Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #222283 > unrolled thread

debsecan does not report a vulnerability?

Back to article view | Back to linux.debian.user

Contents

  debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-07 11:30 +0200
    Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-10 17:20 +0200
      Re: debsecan does not report a vulnerability? Ihor Antonov <ngor@antonovs.family> - 2020-05-10 21:10 +0200
        Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-11 09:20 +0200
          Re: debsecan does not report a vulnerability? Ihor Antonov <ihor@antonovs.family> - 2020-05-12 05:00 +0200
            Re: debsecan does not report a vulnerability? David Wright <deblis@lionunicorn.co.uk> - 2020-05-12 05:20 +0200
              Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-12 06:00 +0200
            Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-12 05:50 +0200
            motivation for switching to Debian? (was: Re: debsecan does not  report a vulnerability?) Victor Sudakov <vas@sibptus.ru> - 2020-05-12 05:50 +0200
    Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-07-07 09:30 +0200
      Re: debsecan does not report a vulnerability? l0f4r0@tuta.io - 2020-07-07 23:30 +0200
        Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-07-08 04:20 +0200

#222283 — debsecan does not report a vulnerability?

[Multipart message — attachments visible in raw view] — view raw

Dear Colleagues,

There is something about debsecan I don't understand, can you please clarify for me?

CVE-2020-1967 was fixed in version 1.1.1d-0+deb10u3, I have
1.1.1d-0+deb10u2 installed, but for some reason debsecan does not report
the vulnerable package:

# dpkg -l | grep openssl
ii  openssl                       1.1.1d-0+deb10u2             amd64        Secure Sockets Layer toolkit - cryptographic utility
# debsecan --suite buster | grep CVE-2020-1967
# 

What am I doing wrong?

I'm familiar with FreeBSD's "pkg audit", maybe I'm misusing debsecan?

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

[toc] | [next] | [standalone]

#222344

[Multipart message — attachments visible in raw view] — view raw

Have I asked in the wrong list? Which list would be more appropriate?

Victor Sudakov wrote:
> Dear Colleagues,
> 
> There is something about debsecan I don't understand, can you please clarify for me?
> 
> CVE-2020-1967 was fixed in version 1.1.1d-0+deb10u3, I have
> 1.1.1d-0+deb10u2 installed, but for some reason debsecan does not report
> the vulnerable package:
> 
> # dpkg -l | grep openssl
> ii  openssl                       1.1.1d-0+deb10u2             amd64        Secure Sockets Layer toolkit - cryptographic utility
> # debsecan --suite buster | grep CVE-2020-1967
> # 
> 
> What am I doing wrong?
> 
> I'm familiar with FreeBSD's "pkg audit", maybe I'm misusing debsecan?
> 
> -- 
> Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
> 2:5005/49@fidonet http://vas.tomsk.ru/



-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

[toc] | [prev] | [next] | [standalone]

#222349

On Sunday, 10 May 2020 08:18:29 PDT Victor Sudakov wrote:
> Have I asked in the wrong list? Which list would be more appropriate?

Hi Victor,

I think this is the right list. But it seems that the message got lost somehow 
in the high volume. I have not used debescan personally, so I am replying 
simply 
to keep this thread alive hoping to get it more visibility
 
> Victor Sudakov wrote:
> > Dear Colleagues,

> > There is something about debsecan I don't understand, can you please
> > clarify for me?
> > 
> > CVE-2020-1967 was fixed in version 1.1.1d-0+deb10u3, I have
> > 1.1.1d-0+deb10u2 installed, but for some reason debsecan does not report
> > the vulnerable package:
> > 
> > # dpkg -l | grep openssl
> > ii  openssl                       1.1.1d-0+deb10u2             amd64      
> >  Secure Sockets Layer toolkit - cryptographic utility # debsecan --suite
> > buster | grep CVE-2020-1967
> > #
> > 
> > What am I doing wrong?
> > 
> > I'm familiar with FreeBSD's "pkg audit", maybe I'm misusing debsecan?

