Exploring Container Vulnerability Response

  • Release version: Yokohama
  • Updated January 30, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Exploring Container Vulnerability Response

    The Container Vulnerability Response application enables ServiceNow customers to import and remediate container vulnerable items (CVITs) through configurable rules. Accessible via a separate subscription, it addresses security risks in containerized applications by focusing on vulnerabilities found in container images deployed in production environments.

    Show full answer Show less

    Containers package application source code and dependencies into container images, which are then published to registries and run as container instances on various platforms. The application supports vulnerability scanning both before deployment (pre-deployment) and after deployment (post-deployment), with post-deployment scanning providing more targeted and actionable insights for production images.

    Key Features

    • Container Image Lifecycle Support: Tracks container images from composition and build through publishing and runtime deployment.
    • Post-Deployment Vulnerability Scanning: Focuses on vulnerabilities in containers running in production to prioritize immediate remediation efforts effectively.
    • Container Components Management: Differentiates and manages container repositories, individual docker image versions, and running container instances, each with unique identifiers.
    • Container Vulnerable Items (CVITs): Groups vulnerabilities based on assignment, criticality, exploitability, and remediation status for streamlined management.
    • Libraries Integration: Provides access to the National Vulnerability Database (NVD) for basic vulnerability IDs and third-party libraries for detailed vulnerability information.
    • Administration Module: Allows configuration of assignment rules, remediation targets, integration settings, and auto-closure timing for vulnerable items. It also enables customization of CVIT granularity by defining key combinations involving image repository, tags, vulnerabilities, and clusters.

    Practical Benefits for Customers

    • Gain comprehensive visibility into container vulnerabilities specifically within your production environment, enabling focused risk management.
    • Prioritize and remediate vulnerabilities efficiently by leveraging metadata-based grouping and assignment rules.
    • Customize vulnerability tracking granularity to align with your organizational structure and operational needs.
    • Integrate vulnerability data from authoritative sources to enhance the detail and accuracy of vulnerability information.

    Additional Information

    The solution is available in multiple release versions (e.g., v2.12, v2.13) with documented compatibility matrices and release notes to assist customers in maintaining up-to-date and compatible deployments.

    The Container Vulnerability Response application imports container vulnerable items (CVITs). According to the rules, the feature enables you to remediate the container vulnerabilities. Container Vulnerability Response is available through a separate subscription.

    Unlike traditional applications, containers package all the application source codes along with their dependencies into a binary file called a container image. The image is published to a registry to provide an option to run this image as an application or a container instance on any platform. The stages in a container pre-deployment life cycle are as follows:
    1. Compose the container image: The container image is composed and pointed to a source code or a dependent library.
    2. Build the container image
    3. Publish the container image: The container image file is published to a registry. Each image has its own unique ID based on the contents of the image. These images are pulled from the registry into the run-time environment in post-deployment mode. The images then run as container instances on the host in the production environment.

    Scanning container images

    A container image can be scanned for vulnerabilities either before or after deployment. If container images are scanned during the pre-deployment phase, you may get many vulnerability alerts, which may not need your immediate attention. However, scanning for vulnerabilities during the post-deployment phase provides greater benefits, such as the following:
    • Providing visibility on the risk associated with the deployed applications.
    • Providing a focused view on only the images in the production environment.
    • Identifying and prioritizing the vulnerabilities that must be acted on immediately.
    • Grouping and assignment of vulnerabilities based on the metadata of the image. For example, an image repository, an image label, and other attributes related to the container image can be used for grouping and assignment rules.
    Each container image has the following key components:
    • Container or image repository: Represents the docker image with a given repository or name. It hosts all the versions of the image.
    • Docker image: Represents a specific version of the build docker image.
    • Docker container: Represents a running instance of the docker image. Each version has a unique ID and has multiple instances of the containers running in the production environment.

    Container Vulnerability Response modules

    The Container Vulnerability Response module provides details on the following:
    Container Vulnerable Items
    The container vulnerable items (CVITs) are grouped and listed based on assignment, criticality, exploitability, and remediation status.
    Libraries
    Get access to the National Vulnerability Database (NVD) and third-party libraries. While the NVD library provides information limited to vulnerability item ID, the third-party library provides most of the details on a vulnerability item. Information in the NVD screen is populated only when the NVD integration is triggered.
    Administration
    The Administration module provides information on the vulnerable items' assignment rules, remediation target rules, and container vulnerability integrations. In addition, you can also configure the duration after which a vulnerable item should be auto closed. You can use the Configure VI Granularity section to configure the granularity of CVITs by specifying the key combinations. By default, a CVIT is created for a combination of an image repository, an image tag, and a vulnerability. You can add additional components to the key for further granularity. For example, you can create a CVIT for a combination of image repository, image tag, vulnerability, and cluster.

    Available versions

    Release version Release Notes

    Container Vulnerability Response v2.13, v2.12

    		 Container Vulnerability Response release notes

    For compatibility information, see KB0856498 Vulnerability Response Compatibility Matrix and Release Schema Changes.