cveDECK

Distributions

The Linux distributions people actually run

CveDeck connects over SSH, reads the package inventory, and matches it against advisories for that distribution and release. Nothing is installed on the host.

U1 · Supported

Inventory parsing and advisory matching

  • Debian
  • Ubuntu
  • Raspbian
  • RHEL
  • CentOS
  • AlmaLinux
  • Rocky Linux
  • Oracle Linux
  • Amazon Linux
  • Fedora
  • Alpine
  • Arch
  • openSUSE
  • SLES
  • Wolfi
  • Chainguard

A distribution without its own OSV.dev tracker is matched against the upstream it derives from. An unrecognised Linux system is queried against every Linux ecosystem CveDeck knows, rather than guessing at a single answer.

Windows hosts can't be scanned. They can be discovered and enrolled, but scans are refused, because Windows inventory can't be matched against vulnerability data yet. Why it refuses rather than guesses.

U2 · Matching

Matched against the right advisories

  • Release-specific. The distribution and release come from the host's /etc/os-release. An Ubuntu host is checked against Ubuntu's tracker for its release, so a Debian fix version never shows up on an Ubuntu machine just because both use .deb.
  • Binary and source package names. Libraries often install under a different name from their source package, such as libssl3 from openssl. Both names are checked, so those findings aren't missed.
  • No borrowed fixes. When one advisory covers several related packages, a fix version published for one package is never assigned to another.
  • Epoch-aware versions. Debian and RPM version epochs (the 2: in 2:1.2.3-1) are handled, so advisories match whether or not they include one.
  • One record per CVE. An advisory that resolves several CVEs at once becomes a separate finding for each, so every CVE can be traced.
U3 · Remediation

What you can actually fix

Flagging a CVE that has no patch in the host's repository just produces an upgrade that upgrades nothing. CveDeck splits findings three ways.

  • Patch available

    The target's repository has a fixed build. CveDeck shows the fixed version and generates the upgrade command for that host's package manager (apt, dnf, apk, pacman or zypper), plus one script covering every fixable package on the host.

  • Pending vendor patch

    The vendor has acknowledged the CVE but hasn't released a fixed build yet. No upgrade command is offered.

  • Cleared

    The installed version is at or above the fixed version. The finding clears on the next scan.

Commands are generated for you to review and run. CveDeck never executes anything on a target. A dependency explorer shows which installed applications rely on a package, so a removal doesn't take a service down with it.

U4 · Collection

Read-only, over SSH

  • Authenticates with a password or an Ed25519, ECDSA or RSA key. Keys sent with a request are parsed in memory and never written to disk.
  • Runs read-only commands only, so a dedicated unprivileged account works, with no sudo and no write access.
  • Also reads the running kernel and pending-reboot state, so a patched host still running an old kernel isn't reported as clean.
  • Subnet discovery sweeps (ICMP, TCP connect and unauthenticated SSH, HTTP and SMB banner reads) find hosts to enrol, and send no credentials.