Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #222395

Re: debsecan does not report a vulnerability?

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Ihor Antonov wrote:
> > > > Have I asked in the wrong list? Which list would be more appropriate?
> > > 
> > > Hi Victor,
> > > 
> > > I think this is the right list. But it seems that the message got lost
> > > somehow in the high volume. I have not used debescan personally, so I am
> > > replying simply
> > > to keep this thread alive hoping to get it more visibility
> > 
> > Hi Ihor!
> > 
> > What do you use to track vulnerabilites in your Debian hosts? What's the
> > general approach? Do we just rely upon unattended-upgrade to fetch and
> > install patched packages for us?
> 
> Running unattended upgrades is generally a recommended way to keep the system 
> up-to-date. It minimizes the time from update being published to installed.
> 
> I got interested and installed debsecan on my laptop. Here is what man says:
> 
>        Much like the official Debian security advisories, debsecan's
>        vulnerability tracking is mostly based on source packages.
>        
> So it seems that it only knows about issues that were reported to source 
> packages. The next logical step would be to grep bugtracker to see if this CVE 
> was even reported to that package. 

So probably debsecan is the wrong tool to determine which of the
packages installed on the particular host are vulnerable? What is the
right tool then?

> 
> > I come from the FreeBSD world where there are two distinct mechanisms to
> > fix vulnerabilites: one for the base system (FreeBSD Security Advisories
> > and freebsd-update to install binary updates to the base system) and
> > another for third-party software from the ports collection ("pkg audit
> > -F" instead of security advisories, "pkg upgrade" to install up-to-date
> > patched versions of packages).
> > 
> > What do we have here, or where can I read more about it?
> There are also Debian security advisories:
> https://www.debian.org/security/ and debian-security-announce mailing list

And the tool for package audit? Is relying on "apt upgrade" the
recommended policy?

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-07 11:30 +0200
  Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-10 17:20 +0200
    Re: debsecan does not report a vulnerability? Ihor Antonov <ngor@antonovs.family> - 2020-05-10 21:10 +0200
      Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-11 09:20 +0200
        Re: debsecan does not report a vulnerability? Ihor Antonov <ihor@antonovs.family> - 2020-05-12 05:00 +0200
          Re: debsecan does not report a vulnerability? David Wright <deblis@lionunicorn.co.uk> - 2020-05-12 05:20 +0200
            Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-12 06:00 +0200
          Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-12 05:50 +0200
          motivation for switching to Debian? (was: Re: debsecan does not  report a vulnerability?) Victor Sudakov <vas@sibptus.ru> - 2020-05-12 05:50 +0200
  Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-07-07 09:30 +0200
    Re: debsecan does not report a vulnerability? l0f4r0@tuta.io - 2020-07-07 23:30 +0200
      Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-07-08 04:20 +0200

csiph-web