Skip to content

Vulnerability scanning from VulnerableCode (experimental)

Warning

The integration with VulnerableCode is experimental. It is not yet feature complete and the results might not be as accurate as expected.

The components of a product can be scanned for vulnerabilities using VulnerableCode. VulnerableCode is an open source database, aggregating software vulnerabilities from multiple public advisory sources and presents their details along with their affected packages and fixed-by packages identified by Package URLs (PURLs).

There are 3 preconditions to be met before VulnerableCode can be used for vulnerability scanning:

  • The base URL of the VulnerableCode instance has to be configured in the Settings.
  • License/Component information has to be imported for the product, only then all components are available for scanning. Only components with a PURL (Package URL) can be scanned, components without a PURL are silently skipped.
  • The flag VulnerableCode scanning enabled in the product settings has to be activated. This flag is activated by default for new products.

Configuration in Settings

The VulnerableCode parameters are configured in the Features section of the Settings.

Settings VulnerableCode instance

VulnerableCode instances

Organisations have the choice of either using a publicly available instance of VulnerableCode or set up and use a local installation.

The base URL for the public instance is https://public.vulnerablecode.io. An API key can be requested with https://public.vulnerablecode.io/account/request_api_key/. The public instance has the advantage of working out of the box, but there is no guarantee for its availability and API throttling leading to errors may occur even with an API key.

A local instance can be installed with Docker or other ways, see https://vulnerablecode.readthedocs.io/en/latest/installation.html#installation. See also https://vulnerablecode.readthedocs.io/en/latest/api-admin.html hot to set up an API key. A local instance is more work to set up and maintain, but gives more control about availability and API throttling.

Manual scan

If all preconditions are met, the VulnerableCode scan can be started manually from the Import menu. If a branch is selected, the scan will be performed on the components of the branch. If no branch is selected, the scan will be performed on the components of all branches and components without a branch.

VulnerableCode scanning import

Automatic scan

VulnerableCode scanning can be configured to run automatically at a specific time. There is a general setting and a setting per product.

General setting

In the Features section of the Settings the automatic VulnerableCode scanning can be enabled or disabled for the whole SecObserve instance.

The hour (in UTC time) and minute, when the automatic API imports, OSV scanning and VulnerableCode scanning will run, can be set in the Background tasks section. A restart of the SecObserve instance is required to apply the changes.

Settings background tasks

Setting per product

Only products that have VulnerableCode scanning enabled and Automatic VulnerableCode scanning enabled turned on will be scanned automatically.

VulnerableCode scanning settings

Funding

NLNet     NGI0 Commons Fund     https://nlnet.nl/project/SecObservePlus

Integration of SecObserve with VulnerableCode is funded through the NGI0 Commons Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101135429. Additional funding is made available by the Swiss State Secretariat for Education, Research and Innovation (SERI).