I’m working for a cloud provider and we are building a service to manage fleets of VMs with all kinds of images. Among all our requirements is the ask to manage the vulnerabilities for customers’ vms.
Currently we are supporting many linux distributions by consuming their CVE data feeds. For example, we are able to get a data feed with debian’s CVEs as json file:
https://security-tracker.debian.org/tracker/data/json
I looked everywhere but didn’t really find similar things for rocky linux. Am I missing something?
If there is such a feed, what are the processes for us to onboard and consume it. If there is not, how can we get all CVEs efficiently?
Please advise! Thanks!