Docker Scout's Package Repositories, Security Trackers, and Vulnerability Matching

Docker Scout uses the following package repositories and security trackers:  - [AlmaLinux Security Advisory](https://errata.almalinux.org/) - [Alpine secdb](https://secdb.alpinelinux.org/) - [Amazon Linux Security Center](https://alas.aws.amazon.com/) - [Bitnami Vulnerability Database](https://github.com/bitnami/vulndb) - [CISA Known Exploited Vulnerability Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - [CISA Vulnrichment](https://github.com/cisagov/vulnrichment) - [Chainguard Security Feed](https://packages.cgr.dev/chainguard/osv/all.json) - [Debian Security Bug Tracker](https://security-tracker.debian.org/tracker/) - [Exploit Prediction Scoring System (EPSS)](https://api.first.org/epss/) - [GitHub Advisory Database](https://github.com/advisories/) - [GitLab Advisory Database](https://gitlab.com/gitlab-org/advisories-community/) - [Golang VulnDB](https://github.com/golang/vulndb) - [National Vulnerability Database](https://nvd.nist.gov/) - [Oracle Linux Security](https://linux.oracle.com/security/) - [Photon OS 3.0 Security Advisories](https://github.com/vmware/photon/wiki/Security-Updates-3) - [Python Packaging Advisory Database](https://github.com/pypa/advisory-database) - [RedHat Security Data](https://www.redhat.com/security/data/metrics/) - [Rocky Linux Security Advisory](https://errata.rockylinux.org/) - [RustSec Advisory Database](https://github.com/rustsec/advisory-db) - [SUSE Security CVRF](http://ftp.suse.com/pub/projects/security/cvrf/) - [Ubuntu CVE Tracker](https://people.canonical.com/~ubuntu-security/cve/) - [Wolfi Security Feed](https://packages.wolfi.dev/os/security.json) - [inTheWild, a community-driven open database of vulnerability exploitation](https://github.com/gmatuz/inthewilddb)  When you enable Docker Scout for your Docker organization, a new database instance is provisioned on the Docker Scout platform. The database stores the Software Bill of Materials (SBOM) and other metadata about your images. When a security advisory has new information about a vulnerability, your SBOM is cross-referenced with the CVE information to detect how it affects you. For more details on how image analysis works, see the [image analysis page](/manuals/scout/explore/analysis.md). ## Vulnerability matching Traditional tools often rely on broad [Common Product Enumeration (CPE)](https://en.wikipedia.org/wiki/Common_Platform_Enumeration) matching, which can lead to many false-positive results. Docker Scout uses [Package URLs (PURLs)](https://github.com/package-url/purl-spec) to match packages against CVEs, which yields more precise identification of vulnerabilities. PURLs significantly reduce the chances of false positives, focusing only on genuinely affected packages. ## Supported package ecosystems Docker Scout supports the following package ecosystems: - .NET - GitHub packages - Go - Java - JavaScript - PHP - Python - RPM - Ruby - `alpm` (Arch Linux) - `apk` (Alpine Linux) - `deb` (Debian Linux and derivatives)

Docker Scout utilizes numerous package repositories and security trackers, including AlmaLinux, Alpine, Amazon Linux, Bitnami, CISA, Chainguard, Debian, EPSS, GitHub, GitLab, Golang, NVD, Oracle Linux, Photon OS, Python, RedHat, Rocky Linux, RustSec, SUSE, Ubuntu, and Wolfi. It provisions a database storing SBOM and metadata, cross-referencing it with CVE information. Docker Scout uses PURLs instead of CPE matching for precise vulnerability identification and supports various package ecosystems like .NET, GitHub packages, Go, Java, JavaScript, PHP, Python, RPM, Ruby, alpm, apk, and deb.