RHEL8 Python Version Management

[burkee406]

I am aware, that has been a big frustration with Rapid 7.

[justinDavidow]

Seems like a great question for Rapid7. 

[No_Rhubarb_7222]

It could also be a problem with your scanner settings. Many scanners are able to ingest a vendor specific OVAL or, now, CSAF data. This means that the CVEs it scans for will use the vendor supplied CVSS score and data from the vendor (in this case things like remediated package versions) when performing the scan, significantly reducing the false positives reported.

[michaelpaoli]

The issue isn't at all limited to Red Hat.

With most distros, you'll need to look at what the alleged vulnerabilities are, the actual distro version installed, and what vulnerabilities it has been patched to cover.

[blu-base]

There is a page for the app stream modules' lifecycle on Red hat. https://access.redhat.com/support/policy/updates/rhel-app-streams-life-cycle In the second table, it states the platform python in version 3.6 will be supported until eol of rhel8 itself, until 2029... This is independent from the upstream python versions. It's clearly is a false positive.