> ## Documentation Index > Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Common Vulnerabilities and Exposures (CVEs) Business or Custom plans only ## What are CVEs? CVEs are weaknesses in software that can be exploited to access sensitive information, such as credit card numbers or social security numbers. Because modern software is complex with its many layers, interdependencies, data inputs, and libraries, vulnerabilities tend to emerge over time. Knowing when and how the code you use is vulnerable to attacks is a powerful tool in allowing you to mitigate the potential for harm, and Anaconda provides you with everything you need to keep your pipeline secure. > [!TIP] > > To access Anaconda's curated CVE data programmatically, use the [Advisory API](https://anaconda.com/docs/anaconda-platform/admin/advisory-api/advisory-api). ## Why trust Anaconda? Anaconda regularly pulls its CVE databases from the National Vulnerability Database (NVD) and the US National Institute of Standards and Technology (NIST) to minimize the risk of vulnerable software in our applications and web pages. Anaconda has an extensive and well-established process for curating CVEs, assessing whether or not packages (Software files and information about the software, such as its name, version, and description, bundled into a file that can be installed and managed by a package manager.) Anaconda built are affected by any CVEs, determining which versions in our repository (Any storage location from which software or software assets, like packages, can be retrieved and installed on a local computer.) are affected, and mitigating the vulnerability. ## Understanding CVEs Here's what you need to know to make the right decisions regarding CVEs for your organization: ### Common Vulnerability Scoring System (CVSS) Standards for determining the severity of a CVE have evolved over time. The [Common Vulnerability Scoring System (CVSS)](https://www.first.org/cvss/) is a mathematical method dating back to 1999 that grades the characteristics of a vulnerability. CVSS 2 was developed and launched in 2007. It was later updated to CVSS 3 in 2015 to offer a more comprehensive scoring method that accurately reflects the severity of vulnerability in the real world. ### CVE scores Software developers refer to CVE databases and scores to minimize the risk of using vulnerable components (packages and binaries) in their applications or web pages. CVE scores and ratings fall into one of 5 categories: ![CVE score meter showing severity levels](https://mintcdn.com/anaconda-29683c67/ghAcs1Rv_eiLtpni/images/anaconda-platform/cve_score_meter.png?fit=max\&auto=format\&n=ghAcs1Rv_eiLtpni\&q=85\&s=90d7e235ab650608b49c865bb11663cc) ### CVE statuses CVEs are assigned a status category as a result of the Anaconda curation process. CVE status categories include: * **Reported**: The vulnerabilities identified in this package have been reported by NIST but not reviewed by the Anaconda team. * **Active**: The vulnerabilities identified in this package are active and potentially exploitable. * **Cleared**: The vulnerabilities identified in this package have been analyzed and determined not to be applicable. * **Mitigated**: The vulnerabilities identified in this package have been proactively mitigated in this build through a code patch. * **Disputed**: The vulnerabilities' legitimacy is disputed by upstream package maintainers or other community members. ## Viewing CVEs > [!NOTE] > > * Not all CVEs present in a package apply to every file within that package. > * Files can be associated with multiple CVEs. > [tab] Channel CVEs > > 1. From the **Channels** page, select a channel to view its packages. > 2. Click the **CVEs** tab to view a full list of CVEs present in the channel. A summary of how many CVEs are associated with packages in the channel and the CVEs' severity levels are displayed at the top. > > > [!TIP] > > > > Select a tile at the top of the list to filter CVEs by severity level. Only one severity level filter can be applied at a time. > > > > *** > > > > Use the navigation controls at the bottom to browse CVEs associated with packages in the channel. > > ![CVEs affecting a