Overcoming CVE Shock - Adding Perspective in Vulnerability Scanning
summary
Scans start with an SBOM and a distro vulnerability database but produce huge noisy lists; scanning a recent Redis image returns 81 vulnerabilities including three criticals. Running the container with ptrace runtime file-trace and mapping touched files back to SBOM packages cuts the actionable set to 12 noncritical issues. The practical claim is that runtime-use filtering, not blanket package lists, determines real risk. Industry work on VEX vendor relevance declarations aims to automate that filtering.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker background
- 1:08Why vulnerability scanning matters
- 4:02How vulnerability scanning works
- 12:49The problem of CVE shock
- 16:45Research on runtime vs build-time packages
- 20:17Introducing VEX for vulnerability filtering
- 22:49Future of VEX and industry adoption
related talks
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
30mTaming the Scanner Storm: How VEX Brings Context to Vulnerability Data
16mUnpacking Open Source Security in Public Repos
29mWatching the Watchers: The Hidden Risks of Container Scanning Tools
34mUnpacking Open Source Security in Public Repos & Registries
30mCVE Context Matters, but Do All Vulnerabilities Really Matter?
36mSecurity Scanning - Past/Present/Future
42mScan, Patch, VEX - Using Open Source Tools to Manage...