Chapter 3. Viewing CVEs in the Red Hat Insights for OpenShift vulnerability dashboard to find your vulnerable OpenShift clusters and images In the CVE list view, you can assess the CVEs impacting your clusters so that you can take the appropriate actions to protect your organization. You can also focus on a single CVE by clicking on CVE ID to see details that help you understand exactly which clusters are exposed by that CVE. In the default view of the CVE list view, you are able to get details such as the following: CVE ID : Shows details about the CVE, CVE ID number Publish date : Shows the date the CVE was published Severity : Shows the severity rating (Critical, Important, Moderate, Low, or Unknown) of the CVE CVSS base score : Shows the Common Vulnerability Scoring System (CVSS) base score (0-10) Exposed clusters : Shows the number of clusters currently affected by a CVE Exposed images : Shows the number of images deployed in your clusters that are currently affected by a CVE From this view, you can filter and sort using these details to help you focus on the most critical CVEs affecting your clusters and images. Important The default view of the CVE list page shows a default filter selection of ( Exposed clusters with 1 or More clusters ). The default filters show you CVEs that affect one or more clusters in your organization. To find all CVEs, including those that do not affect any clusters reported by Red Hat Insights for OpenShift, you can click the X beside the filters to deselect the filter. Filters are persistent throughout your session in the Red Hat Hybrid Console. Additional resources Severity Ratings Official CVSS documentation 3.1. Navigating to the CVE list view You can use Red Hat Insights for OpenShift vulnerability dashboard to view CVEs affecting your organization to help you find information that helps you achieve your desired security posture. To start looking at CVEs related to your organization, you need to navigate to the CVEs listed in the Vulnerability dashboard. Prerequisites Your Red Hat account and your cluster are registered to the same organization. You have logged into the Red Hat Hybrid Cloud Console. Your cluster has been registered to Red Hat OpenShift Cluster Manager. For more information about registering clusters, see Registering OpenShift Container Platform clusters to OpenShift Cluster Manager . Your cluster has been active (Telemetry and the Insights Operator has sent data about your cluster) in the past 30 days. For more information about Telemetry and the Insights Operator, see About remote health monitoring . Procedure Navigate to the OpenShift > Vulnerability Dashboard > CVEs to view the CVEs that affect your clusters and images. If you see a message that reads, "No CVEs found," Red Hat Insights has not found any CVEs that affect your Insights for OpenShift infrastructure. 3.2. Refining the CVE list view results to protect your organization To make the most use of Red Hat Insights for OpenShift vulnerability dashboard, you can refine the CVE list view results by: Searching for a specific CVE Finding information about a specific CVE Filtering results in the CVE list view Filtering CVEs by severity Sorting results in the CVE list view 3.2.1. Searching for a specific CVE You can use the filters in the CVE list view to search for details about a CVE. Prerequisites Your Red Hat account and your cluster are registered to the same organization. You have logged into the Red Hat Hybrid Cloud Console. Your cluster has been registered to Red Hat OpenShift Cluster Manager. For more information about registering clusters, see Registering OpenShift Container Platform clusters to OpenShift Cluster Manager . Your cluster has been active (Telemetry and the Insights Operator has sent data about your cluster) in the past 30 days. For more information about Telemetry and the Insights Operator, see About remote health monitoring . Procedure Navigate to OpenShift > Vulnerability Dashboard > CVEs . Select CVE in the filter drop-down list. Enter the CVE ID you want information about (for this example, CVE-2022-2526 ) into the search field. Wait for the search results to populate (or press Return or Enter). You will see a list of CVE IDs that match what you entered in the search box. For this example, two CVEs (2022-2526 and 2022-25265) match because both contain numbers from the search. The search results also show you information about the Publish date , Severity , CVSS base score , Exposed clusters , and Exposed images related to the CVE. Click the CVE ID to get more details about the CVE. You will see details about the CVE. A list of clusters affected by the CVE show by default in the Exposed cluster tab. (Optional) Click the Exposed images tab to see information about images affected by the CVE. 3.2.2. Finding information about a specific CVE In the Insights for OpenShift vulnerability dashboard, you can click a CVE to open the CVE details view. In the details view, you can see a description of the CVE and other information, such as: CVE ID Publish date Description of the CVE Severity level CVSS base score You can also see a list of exposed clusters because the Exposed clusters tab is selected by default. The Exposed clusters tab shows how many exposed clusters are affected by the CVE. In this view you can get the following information: Name of the cluster Status of the cluster Type of cluster Version of OpenShift used Provider of the cluster, such as AWS or other Last Seen Shows the last time (in the form of minutes, hours, or days) since information was last uploaded from the cluster to the Insights for OpenShift vulnerability dashboard service. You can also get information about exposed images related to