Skip to content

Add RHEL OSV vulnerability scanning #43377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mostlikelee wants to merge 9 commits into
base: main
Choose a base branch
from
Draft

Add RHEL OSV vulnerability scanning #43377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
e7730cb
init
mostlikelee Apr 9, 2026
a4a74a8
use existing config
mostlikelee Apr 9, 2026
fcc4daa
simplify rhel check
mostlikelee Apr 9, 2026
b51a207
add analyzer tests
mostlikelee Apr 9, 2026
eec7b4f
lint
mostlikelee Apr 9, 2026
1f021e2
fix get ubuntu
mostlikelee Apr 9, 2026
b7ea30c
simplify version parse
mostlikelee Apr 9, 2026
f027e6f
remove fedora from osv scan
mostlikelee Apr 9, 2026
d8a65f7
add sync tests
mostlikelee Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 99 additions & 3 deletions cmd/fleet/cron.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,6 +207,11 @@ func scanVulnerabilities(
ovalVulns = append(ovalVulns, osvVulns...)
}

if config.OSVForVulnerabilities {
rhelOSVVulns := checkRHELOSVVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
ovalVulns = append(ovalVulns, rhelOSVVulns...)
}

govalDictVulns := checkGovalDictionaryVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
macOfficeVulns := checkMacOfficeVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
winOfficeVulns := checkWinOfficeVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
Expand Down Expand Up @@ -417,14 +422,16 @@ func checkOvalVulnerabilities(
return nil
}

// If OSV feature flag is enabled, filter out platforms supported by OSV (OVAL will skip them)
// If OSV feature flag is enabled, filter out platforms handled by OSV (OVAL will skip them)
processVersions := versions
if config.OSVForVulnerabilities {
var nonOSVPlatforms []fleet.OSVersion
for _, v := range versions.OSVersions {
if !osv.IsPlatformSupported(v.Platform) {
nonOSVPlatforms = append(nonOSVPlatforms, v)
// Fedora reports platform "rhel" but Red Hat OSV doesn't cover it — keep in OVAL
if osv.IsPlatformSupported(v.Platform) && !strings.Contains(v.Name, "Fedora") {
continue
}
nonOSVPlatforms = append(nonOSVPlatforms, v)
}

processVersions = &fleet.OSVersions{
Expand Down Expand Up @@ -471,6 +478,7 @@ func checkOvalVulnerabilities(
analyzeSpan.End()

cleanupStaleOSVVulnerabilities(ctx, ds, logger, config.OSVForVulnerabilities)
cleanupStaleRHELOSVVulnerabilities(ctx, ds, logger, config.OSVForVulnerabilities)
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Only purge the previous RHEL source after the replacement scan succeeds.

These deletes run even when the replacement path failed to sync or analyze. In that case, flipping osv_for_vulnerabilities can wipe the old RHEL source and leave hosts with no RHEL vuln coverage until a later successful run. Please gate the cleanup on a successful replacement pass instead of calling it unconditionally.

Also applies to: 636-637

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@cmd/fleet/cron.go` at line 481, The call to
cleanupStaleRHELOSVVulnerabilities is being executed unconditionally, which can
delete the old RHEL source even when the replacement/sync/analyze step failed;
change the flow so cleanupStaleRHELOSVVulnerabilities(ctx, ds, logger,
config.OSVForVulnerabilities) only runs after the replacement pass completes
successfully — locate the code path that flips or performs the replacement of
osv_for_vulnerabilities and move or wrap the cleanup call inside the success
branch (check the success/err return of that replacement/sync/analyze function),
and apply the same gating to the other occurrences mentioned (the calls around
the later lines 636-637).


return results
}
Expand Down Expand Up @@ -567,6 +575,89 @@ func cleanupStaleOVALVulnerabilities(ctx context.Context, ds fleet.Datastore, lo
}
}

func checkRHELOSVVulnerabilities(
ctx context.Context,
ds fleet.Datastore,
logger *slog.Logger,
vulnPath string,
config *config.VulnerabilitiesConfig,
collectVulns bool,
) []fleet.SoftwareVulnerability {
ctx, span := tracer.Start(ctx, "vuln.check_rhel_osv")
defer span.End()

var results []fleet.SoftwareVulnerability

versions, err := ds.OSVersions(ctx, nil, nil, nil, nil)
if err != nil {
errHandler(ctx, logger, "listing platforms for RHEL OSV", err)
return nil
}