-------------------
Ihor Antonov

[toc] | [prev] | [next] | [standalone]

#222362

Ihor Antonov wrote:
> On Sunday, 10 May 2020 08:18:29 PDT Victor Sudakov wrote:
> > Have I asked in the wrong list? Which list would be more appropriate?
> 
> Hi Victor,
> 
> I think this is the right list. But it seems that the message got lost somehow 
> in the high volume. I have not used debescan personally, so I am replying 
> simply 
> to keep this thread alive hoping to get it more visibility

Hi Ihor!

What do you use to track vulnerabilites in your Debian hosts? What's the
general approach? Do we just rely upon unattended-upgrade to fetch and
install patched packages for us? 

I come from the FreeBSD world where there are two distinct mechanisms to
fix vulnerabilites: one for the base system (FreeBSD Security Advisories
and freebsd-update to install binary updates to the base system) and
another for third-party software from the ports collection ("pkg audit
-F" instead of security advisories, "pkg upgrade" to install up-to-date
patched versions of packages).

What do we have here, or where can I read more about it?


-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

[toc] | [prev] | [next] | [standalone]

#222393

[Multipart message — attachments visible in raw view] — view raw

On Monday, 11 May 2020 00:14:02 PDT Victor Sudakov wrote:
> Ihor Antonov wrote:
> > On Sunday, 10 May 2020 08:18:29 PDT Victor Sudakov wrote:
> > > Have I asked in the wrong list? Which list would be more appropriate?
> > 
> > Hi Victor,
> > 
> > I think this is the right list. But it seems that the message got lost
> > somehow in the high volume. I have not used debescan personally, so I am
> > replying simply
> > to keep this thread alive hoping to get it more visibility
> 
> Hi Ihor!
> 
> What do you use to track vulnerabilites in your Debian hosts? What's the
> general approach? Do we just rely upon unattended-upgrade to fetch and
> install patched packages for us?

Running unattended upgrades is generally a recommended way to keep the system 
up-to-date. It minimizes the time from update being published to installed.

I got interested and installed debsecan on my laptop. Here is what man says:

       Much like the official Debian security advisories, debsecan's
       vulnerability tracking is mostly based on source packages.
       
So it seems that it only knows about issues that were reported to source 
packages. The next logical step would be to grep bugtracker to see if this CVE 
was even reported to that package. 

> I come from the FreeBSD world where there are two distinct mechanisms to
> fix vulnerabilites: one for the base system (FreeBSD Security Advisories
> and freebsd-update to install binary updates to the base system) and
> another for third-party software from the ports collection ("pkg audit
> -F" instead of security advisories, "pkg upgrade" to install up-to-date
> patched versions of packages).
> 
> What do we have here, or where can I read more about it?
There are also Debian security advisories:
https://www.debian.org/security/ and debian-security-announce mailing list


Separately - I also happened to run a couple of FreeBSD boxes, could you share 
your motivation for switching to Debian? 

Thanks

-- 
Ihor Antonov

[toc] | [prev] | [next] | [standalone]

#222394

On Mon 11 May 2020 at 19:53:46 (-0700), Ihor Antonov wrote:
> On Monday, 11 May 2020 00:14:02 PDT Victor Sudakov wrote:
> > 
> > What do you use to track vulnerabilites in your Debian hosts? What's the
> > general approach? Do we just rely upon unattended-upgrade to fetch and
> > install patched packages for us?
> 
> Running unattended upgrades is generally a recommended way to keep the system 
> up-to-date. It minimizes the time from update being published to installed.
> 
> I got interested and installed debsecan on my laptop. Here is what man says:
> 
>        Much like the official Debian security advisories, debsecan's
>        vulnerability tracking is mostly based on source packages.
>        
> So it seems that it only knows about issues that were reported to source 
> packages. The next logical step would be to grep bugtracker to see if this CVE 
> was even reported to that package. 

Or you could check /usr/share/doc/openssl/changelog.Debian.gz
though it only shows up in version 1.1.1d-0+deb10u3 of course.

