions on the docker container, log in to the container using below commands:
#list all running docker containers
$sudo docker ps
#login into docker container
$sudo docker exec -it <container-id> /bin/bashNote: Inside the container, run the commands to get the package versions and validate the applicability of the CVEs.
Validating the CVE Applicability
As demonstrated above, after validating the correct version of the installed package on the system, validate if the CVE is patched in the version of the package installed. To validate, follow these steps:
Option 1:
- Navigate to the page - https://ubuntu.com/security/cves
- Enter the CVE number which is being reported
- Alternatively filter on the Ubuntu LTS version used in the products, to reduce unnecessary finding and review
- To understand the status of the CVE, refer this guide - https://ubuntu.com/security/cves/about#statuses
- Enter the package name in the search bar
- Filter using Ubuntu release, status=vulnerable
- Enter the CVE number which is being reported
Option 2:
- Directly navigate to the CVE page, for example: https://ubuntu.com/security/CVE-2024-4741
- Replace the CVE number at the end of the URL for which ever CVE needs evaluation
- Navigate toe Status and see of the package name, Ubuntu release and corresponding Status
- If the status is “Not Affected” or “Fixed” for the version present in the system, then the patch is already present