channel](https://mintcdn.com/anaconda-29683c67/XTSpR8a-Sn-FW1SQ/images/anaconda-platform/ap_cve_details_channel_view.png?fit=max\&auto=format\&n=XTSpR8a-Sn-FW1SQ\&q=85\&s=19032993ebcd90a30519d1e73a72b5b7) > [tab] Package CVEs > > 1. From the **Channels** page, select a channel to view its packages. > 2. Select a package from the list. > 3. Click the **CVEs** tab to view a list of CVEs associated with the package. A summary of how many CVEs are associated with the package and their severity level is displayed at the top. > > > [!TIP] > > > > Select a tile at the top of the list to filter CVEs by severity level. Only one severity level filter can be applied at a time. > > > > *** > > > > Use the navigation controls at the bottom to browse CVEs associated with the package. > > ![CVEs affecting a package](https://mintcdn.com/anaconda-29683c67/XTSpR8a-Sn-FW1SQ/images/anaconda-platform/ap_cve_details_package_view.png?fit=max\&auto=format\&n=XTSpR8a-Sn-FW1SQ\&q=85\&s=2269245de95fc663e1a4031264bbdb45) > [tab] File CVEs > > 1. From the **Channels** page, select a channel to view its packages. > 2. Select a package from the list. > 3. Click the CVE score displayed beside the package file to view a list of CVEs associated with the file. > > > [!TIP] > > > > Select the tiles at the top of the list to filter CVEs by score severity and status. > > > > *** > > > > Only one filter of each type can be applied at a time. > > > [!NOTE] > > > > The `active` CVE status filter is applied by default. > > ![CVEs affecting a package file](https://mintcdn.com/anaconda-29683c67/XTSpR8a-Sn-FW1SQ/images/anaconda-platform/ap_cve_details_file_view.png?fit=max\&auto=format\&n=XTSpR8a-Sn-FW1SQ\&q=85\&s=f6f61a29305da6c6c4aec34ca1d47911) > [!TIP] > > Search for a CVE by entering its name into the **Search cves** field. If no matches are returned, the CVE does not affect the channel/package/file. ## Viewing CVE information Select a CVE from the Channel or Package **CVEs** lists to open the CVE Information panel. Here you can view a brief overview of the vulnerability with notes that were created during the Anaconda curation process, as well as its CVSS 2/CVSS 3 score metrics. ![CVE information panel](https://mintcdn.com/anaconda-29683c67/XTSpR8a-Sn-FW1SQ/images/anaconda-platform/ap_cve_info_panel.png?fit=max\&auto=format\&n=XTSpR8a-Sn-FW1SQ\&q=85\&s=f4da4b86983144e2bf7384f4234be651) > [!TIP] > > Click to expand the CVE Information panel to full screen. Click the **CVE Files** tab to view information for every occurrence of the CVE across all channels within the organization. ![CVE files list](https://mintcdn.com/anaconda-29683c67/XTSpR8a-Sn-FW1SQ/images/anaconda-platform/ap_cve_files_list.png?fit=max\&auto=format\&n=XTSpR8a-Sn-FW1SQ\&q=85\&s=85336cf715335bc75116e560f4b4f462) ## Dealing with CVEs CVEs can pose security risks to your environments (A self-contained, isolated space for installing and running software packages.) and your organization. Understanding how to identify and mitigate these vulnerabilities is essential for maintaining secure systems. Packages can be associated with more than one CVE, and CVEs can be associated with multiple different packages, meaning that over time, maintaining an environment can sometimes turn into navigating a maze of dependencies, vulnerabilities, and package conflicts. > [accordion] How can I tell if an environment is affected by a CVE? > > You can scan your local environments for CVEs using `anaconda-audit`. For more information on obtaining `anaconda-audit`, see [Enabling environments](https://anaconda.com/docs/anaconda-platform/user/environments.md#enabling-environments). > > If you are an administrator, you can instruct your members to register their environments with your organization. Once registered, all newly created environments will be logged, scanned for CVEs, and displayed in Package Security Manager (Cloud). For more information on registering environments with your organization, see [Enabling environments](https://anaconda.com/docs/anaconda-platform/user/environments.md#enabling-environments). > > > [!TIP] > > > > Use `conda info --envs` to find your conda environments. > > > [tab] Scanning locally > > > > Use `anaconda-audit` to scan a local environment. > > > > To scan an environment, open Anaconda Prompt (A command-line application included with Windows installations of Anaconda Distribution and