$ zcat /usr/share/doc/openssl/changelog.Debian.gz | head
openssl (1.1.1d-0+deb10u3) buster-security; urgency=medium
  * CVE-2020-1967 (Segmentation fault in SSL_check_chain).
 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Mon, 20 Apr 2020 22:23:01 +0200
openssl (1.1.1d-0+deb10u2) buster-security; urgency=medium
  * Reenable AES-CBC-HMAC-SHA ciphers (Closes: #941987).
$ 

(I'm not sure why the OP is still running the previous version.)

> > I come from the FreeBSD world where there are two distinct mechanisms to
> > fix vulnerabilites: one for the base system (FreeBSD Security Advisories
> > and freebsd-update to install binary updates to the base system) and
> > another for third-party software from the ports collection ("pkg audit
> > -F" instead of security advisories, "pkg upgrade" to install up-to-date
> > patched versions of packages).
> > 
> > What do we have here, or where can I read more about it?
> There are also Debian security advisories:
> https://www.debian.org/security/ and debian-security-announce mailing list
> 
> Separately - I also happened to run a couple of FreeBSD boxes, could you share 
> your motivation for switching to Debian? 

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#222397

[Multipart message — attachments visible in raw view] — view raw

David Wright wrote:
> > On Monday, 11 May 2020 00:14:02 PDT Victor Sudakov wrote:
> > > 
> > > What do you use to track vulnerabilites in your Debian hosts? What's the
> > > general approach? Do we just rely upon unattended-upgrade to fetch and
> > > install patched packages for us?
> > 
> > Running unattended upgrades is generally a recommended way to keep the system 
> > up-to-date. It minimizes the time from update being published to installed.
> > 
> > I got interested and installed debsecan on my laptop. Here is what man says:
> > 
> >        Much like the official Debian security advisories, debsecan's
> >        vulnerability tracking is mostly based on source packages.
> >        
> > So it seems that it only knows about issues that were reported to source 
> > packages. The next logical step would be to grep bugtracker to see if this CVE 
> > was even reported to that package. 
> 
> Or you could check /usr/share/doc/openssl/changelog.Debian.gz
> though it only shows up in version 1.1.1d-0+deb10u3 of course.
> 
> $ zcat /usr/share/doc/openssl/changelog.Debian.gz | head

I'm looking for a more generic tool to audit all installed packages and
report vulnerable ones.
> $ 
> 
> (I'm not sure why the OP is still running the previous version.)

I downgraded it on purpose, to find a tool which would detect and report
this package as vulnerable. The "debsecan" turned out to be the wrong
tool.


-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

[toc] | [prev] | [next] | [standalone]

#222395

[Multipart message — attachments visible in raw view] — view raw

Ihor Antonov wrote:
> > > > Have I asked in the wrong list? Which list would be more appropriate?
> > > 
> > > Hi Victor,
> > > 
> > > I think this is the right list. But it seems that the message got lost
> > > somehow in the high volume. I have not used debescan personally, so I am
> > > replying simply
> > > to keep this thread alive hoping to get it more visibility
> > 
> > Hi Ihor!
> > 
> > What do you use to track vulnerabilites in your Debian hosts? What's the
> > general approach? Do we just rely upon unattended-upgrade to fetch and
> > install patched packages for us?
> 
> Running unattended upgrades is generally a recommended way to keep the system 
> up-to-date. It minimizes the time from update being published to installed.
> 
> I got interested and installed debsecan on my laptop. Here is what man says:
> 
>        Much like the official Debian security advisories, debsecan's
>        vulnerability tracking is mostly based on source packages.
>        
> So it seems that it only knows about issues that were reported to source 
> packages. The next logical step would be to grep bugtracker to see if this CVE 
> was even reported to that package. 

So probably debsecan is the wrong tool to determine which of the
packages installed on the particular host are vulnerable? What is the
right tool then?

> 
> > I come from the FreeBSD world where there are two distinct mechanisms to
> > fix vulnerabilites: one for the base system (FreeBSD Security Advisories
> > and freebsd-update to install binary updates to the base system) and
> > another for third-party software from the ports collection ("pkg audit
> > -F" instead of security advisories, "pkg upgrade" to install up-to-date
> > patched versions of packages).
> > 
> > What do we have here, or where can I read more about it?
> There are also Debian security advisories:
> https://www.debian.org/security/ and debian-security-announce mailing list

And the tool for package audit? Is relying on "apt upgrade" the
recommended policy?

