Skip to main content

Verify No Critical or High Vulnerabilities in Product

Type: Rule
ID: scribe-cve-product
Source: v2/rules/api/scribe-api-cve-product.yaml
Rego Source: scribe-api.rego
Labels: SCA, Blueprint, Scribe

Verify via Scribe API that there are no critical or high severity vulnerabilities in any deliverable component of the product.

tip

Evidence IS NOT required for this rule.

tip

Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the valint utility.

Usage example​

uses: api/scribe-api-cve-product@v2

Mitigation​

Ensure that all critical or high severity vulnerabilities are addressed before delivering the product.

Description​

This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API.

Input Definitions​

ParameterTypeRequiredDescription
cvearrayTrueList of CVEs to check against the product components.