The CVE page allows detailed analysis of CVE vulnerabilities in the system. qbee.io is connected to the NIST CVE vulnerability database which is constantly updated with new vulnerability analysis. qbee.io gathers all installed libraries on the different target devices and constantly monitors all those against the CVE database. This way qbee can immediately warn users if new vulnerabilities are detected. Not all vulnerabilities are critical or relevant. Therefore there is a rating score applied to each. This allows to quickly judge the severity. In addition reviewd vulnerabilities can be disabled or deleted. Disabling or deleting a CVE message will create log information in the audit trail. There the reason for disabling or deleting the CVE item can be stated such that also this is traceable.
Not all CVE entries are critical. Please review and understand how the vulnerability impacts your device/system. If the impact is neligible the CVE can be disabled/deleted.
In the above example a CVE for openssl is detected. This is always worth investigating. Clicking on the vulnerability will give additional information:
In this view you get the following information:
- how many devices are impacted (4 out of 15)
- which devices are impacted (raspberrypi-1..5)
- when was this detected
- which package is impacted (1.0.1k-3+deb8u1)
Clicking on the NIST source gives detailed background information:
Here it is a clear recommendation to update those 5 impacted devices.