Add python vapm scanner#70
Merged
Merged
Conversation
…ogic (v5) Replace the downward closure-expansion of missing KBs with the endpoint engine's calcAffectedCvesList approach: affected = direct CVEs of missing KBs minus CVEs of the older superseded KBs minus CVEs covered by installed KBs + chain. The old expansion accreted the whole historical CVE tail (every cumulative newer than the machine's build leaked in); subtracting superseded history instead fixes the over-reporting (e.g. customer 24H2 build 26100.6584: 662 -> 110). Adds forward supersedence (cumulative_kbs / appendMissingCumulKB) so a stale reported KB still surfaces the latest cumulative's CVEs. Retains the data-quality warnings; load_kb_info_for_os now also returns cumulative_kbs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ent CVEs) Centralized OS CVE mapping (detect_windows_cves) seeded its missing set only from the agent's GetMissingPatches, which reports just the latest offered cumulative. On machines several cumulatives behind, the intervening monthly cumulatives never entered the missing set, so their CVEs were dropped. Add get_missing_kbs_from_later_builds (port of the endpoint engine's getMissingKBFromBuildHistory): seed missing KBs from every kb_base build newer than the running build, the symmetric counterpart to the earlier-builds (installed) seeding, and expand those build-history KBs in the superseded subtraction so the net set stays correct. Validated against a real customer endpoint result set: recovers the full build-applicable OS CVE set (Win10 19044 build .1288: 2235 -> 2693, matching the live endpoint scan 100%) with per-month KB attribution, and is unchanged on the Win11 24H2 case. Third-party detection is unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated the map routine to discover more with CA