Hi, is it possible that overnight there are all these vulnerabilities on all software and all hosts? could it be a false alarm?

Was that thunderbird vulnerability auto added to from Fleet? I am not recognizing it on our sandbox so not sure where it came from, looks false-positive to me

How do I delete all vulnerabilities from db, to see if they reappear with the next device fetch?

you can delete all software & vuln data and let it repopulate on the next interval:

DELETE FROM host_software_installed_paths;
DELETE FROM host_software;
DELETE FROM software_host_counts;
DELETE FROM software_cpe;
DELETE FROM software;

Hey @Ibra. How are things looking on this now?

done the delete, and re-fetched my location, and I don't detect vulnerabilities, I'm waiting for the next interval

I'll keep an eye on this in case we need to get a ticket going.

thanks @Kathy Satterlee, but now i have another problem, i can't connect the smtp: it tells me "Could not connect to SMTP server. Please try again" both trying with gmail and the corporate mail server, how do I configure mailhog or install postfix in the fleet container, to send emails externally? currently fleet has created the following 3 containers: fleet, fleet_redis, fleet_mailhog Thank you

I know gmail can be a bit tricky. For mailhog, I'd take a look at the mailhog server logs to see if there's any information there about why the request isn't going through.

doing docker log -f on the Fleet_mailhog container I see nothing, doing it on the Fleet container instead, I see the following error: {"component": "http", "err": "validation failed: SMTP Options a mail error occurred: sending mail: could not dial smtp host: SMTP connection error: read tcp 172.21.0.3:59066->35.152.65. 126465 i/o timeout", "level": "error", "method": "PATCH", "take": "30. 002711261s", "ts": "2023-10-02T143644.872109915Z", "uri":"/api/latest/fleet/config", "user": "iali@experim.it", "uuid": "12fe7dc1-f1db-491d-a8ad-58f7585a7237"}

could not dial smtp host:

It looks like the Fleet server is unable to reach the smtp server. Double-check that the address is entered correctly and that the port is accessible.

the port is accessible, because doing telnet from the server where the docker container is located works, but doing it from the container gives me this error: [root@itl-cslapp-67 ~]# docker exec Fleet telnet smtps.experim.it 465 OCI runtime execution failed: exec failed: unable to start container process: exec: "telnet": executable file not found in $PATH: unknown [root@itl-cslapp-67 ~]#

I imagine that this is related to the software wrapper. Can you share the response being sent from the Fleet API for that piece of software? You can grab that either by opening the developer console in your browser and checking the network tab, then clicking on the software name to go to the detail page and checking the response in the console or by hitting the software endpoint directly:

{{server-url}}/api/latest/fleet/software/{{id}}

@Kathy Satterlee here are some examples: { "software": { "id": 7554, "name": "Google Chrome", "version": "117.0.5938.92", "source": "programs", "vendor": "Google LLC", "generated_cpe": "cpe2.3a:google:chtove:117.0.5938.92: : :/: : indovs/ ", "vulnetaiblities": " { "cve": "CVE-2023-5186", "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5186" }, { "cve": "CVE-2023-5187", "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5187" } } } { "software": { "id": 7940, "name": "AnyDesk", "version": "ad 7.1.16", "source": "programs", "vendor": "AnyDesk Software GmbH", "generated_cpe": "cpe2.3aanydeskanydeskad.7.1.16*:*:*:*windows*:*", "vulnerabilities": [ { "cve": "CVE-2021-44425", "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-44425" }, { "cve": "CVE-2021-44426", "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-44426" } ] } }