Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #828589 > unrolled thread
| Started by | 0x2a <0x2a@correcthorsebatterystaple.xyz> |
|---|---|
| First post | 2017-06-13 18:20 +0200 |
| Last post | 2017-06-16 16:40 +0200 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.debian.bugs.dist
Bug#864728: security.debian.org: OVAL def generator generates tests only for source packages 0x2a <0x2a@correcthorsebatterystaple.xyz> - 2017-06-13 18:20 +0200
Bug#864728: security.debian.org: OVAL def generator generates tests only for source packages Salvatore Bonaccorso <carnil@debian.org> - 2017-06-13 22:10 +0200
Bug#864728: security.debian.org: OVAL def generator generates tests only for source packages 0x2a <0x2a@correcthorsebatterystaple.xyz> - 2017-06-16 16:40 +0200
| From | 0x2a <0x2a@correcthorsebatterystaple.xyz> |
|---|---|
| Date | 2017-06-13 18:20 +0200 |
| Subject | Bug#864728: security.debian.org: OVAL def generator generates tests only for source packages |
| Message-ID | <tRWHT-1JS-9@gated-at.bofh.it> |
Package: security.debian.org Severity: important The generated OVAL tests only check the version of the source package, not packages built from it. An example would be DSA-3872-1 (CVE-2017-5461, CVE-2017-5462, CVE-2017-7502), where the test checks the *nss* package, not *libnss3*, thus causing a false negative, since *nss* is not installed.
[toc] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2017-06-13 22:10 +0200 |
| Message-ID | <tS0iu-40M-15@gated-at.bofh.it> |
| In reply to | #828589 |
Control: severity -1 wishlist Hi On Tue, Jun 13, 2017 at 04:12:48PM +0000, 0x2a wrote: > Package: security.debian.org > Severity: important > > The generated OVAL tests only check the version of the source > package, not packages built from it. > > An example would be DSA-3872-1 (CVE-2017-5461, CVE-2017-5462, > CVE-2017-7502), where the test checks the *nss* package, not > *libnss3*, thus causing a false negative, since *nss* is not > installed. Some background: For our security-tracker we are intrested tracking fixes to the respective source packages. The OVAL files are generated out of that information of the security-tracker, thus as well only tracking source packages. Regards, Salvatore
[toc] | [prev] | [next] | [standalone]
| From | 0x2a <0x2a@correcthorsebatterystaple.xyz> |
|---|---|
| Date | 2017-06-16 16:40 +0200 |
| Message-ID | <tT0zM-1hl-19@gated-at.bofh.it> |
| In reply to | #828617 |
Hi, I'd like to create a patch for this. The required information about binary packages could be fetched from: - the package tracker (would require a REST interface in distro-tracker, see #756028 which has no updates since 07/2014) - UDD (would add a dependency for python-psycopg2) Is there any preference from the maintainer(s)? regards, 0x2a
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web