Chapter 4. Known issues

A list of unresolved known issues found in this release:

Report analysis fails for RPM packages with .hum1 suffix: When you scan an RPM package with the .hum1 filename suffix (for example, mariadb-connector-c-3.4.9-1.hum1), the system generates a report with a Failed status. Currently, Exploit Intelligence does not support RPM packages with the .hum1 filename suffix. There is no workaround for this issue at this time.

Package analysis fails when an unrelated CVE ID is specified: When you analyze an RPM package for a specific CVE, and the specific CVE ID has no relation or correlation to the RPM you need to analyze, the report shows a Failed status. This does not mean that there is a system failure. There is currently no workaround for this issue.

Exploit Intelligence Operator cannot be used for RHTPA integration: The Exploit Intelligence Operator supports only OAuth-based OpenID Connect (OIDC) providers. However, RHTPA does not support OAuth authentication for the Exploit Intelligence integration. As a workaround, use the Exploit Intelligence kustomize-based deployment with a Keycloak or Cognito OIDC provider instead of the Operator.

Trustify fails to match advisories for container images identified by SHA256 digests: Trustify misinterprets container image digests (sha256:…) as sequential version numbers rather than unordered fingerprints, and attempts to store them in version ranges. Consequently, range conditions are never met, vulnerability analysis returns empty results for affected OCI packages, and Exploit Intelligence analysis fails for SPDX SBOM files. There is currently no workaround for this issue.

Trustify does not evaluate version schemes and range bounds when resolving advisories: Trustify does not evaluate advisory version schemes and range bounds when resolving product vulnerability statuses for a package URL. Consequently, non-applicable version ranges are returned, and packages past their fix version are still reported as affected. There is currently no workaround for this issue.

Trustify does not apply CPE context filtering to CSAF advisories: The product vulnerability statuses for a package URL are derived without considering a CSAF advisory’s CPE context. Consequently, advisory statuses tied to one product are applied to packages from other products. As a result, Trustify reports irrelevant RPM version ranges and reports large volumes of false-positive vulnerability rows when analyzing full SBOMs. There is currently no workaround for this issue.