Miniconda. Find it by searching 'Anaconda Prompt' in the Windows Start menu.) (Terminal on macOS/Linux) and run the following command: > > > > ```sh theme={null} > > anaconda audit scan --name > > ``` > > > > Comments > > > > Replace \ with the name of the environment you want to scan. > > > > > [!NOTE] > > > > > > This command uses the default conda environment path prefix. If you have environments in non-default locations, you can use the `--prefix` flag to specify the path to the environment. For example: > > > > > > ```sh theme={null} > > > anaconda audit scan --prefix /path/to/env/ > > > ``` > > > > > > Comments > > > > > > Replace \ with the name of the environment you want to scan. > > > > To scan an environment for a specific CVE: > > > > > [tab] Windows > > > > > > Open Anaconda Prompt (A command-line application included with Windows installations of Anaconda Distribution and Miniconda. Find it by searching 'Anaconda Prompt' in the Windows Start menu.) and run the following command: > > > > > > ```sh theme={null} > > > anaconda audit scan --prefix /path/to/env/ | findstr "" > > > ``` > > > > > > Comments > > > > > > Replace \ with the name of the environment you want to scan. > > > Replace \ with the name of the CVE you want to check for. > > > > > [tab] macOS/Linux > > > > > > Open a terminal and run the following command: > > > > > > ```sh theme={null} > > > anaconda audit scan --prefix /path/to/env/ | grep > > > ``` > > > > > > Comments > > > > > > Replace \ with the name of the environment you want to scan. > > > Replace \ with the name of the CVE you want to check for. > > > > The audit scan returns a list of environment packages, and displays the following information for each package: > > > > * Version number > > * Build number > > * Source channel > > * CVE curation status > > * CVSS score > > * CVE status > > > > A summary of the scan results is displayed at the end of the scan that shows a matrix of the number of CVEs and their statuses by severity level. > > > > ![](https://mintcdn.com/anaconda-29683c67/XTSpR8a-Sn-FW1SQ/images/anaconda-platform/anaconda_audit_scan_summary.png?fit=max\&auto=format\&n=XTSpR8a-Sn-FW1SQ\&q=85\&s=c180d358a19cad040a63fd611f94dcab) > > > > Scan results are color coded to help you identify the CVE severity, and a checkmark is displayed beside a CVE name to indicate that it has undergone Anaconda curation. CVEs that are stricken through have a status of cleared and are safe to use in your environment. > > > [tab] Scanning from your organization > > > > Scan an environment that has been logged with an organization to get an updated list of CVEs associated with the packages in the environment: > > > > 1. Select **Environments** from the left-hand navigation. > > 2. Select the environment you want to scan from the list. > > 3. Click **Update Scan**. > > > > ![Update scan button](https://mintcdn.com/anaconda-29683c67/XTSpR8a-Sn-FW1SQ/images/anaconda-platform/ap_env_scan_in_cloud.png?fit=max\&auto=format\&n=XTSpR8a-Sn-FW1SQ\&q=85\&s=d6c345b2cd22163d3eb6a10271067a6e) > [accordion] What actions can I take if I find a vulnerable package? > > If you discover a package in your environment is associated with a CVE, you can: > > * **Upgrade the package**: Update to a newer version that has fixed the vulnerability. > * **Downgrade the package**: If a previous version exists without the vulnerability, you can choose to downgrade. This might come with a loss of functionality, however. *Exercise caution when downgrading packages.* > * **Remove the package**: If the package is not critical to your workflow, you can remove it. > * **Contact your administrator**: If you're unsure about the best course of action, consult your organization's administrator. > > Administrators can also enforce security standards by [blocking environments](https://anaconda.com/docs/anaconda-platform/admin/environments.md#blocking-environments) that contain critical vulnerabilities from use. > [accordion] Upgrading my package created a dependency conflict! > > Package dependency conflicts can occur when upgrading or downgrading a package to mitigate a vulnerability. For help managing dependency conflicts, see [Managing solver errors](https://anaconda.com/docs/getting-started/working-with-conda/packages/solver-errors.md).