topic Re: Cortex XDR on Ubuntu doesn't recognise vulnerabilities correctly in Cortex XDR Discussions

Cortex XDR on Ubuntu doesn't recognise vulnerabilities correctly

Piotr_Kowalczyk — Tue, 15 Aug 2023 10:39:29 GMT

Hi,

Cortex XDR agent (version 8.1.0.107064) installed on fully patched Ubuntu server 22.04 doesn’t recognise vulnerabilities correctly. It shows over 330 false positives.

Some examples below:

CVE-2015-34-5 – ntp vulnerable version prior 4.2.8p2-RC2 – recently installed 4.2.8p15

CVE-2019-13638 – patch vulnerable version 2.7.6 – recently installed 2.7.6-7build2 which has the CVE fixed.

CVE-2022-0318 – vim vulnerable version up to (excluding) 8.2.4151 – installed version: 8.2.4919

Could you help with this please?

Re: Cortex XDR on Ubuntu doesn't recognise vulnerabilities correctly

PiyushKohli — Tue, 15 Aug 2023 13:58:49 GMT

Hi @Piotr_Kowalczyk

Thank you for writing to live community!

Cortex XDR calculates CVEs for applications according to the application version, and not according to application build numbers.

Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Vulnerability-Assessment

Hope this helps and clarifies!

Please mark the response as "Accept as Solution" if it answers your query.

Re: Cortex XDR on Ubuntu doesn't recognise vulnerabilities correctly

Piotr_Kowalczyk — Tue, 15 Aug 2023 14:40:43 GMT

Thanks you for this information.

Although it explains the behaviour, sadly it makes the functionality useless.