the CVE. When you click the Exposed images tab, you can get the following information: Name of the image Registry name that the image is registered to Version of the registry Clusters shows how many images that are vulnerable or exposed by the CVE in the cluster. Clicking on a number in this column will show you: Prerequisites Your Red Hat account and your cluster are registered to the same organization. You have logged into the Red Hat Hybrid Cloud Console. Your cluster has been registered to Red Hat OpenShift Cluster Manager. For more information about registering clusters, see Registering OpenShift Container Platform clusters to OpenShift Cluster Manager . Your cluster has been active (Telemetry and the Insights Operator has sent data about your cluster) in the past 30 days. For more information about Telemetry and the Insights Operator, see About remote health monitoring . Procedure Navigate to OpenShift > Vulnerability Dashboard > CVEs . Review the resulting list and find a CVE ID of interest (for example, 2022-2526). Click the CVE ID to find additional details about the CVE. Note If your clusters are not affected by the CVE, you will see the message: "No matching clusters found." 3.2.3. Filtering results in the CVE list view In the CVE list view, you can apply filters to the list of CVEs so that you can focus on specific information, such as the severity level of a CVE, or clusters in a specific version of Insights for OpenShift. After selecting an individual CVE, you can apply primary and secondary filters to the resulting list of clusters. The filters and options that you can apply are: CVE ID : Filter by ID or description. Publish date : Select from All, Last 7 days, Last 30 days, Last 90 days, Last year, or More than 1 year ago. Severity : Select one or more values: Critical, Important, Moderate, Low, or Unknown. CVSS base score : Enter a range from 0-10. Exposed clusters : Select to only show CVEs with clusters currently affected, or with no clusters affected. Prerequisites Your Red Hat account and your cluster are registered to the same organization. You have logged into the Red Hat Hybrid Cloud Console. Your cluster has been registered to Red Hat OpenShift Cluster Manager. For more information about registering clusters, see Registering OpenShift Container Platform clusters to OpenShift Cluster Manager . Your cluster has been active (Telemetry and the Insights Operator has sent data about your cluster) in the past 30 days. For more information about Telemetry and the Insights Operator, see About remote health monitoring . Procedure Navigate to OpenShift > Vulnerability Dashboard > CVEs . The default view of the CVE list view shows a default filter selection of 1 or More clusters . Select a primary filter (for example, Publish date ) from the drop-down list of filters. Select a secondary filter from the drop-down list of filters. For this example, select Last 30 days from the Filter by publish date drop-down arrow. Note Your currently selected filters are visible to help you keep track of what you are filtering. Confirm your filter selection, and then review the resulting information. This example shows CVEs from the last 30 days. If the last action results in a message indicating "No matching CVEs found," this means your clusters are not affected by any CVEs. Important Filters remain active until you deselect them or leave the Red Hat Insights for OpenShift session. Reset or deselect unneeded filters to avoid unintended results. To deactivate filters. click the X to each filter (or any default filters) you selected, as needed. 3.2.4. Filtering CVEs by severity In Red Hat Insights for OpenShift, you can filter the CVE list to show the most critical CVEs. Prerequisites Your Red Hat account and your cluster are registered to the same organization. You have logged into the Red Hat Hybrid Cloud Console. Your cluster has been registered to Red Hat OpenShift Cluster Manager. For more information about registering clusters, see Registering OpenShift Container Platform clusters to OpenShift Cluster Manager . Your cluster has been active (Telemetry and the Insights Operator has sent data about your cluster) in the past 30 days. For more information about Telemetry and the Insights Operator, see About remote health monitoring . Procedure Navigate to OpenShift > Vulnerability Dashboard > CVEs . Click the drop-down filter list. Select Severity . Click the drop-down arrow in the Filter by Severity field. Select a filter (for example, Critical ) to display all CVEs with that severity rating. Click the CVE ID to get additional information. 3.2.5. Sorting results in the CVE list view You can also sort the list of CVEs in this view to assess the most relevant information first. For example, to see all of the most critical CVEs affecting your clusters and images, sort by the severity or CVSS base score. You can sort the CVE page results by these columns: CVE ID Publish date Severity CVSS base score Exposed clusters Exposed images Prerequisites Your Red Hat account and your cluster are registered to the same organization. You have logged into the Red Hat Hybrid Cloud Console. Your cluster has been registered to Red Hat OpenShift Cluster Manager. For more information about registering clusters, see Registering OpenShift Container Platform clusters to OpenShift Cluster Manager . Your cluster has been active (Telemetry and the Insights Operator has sent data about your cluster) in the past 30 days. For more information about Telemetry and the Insights Operator, see About remote health monitoring . Procedure Navigate to OpenShift > Vulnerability Dashboard > CVEs . Click the sort arrow to the column heading of the column you want to sort.

Commands: