For Teachers · Back to the Module · Print with your browser's Print command.

P10 Teacher Answer Key: Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities

Teacher Answer Key (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: F3

Learning Objectives

• [ ] Explain how a package inventory is matched against vulnerability data.
• [ ] Explain why Debian, RPM and semantic versions must be compared with their own rules.
• [ ] Prioritise findings using severity and known exploitation.

Key Terms

Write each definition in your own words.

• CVE: Common Vulnerabilities and Exposures: an identifier for one specific, publicly known vulnerability in a product.
• CVSS: Common Vulnerability Scoring System: a standard way to rate how severe a vulnerability is, from 0.0 to 10.0.
• Patch Management: The process of finding, testing and installing software updates, especially security fixes.
• Software Inventory: A list of installed packages and libraries with their exact versions, the starting point for vulnerability matching.
• Known Exploited Vulnerability: A vulnerability that CISA has confirmed is being used in real attacks, listed in its KEV catalogue.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt vulndb and note the snapshot date and whether it is test data.
2. Run: openvapt demo --only HOST-CVE-,WEB-CVE- --out p10 and read how each finding names the installed and fixed version.
3. Read internal/vulndb/review_test.go and explain why 1.0~rc1 is older than 1.0.

Self-Check Questions

1. Why can't versions be compared as plain numbers?

• [x] a) Because ecosystems such as Debian and RPM have their own rules, such as epochs and tilde pre-releases
• [ ] b) Because versions are secret
• [ ] c) Because numbers are too large
• [ ] d) Because only RPM has ordering rules
• Answer: a. Each ecosystem defines its own ordering rules, and a naive comparison gives wrong answers.

1. Which findings should usually be fixed first?

• [ ] a) Low severity
• [x] b) Vulnerabilities listed as known exploited by CISA
• [ ] c) Informational findings
• [ ] d) The oldest findings
• Answer: b. Known exploitation is strong evidence of real risk.

1. Why does every report state the vulnerability data snapshot date?

• [ ] a) For decoration
• [x] b) Because offline data cannot include vulnerabilities published after it was built
• [ ] c) Because the law requires it
• [ ] d) Because the data changes during the scan
• Answer: b. Old data misses newer vulnerabilities, so the reader must know its age.

1. Which of these Debian versions is the oldest?

• [x] a) 1.0~rc1
• [ ] b) 1.0
• [ ] c) 1.0-1
• [ ] d) 1:0.9
• Answer: a. A tilde sorts before anything, so 1.0~rc1 comes before 1.0. The epoch in 1:0.9 makes it newer than all of them.

1. Why must matching use the distribution's own advisory data?

• [x] a) Distributions often backport fixes without changing the upstream version number
• [ ] b) Upstream data is secret
• [ ] c) Distributions never fix vulnerabilities
• [ ] d) Advisories exist only for Debian
• Answer: a. A backported fix keeps the old upstream number, so only the distribution's data knows which package version is fixed.

1. Where does a web application's library inventory come from?

• [x] a) Lock files such as composer.lock or package-lock.json
• [ ] b) The web server's access log
• [ ] c) Downloading the site from the internet
• [ ] d) The CVE website
• Answer: a. Lock files list the exact library versions the application ships.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OSV, Open Source Vulnerability format and database: https://osv.dev/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Debian Policy Manual, Version numbering: https://www.debian.org/doc/debian-policy/ch-controlfields.html#version

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.