IOS Software Checker -v- Security notifications

[oloneb]

Can you please advise if the IOS software checker should be the default source for affected versions? In the notifications there are bug ID's noted but often the information in these do not match the output of the software checker. So do we assume that the bug ID's are the only ones that have currently been reported and aassociated to the PSIRT but the Software Checker identifies all versions affected irrespective if a bug has been reported against that product / version?

[Omar Santos]

Hi Oloneb,

Yes. The IOS Software Checker integration is the main source of version information. Only IOS and IOS-XE are currently supported and Cisco is planning to supporting other platforms in the future. You can use the Cisco PSIRT openVuln API to perform queries similar to the Cisco IOS Checker. You can search for Cisco Security Advisories that apply to specific Cisco IOS and IOS XE Software releases and have a Security Impact Rating (SIR) of Critical or High. Note that the tool does not provide information about security advisories that have a SIR of Medium.

Method	REST API URL	Description
GET	https://api.cisco.com/security/advisories/ios?version=<<IOS version>>	Used to obtain all published security advisories that affect a given Cisco IOS Software version.
GET	https://api.cisco.com/security/advisories/iosxe?version=<<IOS XE version>>	Used to obtain all published security advisories that affect a given Cisco IOS XE Software version.

More information at:

https://developer.cisco.com/site/PSIRT/get-started/getting-started.gsp