var now time.Time
if !config.DisableDataSync {
now = time.Now()
}

if !config.DisableDataSync {
refreshCtx, refreshSpan := tracer.Start(ctx, "vuln.rhel_osv.refresh")
downloaded, err := osv.RefreshRHEL(refreshCtx, versions, vulnPath, now)
if err != nil {
errHandler(refreshCtx, logger, "updating RHEL OSV artifacts", err)
}
for _, d := range downloaded {
logger.DebugContext(refreshCtx, "", "rhel-osv-sync-downloaded", d)
}
refreshSpan.End()
}

analyzeCtx, analyzeSpan := tracer.Start(ctx, "vuln.rhel_osv.analyze",
trace.WithAttributes(attribute.Int("os_count", len(versions.OSVersions))))
for _, version := range versions.OSVersions {
start := time.Now()
r, err := osv.AnalyzeRHEL(analyzeCtx, ds, version, vulnPath, collectVulns, logger, now)
if err != nil && errors.Is(err, osv.ErrUnsupportedPlatform) {
logger.DebugContext(analyzeCtx, "rhel-osv-analysis-unsupported", "platform", version.Name)
continue
}

elapsed := time.Since(start)
logger.DebugContext(analyzeCtx, "rhel-osv-analysis-done",
"platform", version.Name,
"elapsed", elapsed,
"found new", len(r))
results = append(results, r...)
if err != nil {
errHandler(analyzeCtx, logger, "analyzing RHEL OSV artifacts", err)
}
}
analyzeSpan.End()

cleanupStaleRHELOVALVulnerabilities(ctx, ds, logger)

return results
}

// cleanupStaleRHELOSVVulnerabilities removes RHEL OSV vulnerabilities when the flag is disabled.
func cleanupStaleRHELOSVVulnerabilities(ctx context.Context, ds fleet.Datastore, logger *slog.Logger, osvEnabled bool) {
if osvEnabled {
return
}

logger.DebugContext(ctx, "cleaning up RHEL OSV vulnerabilities because RHEL OSV is disabled")
if err := ds.DeleteOutOfDateVulnerabilities(ctx, fleet.RHELOSVSource, time.Now().Add(deleteAllVulnerabilitiesTime)); err != nil {
errHandler(ctx, logger, "cleaning up RHEL OSV vulnerabilities", err)
}
}

// cleanupStaleRHELOVALVulnerabilities removes RHEL OVAL vulnerabilities when RHEL OSV is enabled.
func cleanupStaleRHELOVALVulnerabilities(ctx context.Context, ds fleet.Datastore, logger *slog.Logger) {
logger.DebugContext(ctx, "cleaning up RHEL OVAL vulnerabilities because RHEL OSV is enabled")
if err := ds.DeleteOutOfDateVulnerabilities(ctx, fleet.RHELOVALSource, time.Now().Add(deleteAllVulnerabilitiesTime)); err != nil {
errHandler(ctx, logger, "cleaning up RHEL OVAL vulnerabilities", err)
}
}

func checkGovalDictionaryVulnerabilities(
ctx context.Context,
ds fleet.Datastore,
Expand Down Expand Up @@ -604,6 +695,11 @@ func checkGovalDictionaryVulnerabilities(
analyzeCtx, analyzeSpan := tracer.Start(ctx, "vuln.goval_dictionary.analyze",
trace.WithAttributes(attribute.Int("os_count", len(versions.OSVersions))))
for _, version := range versions.OSVersions {
// Skip RHEL platforms when OSV is enabled (OSV handles both kernel and non-kernel).
// Fedora reports platform "rhel" but Red Hat OSV doesn't cover it — keep in goval-dictionary.
if config.OSVForVulnerabilities && osv.IsPlatformSupported(version.Platform) && !strings.Contains(version.Name, "Fedora") {
continue
}
start := time.Now()
r, err := goval_dictionary.Analyze(analyzeCtx, ds, version, vulnPath, collectVulns, logger)
if err != nil && errors.Is(err, goval_dictionary.ErrUnsupportedPlatform) {
Expand Down
1 change: 1 addition & 0 deletions server/fleet/vulnerabilities.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,7 @@ const (
GovalDictionarySource
WinOfficeSource
UbuntuOSVSource
RHELOSVSource
)

type VulnerabilityWithMetadata struct {
Expand Down
Loading
Loading