Failing to detect CentOS 5 packages

[ScalockScanner]

Clair wont find any vulnerabilities in Cenots 5.
This version is part of the supported systems

[Quentin-M]

Hi,

Have you waited for the initial update to occur? You can try to debug what Clair knows about your image/layers using the API. There are few other related issues out there, you can probably dig in and see examples on how to figure out what's going on.

[ScalockScanner]

Hi Quentin,
I know about the update time issue, and its not that. I tested many images
centos 6 and centos 7 on several deployments configurations.
Centos 5 returns always clean

just to make sure I checked in my DB that the update process had ended when
the vulnerability table stops going up ~90,000 vulns..

So all the the DB is defiantly updated.

Were there any positive tests with Centos 5?

Thanks

On Thu, Jul 14, 2016 at 5:31 PM, Quentin Machu notifications@github.com
wrote:

Hi,

Have you waited for the initial update to occur? You can try to debug what
Clair knows about your image/layers using the API. There are few other
related issues out there, you can probably dig in and see examples on how
to figure out what's going on.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
#215 (comment), or mute
the thread
https://github.com/notifications/unsubscribe/APdTE4yo8bZMZQKy2c6pAUwoy6YtXwL2ks5qVkhWgaJpZM4JMZmr
.

[Quentin-M]

Hi,

Here is why CentOS 5 returns clean as you pointed it out:

• updater/fetchers/rhel/rhel.go#36
• updater/fetchers/rhel/rhel.go#293

The RHEL updater currently ignores vulnerabilities for CentOS <= 5. As the naming of the constant firstConsideredRHEL suggests it, it should actually considers CentOS 5 and ignores CentOS < 5.

Thanks for the report!

[Quentin-M]

@ScalockScanner Clair v1.2.3 contains the fix to your issue.