Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
COS menyediakan feed kerentanan Open Vulnerability and Assessment Language (OVAL), yang
adalah set data terstruktur yang dapat dibaca mesin untuk semua rilis COS yang didukung. Anda dapat menggunakan
feed untuk mengevaluasi paket yang diinstal di sistem COS untuk masalah keamanan.
Anda dapat mengakses feed OVAL di gs://cos-oval-vulnerability-feed.
Feed bergantung pada file cos-package-info.json, yang mencantumkan paket yang diinstal pada
image. File ini terletak di direktori /etc pada instance VM Anda.
Memindai instance VM COS dengan feed Oval
Anda dapat menggunakan feed OVAL untuk memindai instance COS apa pun. Misalnya, Anda ingin memindai
instance yang menjalankan image COS-109:
Download feed Oval untuk instance Anda. Pastikan Anda memilih tonggak pencapaian yang benar.
Untuk contoh saat ini, nilainya adalah 109:
Gunakan alat yang sesuai dengan Security Content Automation Protocol (SCAP) pilihan Anda yang dapat memproses feed Oval. Dalam hal ini, kita menggunakan OpenSCAP:
Perhatikan bahwa file cos-package-info.json dan feed COS Oval harus berada di direktori yang sama. Jika tidak, perbarui jalur cos-package-info.json di file feed COS Oval.
Cara memperbaiki kerentanan yang dilaporkan oleh pemindai
Feed ini mencantumkan semua kerentanan yang diperbaiki dalam image COS terbaru. Dengan demikian,
Anda dapat memperbaiki semua kerentanan terbuka yang dilaporkan oleh pemindai di sistem dengan
memperbarui ke image COS terbaru untuk tonggak pencapaian tertentu tersebut.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eCOS provides an Open Vulnerability and Assessment Language (OVAL) feed, a structured dataset for identifying security vulnerabilities in supported COS releases.\u003c/p\u003e\n"],["\u003cp\u003eThe OVAL feed, accessible at \u003ccode\u003egs://cos-oval-vulnerability-feed\u003c/code\u003e, relies on the \u003ccode\u003ecos-package-info.json\u003c/code\u003e file, which lists installed packages on an image and is located in the \u003ccode\u003e/etc\u003c/code\u003e directory.\u003c/p\u003e\n"],["\u003cp\u003eScanning a COS instance involves downloading and extracting the OVAL feed for the specific milestone, copying the \u003ccode\u003ecos-package-info.json\u003c/code\u003e file from the VM, and using an SCAP-compliant tool like OpenSCAP.\u003c/p\u003e\n"],["\u003cp\u003eVulnerabilities reported by the scanner can be resolved by updating to the latest COS image for the applicable milestone, as the feed lists vulnerabilities fixed in these images.\u003c/p\u003e\n"]]],[],null,["# Scanning COS images with Oval vulnerability feed\n\nCOS provides an Open Vulnerability and Assessment Language (OVAL) vulnerability feed, which\nis a structured, machine-readable dataset for all supported COS releases. You can use the\nfeed to evaluate packages installed on a COS system for security issues.\n\nYou can access the OVAL feed at `gs://cos-oval-vulnerability-feed`.\nThe feed depends on the `cos-package-info.json` file, which lists installed packages on an\nimage. This file is located at `/etc` directory on your VM instances.\n\nScanning COS VM instances with Oval feed\n----------------------------------------\n\nYou can use the OVAL feed to scan any COS instance. For example, assume you want to scan\nan instance running the `COS-109` image:\n\n1. Download the Oval feed for your instance. Make sure you choose the correct milestone.\n For the current example, it is 109:\n\n gcloud storage cp gs://cos-oval-vulnerability-feed/cos-109.oval.xml.tar.gz .\n\n2. Extract the downloaded Oval feed:\n\n tar xf cos-109.oval.xml.tar.gz\n\n3. Copy `cos-package-info.json` from your VM instance, in this case `my-cos-instance`:\n\n gcloud compute scp my-cos-instance:/etc/cos-package-info.json .\n\n4. Use your preferred Security Content Automation Protocol (SCAP) compliant tool that can process Oval feed. In this case, we use `OpenSCAP`:\n\n oscap oval eval --report report.html cos-109.oval.xml\n\nNote that the `cos-package-info.json` file and the COS Oval feed need to be in the same\ndirectory. If not, update the path of the `cos-package-info.json` in the COS Oval feed file.\n\nHow to fix vulnerabilities reported by the scanner\n--------------------------------------------------\n\nThe feed lists all the vulnerabilities fixed in the latest COS image. As such,\nyou can fix all open vulnerabilities reported by the scanner on your system by\nupdating to the latest COS image for that particular milestone."]]
