The inventory, hour by hour: fixed, vulnerable, still under investigation

How to read it

• Vulnerable mostly means inherited. 185 of the 216 vulnerable rows are applications the inventory marks affected when deployed on an affected web-serving PHP runtime. Their fix is patching PHP underneath them, not a release from their maker, so they stay vulnerable in the list whatever the server does. That is why only 1 row moved from vulnerable to fixed.
• Fixes came from the people who ship PHP. Operating systems, container images, platforms and hosting panels: the 61 fixed rows are almost all runtimes, recorded from 15:30 UTC on 21 October.
• The investigation pile grew while it shrank. 207 rows were resolved to vulnerable and 44 to fixed, and 78 new rows arrived under investigation.
• The boxes in front run PHP too. Vulnerable: Check Point firewall web interfaces (Check Point), NetScaler ADC (Citrix / NetScaler), PAN-OS (Palo Alto Networks), Panorama (Palo Alto Networks). Under investigation: Cisco (29), Fortinet (10), F5 (2), Juniper Networks (1), Sophos (1).

Every change of status

Between consecutive commits, per row. A row added already fixed counts as added.

What kind of rows they are

Read from each row's own CVE assessment line by 11 rules, applied in order; the rules are in admin/build/inventory_history.py and in the data. The words matched are the inventory's; the grouping is this site's.

When each supplier was first recorded fixed

The time the inventory recorded the fix, not the time the supplier shipped it.

Where this comes from

a git clone; every count is from software/software_list_*.md at the commit named. Commits are content-addressed: anyone with a clone can check every number here against the commit named. The self-check: at cca173c64ec5 this parser agrees with data/software.json on all 674 rows the vault exported, status for status; it also finds 1 row the vault missed: iBabs / iBabs bestuursportaal (Not vuln). That one row is a correction to this site's earlier counts, on corrections. The vault holds the inventory at one commit; the history is not yet captured into it (board).