Skip to content

Commit e5adce1

Browse files
authored
Update acrolinx score
Update acrolinx score
1 parent e9051fc commit e5adce1

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

articles/marketplace/azure-container-certification-faq.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,14 @@ sections:
2626
answer: |
2727
A vulnerability is an exploitable risk and/or an unsecured entry points that can be used by malicious actors for nefarious actions.
2828
29-
Marketplace Container Certification uses MS Defender for cloud which scans images in ACR for vulnerabilties based on CVSS v3 score (Common Vulnerability Scoring System). All container products with vulnerabilities with CVSS v3 score greater than or equal to 7 are blocked. There may be rare instances where specific CVE IDs with even lower scores are blocked by certification.
29+
Marketplace Container Certification uses MS Defender for cloud, which scans images in ACR for vulnerabilties based on CVSS v3 score (Common Vulnerability Scoring System).. All container products with vulnerabilities with CVSS v3 score greater than or equal to 7 are blocked. There may be rare instances where specific CVE IDs with even lower scores are blocked by certification.
3030
Certification tries to provide remediation steps for each vulnerability so publishers can fix them.
3131
32-
You can also use MS Defender or open source/paid software such as Aqua Security, Qualys Container Security, Clair, Twist Lock for scanning your images before publishing and removing at least high and critical vulnerabilities to ensure high rate of passing.
33-
These tools are just examples of the tools available for scanning online. ISVs are free to choose any other tool which is the right fit for them (even if it is not part of the list here) as long as it identifies vulnerabilities.
32+
You can also use MS Defender or open source/paid software such as Aqua Security, Qualys Container Security, Clair, Twist Lock for scanning your images before publishing. You must remove at least high and critical vulnerabilities to ensure high rate of passing.
33+
These tools are just examples of the tools available for scanning online. ISVs are free to choose any other tool, which is the right fit for them (even if it is not part of the list here) as long as it identifies vulnerabilities.
3434
3535
>[!NOTE]
36-
>The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability, and produce a numerical score reflecting its severity, as well as a textual representation of that score. The numerical score can then be translated into a qualitative representation (such as low, medium, high, and critical) to help organizations properly assess and prioritize their vulnerability management processes.
36+
>The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability, and produce a numerical score reflecting its severity, and a textual representation of that score. The numerical score can then be translated into a qualitative representation (such as low, medium, high, and critical) to help organizations properly assess and prioritize their vulnerability management processes.
3737
3838
>[!NOTE]
3939
>There are rare scenarios where products might have excessive number of vulnerabilties and we are not able to share results for all of them in certification report. We recommend you to scan such products before publishing. You can also reach out to us at [Marketplace Publisher Support](https://aka.ms/marketplacepublishersupport) to get details in email.

0 commit comments

Comments
 (0)