Ubuntu Expanded Security Maintenance (ESM)

Anchore Enterprise supports the use of Ubuntu Expanded Security Maintenance (ESM) data when scanning relevant container images for vulnerabilities. ESM is the Ubuntu Pro channel through which Canonical publishes security fixes for packages beyond their standard support window. When an image was built with ESM enabled, the Ubuntu security advisories that apply to it differ from those for a standard image, and the fix versions carry an +esm suffix.

This mirrors the existing support for Red Hat Enterprise Linux (RHEL) Extended Update Support (EUS). The configuration keys, the image annotation, and the presentation in the Anchore Enterprise GUI follow the same pattern.

How ESM Is Detected

During image analysis, Anchore Enterprise records whether an Ubuntu image shows evidence that ESM was enabled when the image was built. Any one of the following is sufficient:

• An uncommented apt source, or an apt auth entry, that points at the esm.ubuntu.com/infra or esm.ubuntu.com/apps streams. Both classic .list and DEB822 .sources files are inspected.
• An Ubuntu Pro client status cache reporting the esm-infra or esm-apps service as enabled.
• An installed package whose version carries an ESM pocket suffix such as +esm1 or ~esm2. This is durable evidence that ESM content is on disk even if ESM was later disabled.

Other Ubuntu Pro streams, such as FIPS or real-time kernel channels, do not count as ESM evidence. They can be enabled independently of ESM and do not change the applicable security advisories in the same way.

The result is stored on the image as extended_support in its metadata and is visible through the /images/{image_digest} API.

Default Behavior

By default, Anchore Enterprise uses ESM data for any Ubuntu image that was identified as having ESM enabled during image analysis. Standard Ubuntu images continue to be matched against the standard advisories.

Images analyzed before upgrading to Anchore Enterprise 6.3.0 have no ESM detection recorded. Reanalyze them to make use of the default behavior.

The default can be overridden at the system level through configuration, or at the image level by applying the anchore.user/extended_support annotation to individual images.

Overriding at the Image Level

To specify that an Ubuntu image should use ESM data for vulnerability scanning regardless of ESM detection, set the anchore.user/extended_support annotation to true.

anchorectl image add myrepo.example.com:5000/my_app:latest \
  --annotation "anchore.user/extended_support=true"

To specify that an Ubuntu image should not use ESM data for vulnerability scanning regardless of ESM detection, set the annotation to false.

anchorectl image add myrepo.example.com:5000/my_app:latest \
  --annotation "anchore.user/extended_support=false"

The annotation value is matched case-insensitively. Any value other than true or false is ignored.

Annotations can also be added via the Anchore Enterprise GUI.

Configuration

You can decide how Anchore Enterprise should act when scanning Ubuntu ESM images for vulnerabilities by setting the following configuration options:

• services.policy_engine.vulnerabilities.extended_support.ubuntu.enabled

  • auto: Use ESM data during vulnerability scans if ESM was detected during image analysis. This is the default value.

  • always: Use ESM data during vulnerability scans for all Ubuntu images, regardless of whether ESM was detected during image analysis.

  • never: Do not use ESM data during vulnerability scans for any Ubuntu images.

• services.policy_engine.vulnerabilities.extended_support.ubuntu.versions

  • Defines the range of Ubuntu versions for which the above ESM behavior applies, using the same range syntax as the RHEL setting, for example ">=20.04".

  • The default value is empty, which applies the ESM behavior to all Ubuntu versions.

These settings can be changed via the configuration API without a restart, or by modifying your configuration file as follows.

Helm

To override the default values, alter the following fields in your values.yaml file:

anchoreConfig:
  policy_engine:
    vulnerabilities:
      extended_support:
        ubuntu:
          enabled: "auto"
          versions: ""

Docker Compose

To override the default values, alter the following fields in your config.yaml file:

services:
  policy_engine:
    vulnerabilities:
      extended_support:
        ubuntu:
          enabled: "auto"
          versions: ""

Presentation in the Anchore Enterprise GUI

When ESM detection or ESM data use applies to an image, the header of its image analysis view shows an indicator with the Ubuntu mark and one of three states:

• ESM Detected and Used: ESM was detected in the image and ESM data was applied during scanning. Results reflect Canonical’s extended security patches and may show fewer findings than a standard scan.
• ESM Detected but Not Used: ESM was detected, but ESM data was not applied because the system configuration or the image annotation disables it. Results are based on the standard package versions and may show more findings.
• ESM Not Detected but Used: ESM was not detected, but ESM data was applied because the image annotation or the system configuration requires it.

No indicator is shown when ESM was neither detected nor used. Hovering the indicator explains which setting produced the current state.

Related APIs

For the presentation of ESM detection and its use in image vulnerability scans, see the API documentation for the /images/{image_digest} and /images/{image_digest}/vuln/{vuln_type} APIs. Both report the same extended_support field used for RHEL EUS.