When you run vulnerability scans, images that are subject to Common Vulnerabilities and Exposures (CVE) are identified. According to the severity of the CVE and your security settings, these images might not be permitted to run. As a Harbor system administrator, you can create whitelists of CVEs to ignore during vulnerability scanning.

You can set a system-wide CVE whitelist or you can set CVE whitelists on a per-project basis. For information about per-project CVE whitelists, see Configure a Per-Project CVE Whitelist.

System-wide CVE whitelists apply to all of the projects in a Harbor instance.

1. Go to Configuration > System Settings.

2. Under Deployment security, click Add.

   

   

3. Enter the list of CVE IDs to ignore during vulnerability scanning.

   

   

   Either use a comma-separated list or newlines to add multiple CVE IDs to the list.

4. Click Add at the bottom of the window to add the list.

5. Optionally uncheck the Never expires checkbox and use the calendar selector to set an expiry date for the whitelist.

   

   

6. Click Save at the bottom of the page to save your settings.

After you have created a system whitelist, you can remove CVE IDs from the list by clicking the delete button next to it in the list. You can click Add to add more CVE IDs to the system whitelist.