mirror of https://github.com/goharbor/harbor.git
27 lines
1.7 KiB
Markdown
27 lines
1.7 KiB
Markdown
---
|
|
title: Configure System-Wide CVE Allowlists
|
|
weight: 50
|
|
---
|
|
|
|
When you run vulnerability scans, images that are subject to Common Vulnerabilities and Exposures (CVE) are identified. According to the severity of the CVE and your security settings, these images might not be permitted to run. As a Harbor system administrator, you can create allowlists of CVEs to ignore during vulnerability scanning.
|
|
|
|
You can set a system-wide CVE allowlist or you can set CVE allowlists on a per-project basis. For information about per-project CVE allowlists, see [Configure a Per-Project CVE Allowlist](../../working-with-projects/project-configuration/configure-project-allowlist.md).
|
|
|
|
System-wide CVE allowlists apply to all of the projects in a Harbor instance.
|
|
|
|
1. Go to **Configuration** > **System Settings**.
|
|
1. Under **Deployment security**, click **Add**.
|
|
|
|
1. Enter the list of CVE IDs to ignore during vulnerability scanning.
|
|
|
|
|
|
Either use a comma-separated list or newlines to add multiple CVE IDs to the list.
|
|
1. Click **Add** at the bottom of the window to add the list.
|
|
1. Optionally uncheck the **Never expires** checkbox and use the calendar selector to set an expiry date for the allowlist.
|
|
|
|
1. Click **Save** at the bottom of the page to save your settings.
|
|
|
|
After you have created a system allowlist, you can remove CVE IDs from the list by clicking the delete button next to it in the list. You can click **Add** to add more CVE IDs to the system allowlist.
|
|
|
|
|