--- title: "P10: Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities" canonical: https://openvapt.com/academy/p10.html html: https://openvapt.com/academy/p10.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P10: Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities How known vulnerabilities are matched to installed software, why version comparison is subtle, and how to prioritise with the CISA Known Exploited Vulnerabilities list. - Level: Practitioner - Time: about 25 minutes - Read first: F3 ## You Will Be Able To - Explain how a package inventory is matched against vulnerability data. - Explain why Debian, RPM and semantic versions must be compared with their own rules. - Prioritise findings using severity and known exploitation. ## From Inventory to Advisory Vulnerability matching starts with an inventory. It lists the installed operating system packages (from dpkg or rpm). It also lists the libraries a web application ships (from lock files such as composer.lock or package-lock.json). Each item is compared with advisories that state which versions are affected and which version fixes the problem. OSV (osv.dev) publishes advisories in one open format for many ecosystems, including Debian, Ubuntu, AlmaLinux, Rocky Linux, Packagist and npm. Distributions often backport fixes without changing the upstream version number, which is why matching must use the distribution's own advisory data and exact package versions. ## Comparing Versions Correctly Version strings are not simple numbers. In Debian versions an epoch (1:) outranks everything. A tilde sorts before anything, so 1.0~rc1 comes before 1.0. The revision after the last hyphen counts too. RPM has its own rules, including a caret for post-release snapshots. A tool that compares versions naively reports false positives and, worse, false negatives. ## Prioritising Severity alone is a poor queue. The CISA Known Exploited Vulnerabilities catalogue lists flaws attackers are known to use in practice; those should be fixed first. Offline data also ages: a snapshot from months ago cannot know about last week's vulnerabilities, so every report states the snapshot date. ## In Summary Know what software you run. Match it against CVE and OSV data. Fix known exploited vulnerabilities first. ## Apply It - [HOST-CVE-001 Installed OS Packages With Known Vulnerabilities](https://openvapt.com/checks/HOST-CVE-001.md) (high) - [HOST-CVE-002 Known Exploited Vulnerabilities Present](https://openvapt.com/checks/HOST-CVE-002.md) (critical) - [HOST-CVE-003 Vulnerability Snapshot Outdated or Test Data](https://openvapt.com/checks/HOST-CVE-003.md) (low) - [WEB-CVE-001 Vulnerable Web Application Libraries](https://openvapt.com/checks/WEB-CVE-001.md) (high) ## Lab 1. `Run: openvapt vulndb and note the snapshot date and whether it is test data.` 2. `Run: openvapt demo --only HOST-CVE-,WEB-CVE- --out p10 and read how each finding names the installed and fixed version.` 3. `Read internal/vulndb/review_test.go and explain why 1.0~rc1 is older than 1.0.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. Why can't versions be compared as plain numbers? - A. Because ecosystems such as Debian and RPM have their own rules, such as epochs and tilde pre-releases - B. Because versions are secret - C. Because numbers are too large - D. Because only RPM has ordering rules - Answer: A. Each ecosystem defines its own ordering rules, and a naive comparison gives wrong answers. 2. Which findings should usually be fixed first? - A. Low severity - B. Vulnerabilities listed as known exploited by CISA - C. Informational findings - D. The oldest findings - Answer: B. Known exploitation is strong evidence of real risk. 3. Why does every report state the vulnerability data snapshot date? - A. For decoration - B. Because offline data cannot include vulnerabilities published after it was built - C. Because the law requires it - D. Because the data changes during the scan - Answer: B. Old data misses newer vulnerabilities, so the reader must know its age. 4. Which of these Debian versions is the oldest? - A. 1.0~rc1 - B. 1.0 - C. 1.0-1 - D. 1:0.9 - Answer: A. A tilde sorts before anything, so 1.0~rc1 comes before 1.0. The epoch in 1:0.9 makes it newer than all of them. 5. Why must matching use the distribution's own advisory data? - A. Distributions often backport fixes without changing the upstream version number - B. Upstream data is secret - C. Distributions never fix vulnerabilities - D. Advisories exist only for Debian - Answer: A. A backported fix keeps the old upstream number, so only the distribution's data knows which package version is fixed. 6. Where does a web application's library inventory come from? - A. Lock files such as composer.lock or package-lock.json - B. The web server's access log - C. Downloading the site from the internet - D. The CVE website - Answer: A. Lock files list the exact library versions the application ships. ## Key Terms - CVE: Common Vulnerabilities and Exposures: an identifier for one specific, publicly known vulnerability in a product. - CVSS: Common Vulnerability Scoring System: a standard way to rate how severe a vulnerability is, from 0.0 to 10.0. - Patch Management: The process of finding, testing and installing software updates, especially security fixes. - Software Inventory: A list of installed packages and libraries with their exact versions, the starting point for vulnerability matching. - Known Exploited Vulnerability: A vulnerability that CISA has confirmed is being used in real attacks, listed in its KEV catalogue. ## References - [OSV, Open Source Vulnerability format and database](https://osv.dev/) - [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - [Debian Policy Manual, Version numbering](https://www.debian.org/doc/debian-policy/ch-controlfields.html#version) Offline: `openvapt learn P10`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p10.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.