Azure Linux (CBL-Mariner)¶
CBL-Mariner was rebranded to Azure Linux for version 3.0 onwards.
Tunnel supports the following scanners for OS packages.
| Version | SBOM | Vulnerability | License |
|---|---|---|---|
| 1.0 | ✔ | ✔ | ✔ |
| 1.0 (Distroless) | ✔ | ✔ | |
| 2.0 | ✔ | ✔ | ✔ |
| 2.0 (Distroless) | ✔ | ✔ | |
| 3.0 | ✔ | ✔ | ✔ |
| 3.0 (Distroless) | ✔ | ✔ |
The following table provides an outline of the targets Tunnel supports.
| Version | Container image | Virtual machine | Arch |
|---|---|---|---|
| 1.0 | ✔ | ✔ | amd64, arm64 |
| 2.0 | ✔ | ✔ | amd64, arm64 |
| 3.0 | ✔ | ✔ | amd64, arm64 |
The table below outlines the features offered by Tunnel.
| Feature | Supported |
|---|---|
| Detect unfixed vulnerabilities | ✓ |
| Dependency graph | ✓ |
SBOM¶
Tunnel detects packages that have been installed through package managers such as tdnf, dnf and yum.
Vulnerability¶
Azure Linux offers its own security advisories, and these are utilized when scanning Azure Linux for vulnerabilities.
Data Source¶
See here.
Fixed Version¶
Tunnel takes fixed versions from Azure Linux OVAL.
Severity¶
Tunnel calculates the severity of an issue based on the severity provided in Azure Linux OVAL.
Status¶
Tunnel supports the following vulnerability statuses for Azure Linux.
| Status | Supported |
|---|---|
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | |
| Will Not Fix | |
| Fix Deferred | |
| End of Life |
License¶
Tunnel identifies licenses by examining the metadata of RPM packages.
Note
License detection is not supported for Azure Linux Distroless images.