Vulnerability management overview

When vulnerability reporting is enabled, Red Hat Edge Manager correlates Red Hat CVE and errata data with the bootc operating system images that devices report. You can assess risk per device, per fleet, or across the entire estate.

How vulnerability reporting works
Copy link

At a configurable interval (default: every 15 minutes), the flightctl-periodic service:

  1. Collects the distinct operating system image digests reported in device status across enrolled devices.
  2. Queries the Red Hat Trusted Profile Analyzer API to resolve each digest to its SBOM and associated advisories.
  3. Stores the results in the Red Hat Edge Manager database, keyed by image digest and CVE ID.

The API, CLI, and web console display the stored findings. Vulnerability data reflects the image digest a device reports in status.os.imageDigest, not on-device runtime scanning.

For High and Critical findings, the periodic service can also record CVE lifecycle events; see CVE lifecycle events in the Additional resources section.

Prerequisites

  • A running Red Hat Trusted Profile Analyzer instance that the flightctl-periodic service can reach over the network.
  • The Red Hat Trusted Profile Analyzer API base URL (for example, rhtpa.example.com).
  • If Red Hat Trusted Profile Analyzer requires authentication, an OIDC issuer URL and OAuth2 client credentials for a client-credentials grant. Alternatively, a deployment that allows unauthenticated access in non-production environments.
  • Software bill of materials (SBOM) or advisory data in Red Hat Trusted Profile Analyzer for the image digests your devices run. The Red Hat Edge Manager image builder generates compliant SBOMs automatically. You can also import SBOMs from CI/CD; see SBOM requirements for Red Hat Trusted Profile Analyzer in the Additional resources section.

Scope and limitations
Copy link

Vulnerability reporting in release 1.3:

  • Reports vulnerabilities associated with the bootc operating system image digest on each device.
  • Uses Red Hat security data surfaced through Red Hat Trusted Profile Analyzer (CVEs and errata such as Red Hat Security Advisories (RHSAs)).
  • Does not perform on-device runtime scanning.
  • Does not trigger automated remediation or image updates when the system detects a CVE.

For severity definitions, see Red Hat security rating classification on the Red Hat Customer Portal.