Software past its end of life gets no more security fixes, and no CVE is published to say so. A server can match no advisory and still run Ubuntu 18.04, Node.js 14 or log4j 1.2. TigerGate reports these as End-of-life software findings, the equivalent of the “Unsupported Version Detection” findings in other vulnerability scanners. End-of-life findings appear with the other findings on the Findings, Prioritize and Hosts tabs, in the category End of life (unsupported). They are rated Critical.

​
What is checked

KindProductsSource
Linux distributionThe installed release of Ubuntu, Debian, Red Hat Enterprise Linux, Amazon Linux, Alpine and the other distributions the vulnerability matcher supportsThe vulnerability matcher’s end-of-support data for the distribution
Windows and macOSWindows, Windows Server and macOS, by build or product versionVendor lifecycle
Runtimes and serversJava (OpenJDK), Apache Tomcat, Node.js, Python, PHP, nginx, Apache HTTP Server, PostgreSQL, MariaDB, .NET and ASP.NET CoreVendor lifecycle
Databases and application serversOracle Database and Red Hat JBoss EAP, by major release. Oracle WebLogic Server, IBM WebSphere Application Server and WildFly are not checked: endoflife.date publishes no lifecycle for them. Paid extended support (Oracle Extended Support, Red Hat Extended Life Phase) is not considered.Vendor lifecycle
LibrariesApache Log4j (1.x and 2.x), Spring Framework, ElasticsearchVendor lifecycle
Vendor lifecycle dates come from a snapshot of endoflife.date that is updated with TigerGate releases. A release missing from the snapshot is treated as unknown, never as end of life. Runtimes and libraries are judged only when they are installed outside the OS package manager. A distribution keeps patching its own python3 or openjdk package for as long as it supports the release, even after upstream support ends. For those, the distribution’s own end of life applies, and that is the Linux finding.

​
Reading a finding

Each finding names the product and release line, for example “Apache Tomcat 8.5 reached end of life on 2024-03-31”, and lists every affected install on the server with its path. The fixed in version is the latest version of the oldest release line still supported, which is the smallest upgrade that gets maintainer fixes again. One finding is raised per product and release line on a server, not one per file. Three applications that each bundle log4j 1.2 produce one finding with three install paths. The finding closes automatically once a later scan no longer sees an end-of-life release on that server.

​
Turning it off or changing severity

The rule is endpoint.end_of_life, listed as End-of-life software in Endpoint → Rules. As with other agent rules, you can disable it or change its severity for your organization there.