Advisory sources

The vulnerabilities selector function matches package versions, and the OS packages inside container images, against the Bytesafe advisory dataset. The same data is behind the vulnerability pages in the dashboard; see Research advisories and malware.

Advisory sourcesCopy Anchor Link

Bytesafe builds the advisory dataset from these sources.

Exploitation and prediction dataCopy Anchor Link

These sources add to what is known about a vulnerability, rather than naming affected packages:

EUVD records and known-exploited status are shown on a vulnerability's page in the dashboard. They do not change what a rule matches: rules compare CVSS score and EPSS probability only. When a vulnerability has no EPSS score of its own, such as a GHSA advisory, the dashboard shows the score of its CVE alias where EUVD links the two.

Ecosystem coverageCopy Anchor Link

Package advisories are matched for every supported ecosystem except Conda: the dataset has no Conda advisories, and the vulnerabilities selector function is not supported for Conda firewalls.

On a container firewall, the OS packages installed in an image are matched against the advisories of the image's distribution and release. Images based on Alpine, Wolfi and Chainguard, Debian, Ubuntu, Red Hat Enterprise Linux, CentOS, Rocky Linux, AlmaLinux, Amazon Linux, SUSE Linux Enterprise, openSUSE Leap, Photon OS, and CBL-Mariner are covered.

Version matching uses each ecosystem's or distribution's native version scheme. Package names are normalized before matching according to each ecosystem's rules.

CVSS scoreCopy Anchor Link

A rule like maxCvssScore: 7.0 compares against one score per vulnerability.

That score comes from one vendor, chosen when the dataset is built. If the vendor published a CVSS vector, the firewall uses the score of the newest CVSS version it scored: 4.0, then 3.x, then 2.0. If the vendor published only a severity label, the firewall maps the label to a score:

A vulnerability with no score and no severity is unscored. It does not cross any maxCvssScore threshold, so a vulnerabilities rule does not block on it. The dashboard shows it as Unscored, and the CLI as UNKNOWN (?).

For OS packages in a container image, the distribution's own assessment is used when it published a CVSS vector. A distribution knows how it builds and ships a package, so its score often differs from NVD's for the same CVE. When the distribution published only a severity label, or nothing, the score above is used.

EPSS scoreCopy Anchor Link

Each vulnerability can carry an EPSS score from FIRST. EPSS has two values:

• probability: likelihood of exploitation, 0 to 1.
• percentile: ranking compared with other CVEs, 0 to 1.

The selector's maxEpssScore compares against probability.

Both thresholds must be exceeded for a match: CVSS score must be greater than maxCvssScore, and EPSS probability must be greater than maxEpssScore. Details and examples are in Block vulnerable packages.

Freshness and score changesCopy Anchor Link

Advisory data changes after publication. A CVE often appears with a provisional CVSS score that is revised once analysis completes: 7.5 can become 10, a critical can be downgraded, and an advisory can be withdrawn entirely. EPSS probabilities are recalculated as exploitation data comes in.

The firewall stores no verdicts. Every download request is evaluated against the advisory dataset, so score changes take effect in both directions:

• Score drops below your threshold: the vulnerabilities rule stops matching, and the next request for the package passes. Nothing needs to be reset. An exception created while the package was blocked stops being consulted, because exceptions are only checked after the rule matches.
• Score rises above your threshold: the rule starts matching, and the next request is blocked. This applies even if the same version was downloaded through the firewall before; the firewall's artifact cache does not bypass rule evaluation.
• Advisory withdrawn: it is excluded from matching entirely.

Two things bound how quickly a change shows up:

• Bytesafe rebuilds the dataset from its sources several times a day.
• Only requests that reach the firewall are evaluated. A version already sitting in a client's local package manager cache, or in a repository manager cache in front of the firewall, is served from there without a new firewall decision.

Other package signalsCopy Anchor Link

• Malware detection combines package-content findings with dedicated malicious-package intelligence. It does not use the vulnerability dataset described on this page. See Block malware.
• Deprecated and unlisted status comes from upstream registry metadata. See Block deprecated packages.

RelatedCopy Anchor Link

• How-to: Block vulnerable packages, Research advisories and malware
• Reference: Selector functions, Rules and selectors