Prisma Cloud defender agent unable to identify Red Hat back ported patches causing false positives

[GabeColonaco]

Hello,

Wanted to throw this out here to see if anyone has run into this issue and hopefully found a solution. 

I have been reviewing vulnerabilities identified by the defender agent and have noticed that it is consistently unable to detect when Red Hat has back ported a patch to specific packages. It seems, despite being Certified for Red Hat Vulnerability Scanning it is still flagging red hat patched packages as affected.https://live.paloaltonetworks.com/t5/community-blogs/prisma-cloud-offers-certified-red-hat-vulnerabi...

Hoping anyone else has run into this and has found a work around

[LMegrelis]

I would recommend opening a TAC case for further investigation. https://support.paloaltonetworks.com/

[JSpurlock]

I'm not an expert on paloalto products but I've used other vulnerability scanners. 
In most cases, a scan is unintrusive and by that nature is not testing for a specific vulnerability. 
Most likely what you're seeing is the application version number matching a known vulnerable version of the application. 
When Red Hat back ports a patch they don't increment the application version number to reflect the patch.

In this case, the application version number matches the published vulnerable version.
If I'm not mistaken, Red Hat has published information explaining this situation.