Overview


CyberCenter U9 introduces improvements to the ingestion and validation of malware identifiers (MAL-IDs). The updated logic expands validation beyond the GitHub Security Advisory (GHSA) source, uses additional secondary sources, and improves affected-version parsing.


These changes are intended to improve malware vulnerability coverage while limiting false positives from unvalidated Open Source Security Foundation (OpenSSF) entries.


What is changing


The current malware-ID ingestion process validates OpenSSF entries against GHSA data. Requiring GHSA validation can exclude some package vulnerabilities from customer results when corresponding validation is not available in GHSA.


OpenSSF contains additional malware information, but not every entry may be correct or independently validated. Ingesting all OpenSSF entries without further validation could therefore generate a significant number of false positives.


With CyberCenter U9, malware-ID ingestion will use updated logic that:


- Does not rely solely on GHSA to validate an OpenSSF entry.

- Validates entries against additional secondary sources.

- Improves version parsing to associate findings with the correct affected package versions.


Why this change is being made


The previous validation model involves a tradeoff between coverage and accuracy:


- Requiring a GHSA match can omit malware-related package vulnerabilities that are supported by other sources.

- Including every OpenSSF entry without additional validation can increase false positives.


The new logic is designed to improve this balance by corroborating OpenSSF entries across more sources and by more accurately interpreting affected-version information.


Availability


The improved malware feeds will begin with the **CyberCenter U9** release.


Customer impact


After the CyberCenter U9 feed update, customers may observe changes in malware-related vulnerability and compliance information. Depending on the available source validation and corrected affected-version mapping, findings may be added, removed, or reassessed.


The update may affect:


- Malware-related vulnerability findings.

- The affected package versions associated with a finding.

- Vulnerability counts and related reports.

- Compliance results or status derived from the affected vulnerability data.


Important The precise direction or volume of changes will depend on each customer's packages, versions, and existing findings.


Required Customer Action


No configuration, upgrade action, or feature enablement is required for customers to receive this feed improvement.


However, customers should review and reassess their vulnerability and compliance information after the CyberCenter U9 malware-feed update because existing results may change.


Recommended Review


1. Record the current malware-related vulnerability and compliance results before the updated feed is applied.

2. After the CyberCenter U9 feed update, review newly added, removed, or changed malware findings.

3. Confirm that each finding is associated with the expected package and affected version.

4. Reassess risk acceptances, exceptions, suppressions, tickets, and remediation priorities that depend on the changed findings.

5. Review compliance reports or controls whose status is derived from vulnerability data.

6. Update internal reports and stakeholder communications when the reassessment changes risk or compliance status.


Scope of the Update

Pre-release analysis identified 10,196 unique MAL-ID and package associations, representing 17,423 affected-version expressions.

Most additions identify one or more specific affected versions. A smaller subset uses a version range beginning at a specified minimum version. As a result, the update may affect multiple versions of the same package and can produce more changed findings than the number of newly added MAL-IDs.

These figures reflect the analyzed pre-release dataset and may change before production rollout.

Version-Matching Behavior

The updated data contains two primary affected-version patterns:

  • Specific-version matches: The malware record applies to explicitly identified package versions.

  • Minimum-version ranges: The malware record applies beginning with the specified version, represented as >= version.

Customers should review the affected-version information rather than relying only on the presence of a MAL-ID. If an affected range appears broader than expected, contact Aqua Support for validation.

Important Distinction

This update improves malware-feed coverage and affected-version association. It does not indicate that every newly visible package or finding was newly introduced into the customer environment at the time of the release.

The package may have existed previously but was not reported because the earlier ingestion logic could not sufficiently validate or map the malware entry.