Welcome to the Inedo Forums! Check out the Forums Guide for help getting started.
If you are experiencing any issues with the forum software, please visit the Contact Form on our website and let us know!
Can I create a policy exception for a vulnerable package
-
ProGet has identified a package that has 2 high risk vulnerabilities and is blocking it. We have a situation where we nee to allow that package to be downloaded while we perform an upgrade to one of our systems. How can I allow that package to be downloaded for a short time? It seems I need to Add a Policy Exception, but the only available categories are License Rules, Unlisted Rule, Aged Package Rule, Deprecation Rule, Latest Patch Rule, and Recently Published Rule. I don't see anything to override the vulnerability.
What is the recommended way to accomplish this?
-
Hi @bobmaurer ,
There are a couple ways to handle this:
- Overriding the Assessment on the vulnerability; this is probably the best way to do it
- Override the Compliance status on the package itself by doing Set Package Status
But if it's temporary, then it doesn't really matter. They will both work.
Thanks,
Alana
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login