grype-vulnerability-analysis

Overview

Focuses on interpreting and managing vulnerability scan results. Includes "explaining" why a package was matched and using VEX (Vulnerability Exploitability eXchange) to filter out non-applicable findings.

When to Use

• Deep Investigation: Understanding why Grype thinks a package is vulnerable.
• False Positive Management: Using VEX or suppression rules for documented non-explorable findings.
• VEX Integration: Applying OpenVEX documents to filter results in CI/CD.

Core Operations

Explaining Findings

Use this to get detailed evidence for a specific CVE or vulnerability ID.

grype explain --id CVE-2023-1234

Applying VEX Documents

Filter results using external VEX metadata.

grype <target> --vex ./my-vex-doc.json

Suppression Rules

You can suppress specific vulnerabilities via the .grype.yaml configuration file or by using flags.

Manual Suppression (Flags)

# Ignore fixed vulnerabilities
grype <target> --only-notfixed

# Ignore specific severity
grype <target> --ignore-states wont-fix

Advanced Logic

When results are non-obvious, combine explain with db search to trace the package-to-vulnerability mapping.