For Teachers · Back to the Module · Print with your browser's Print command.

P10 Worksheet: Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities

Student Worksheet (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: F3

Learning Objectives

• [ ] Explain how a package inventory is matched against vulnerability data.
• [ ] Explain why Debian, RPM and semantic versions must be compared with their own rules.
• [ ] Prioritise findings using severity and known exploitation.

Key Terms

Write each definition in your own words.

• CVE: ______________________________________________
• CVSS: ______________________________________________
• Patch Management: ______________________________________________
• Software Inventory: ______________________________________________
• Known Exploited Vulnerability: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt vulndb and note the snapshot date and whether it is test data.
2. Run: openvapt demo --only HOST-CVE-,WEB-CVE- --out p10 and read how each finding names the installed and fixed version.
3. Read internal/vulndb/review_test.go and explain why 1.0~rc1 is older than 1.0.

Self-Check Questions

1. Why can't versions be compared as plain numbers?

• [ ] a) Because ecosystems such as Debian and RPM have their own rules, such as epochs and tilde pre-releases
• [ ] b) Because versions are secret
• [ ] c) Because numbers are too large
• [ ] d) Because only RPM has ordering rules

1. Which findings should usually be fixed first?

• [ ] a) Low severity
• [ ] b) Vulnerabilities listed as known exploited by CISA
• [ ] c) Informational findings
• [ ] d) The oldest findings

1. Why does every report state the vulnerability data snapshot date?

• [ ] a) For decoration
• [ ] b) Because offline data cannot include vulnerabilities published after it was built
• [ ] c) Because the law requires it
• [ ] d) Because the data changes during the scan

1. Which of these Debian versions is the oldest?

• [ ] a) 1.0~rc1
• [ ] b) 1.0
• [ ] c) 1.0-1
• [ ] d) 1:0.9

1. Why must matching use the distribution's own advisory data?

• [ ] a) Distributions often backport fixes without changing the upstream version number
• [ ] b) Upstream data is secret
• [ ] c) Distributions never fix vulnerabilities
• [ ] d) Advisories exist only for Debian

1. Where does a web application's library inventory come from?

• [ ] a) Lock files such as composer.lock or package-lock.json
• [ ] b) The web server's access log
• [ ] c) Downloading the site from the internet
• [ ] d) The CVE website

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OSV, Open Source Vulnerability format and database: https://osv.dev/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Debian Policy Manual, Version numbering: https://www.debian.org/doc/debian-policy/ch-controlfields.html#version

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.