Critical · urgent · major — the vendor's top rating, or no rating while CVEs are listed: red pill and barImportant · high · medium — the vendor's second ratingModerate · medium · low — the vendor's other ratingsthe rating is the vendor's: AlmaLinux Critical / Important / Moderate, Low; Fedora and EPEL urgent / high / medium, low; Ubuntu (USN OVAL) Critical / High / Medium, Low; nginx.org major / medium / low; modules — CVSS from the CVE record critical / high / medium, low; PowerDNS Critical, High / Medium / Lowdefault — what dnf install nginx installs without choosing a stream
sources and rules (3) · checked 0 min ago
304AlmaLinux 8 · nginx · AppStream · checked · changed method conditional GET of the AppStream repomd.xml → on change: the Packages/ listing (when the nginx file appeared, module stream by version); modules.yaml (the default stream) and updateinfo.xml.gz (advisory, rating, CVEs; sha256 from repomd.xml) — when a new nginx build appeared, a build of the last 30 days waits for its advisory, or once a day · rule every 5 min; the official repository is down — AlmaLinux mirrors from the mirrorlist (https only, revision not older than already seen): builds from the advisories, time from the file's Last-Modified
304AlmaLinux 8 · nginx.org (stable, mainline) · checked · changed method conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared) · rule every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
304nginx.org · security advisories · checked · changed method conditional GET → HTML parsing: title, rating (major, medium, low), CVE, vulnerable and not vulnerable versions · rule every 30 min
vigil