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

[toc] | [prev] | [next] | [standalone]

#222396 — motivation for switching to Debian? (was: Re: debsecan does not report a vulnerability?)

[Multipart message — attachments visible in raw view] — view raw

Ihor Antonov wrote:
> 
> Separately - I also happened to run a couple of FreeBSD boxes, could you share 
> your motivation for switching to Debian? 

There are two major issues:

1. Lack of proper support for FreeBSD in AWS. Despite Colin's efforts
(and I'm subscribed to his Patreon) there is always something that works
in Debian and does not work in FreeBSD (hot plugging/unplugging of EBS
volumes is one notorious example).

2. FreeBSD's inability to install simultaneously multiple versions of
PHP and multiple versions of Postgres. While both tasks are very easy in
Debian, in FreeBSD this would involve manual work, jails etc (the
standard pkg system does not support this).

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

[toc] | [prev] | [next] | [standalone]

#224482

[Multipart message — attachments visible in raw view] — view raw

Victor Sudakov wrote:
> 
> There is something about debsecan I don't understand, can you please clarify for me?


After reading your replies and the Debian security advisories, I made up
my mind that I probably just want to now if new versions of packages are
available in the repos. Perhaps it's the best thing I can do about
vulnerabilities. 

So I wrote the following UserParameter for the Zabbix agent, and I think
I've found it useful already:

# Number of upgradable packages
UserParameter=packages.upgradeable,if [ -x /usr/bin/apt-get ] ; then /usr/bin/apt-get upgrade -s | grep -c '^Inst' ; elif [ -x /usr/bin/yum ] ; then /usr/bin/yum check-update | grep -c 'updates$'; else echo "1" ; fi

It does not require any extra utilities to estimate the number of
upgradeable packages.


-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

[toc] | [prev] | [next] | [standalone]

#224538

Hi,

7 juil. 2020 à 09:23 de vas@sibptus.ru:

> After reading your replies and the Debian security advisories, I made up
> my mind that I probably just want to now if new versions of packages are
> available in the repos. Perhaps it's the best thing I can do about
> vulnerabilities. 
>
> So I wrote the following UserParameter for the Zabbix agent, and I think
> I've found it useful already:
>
> # Number of upgradable packages
> UserParameter=packages.upgradeable,if [ -x /usr/bin/apt-get ] ; then /usr/bin/apt-get upgrade -s | grep -c '^Inst' ; elif [ -x /usr/bin/yum ] ; then /usr/bin/yum check-update | grep -c 'updates$'; else echo "1" ; fi
>
> It does not require any extra utilities to estimate the number of
> upgradeable packages.
>
Regarding APT, don't forget first to do:
apt update
...otherwise you won't get so many upgrades available ;)
Why not just counting results of:
apt list --upgradable
or
apt list --upgradeable
?
NB: Personally, I prefer apticron :)

Best regards,
l0f4r0

[toc] | [prev] | [next] | [standalone]

#224559

[Multipart message — attachments visible in raw view] — view raw

l0f4r0@tuta.io wrote:
> Hi,
> 
> 7 juil. 2020 à 09:23 de vas@sibptus.ru:
> 
> > After reading your replies and the Debian security advisories, I made up
> > my mind that I probably just want to now if new versions of packages are
> > available in the repos. Perhaps it's the best thing I can do about
> > vulnerabilities. 
> >
> > So I wrote the following UserParameter for the Zabbix agent, and I think
> > I've found it useful already:
> >
> > # Number of upgradable packages
> > UserParameter=packages.upgradeable,if [ -x /usr/bin/apt-get ] ; then /usr/bin/apt-get upgrade -s | grep -c '^Inst' ; elif [ -x /usr/bin/yum ] ; then /usr/bin/yum check-update | grep -c 'updates$'; else echo "1" ; fi
> >
> > It does not require any extra utilities to estimate the number of
> > upgradeable packages.
> >
> Regarding APT, don't forget first to do:
> apt update
> ...otherwise you won't get so many upgrades available ;)

This already happens automatically, from apt.systemd.daily I think.

> Why not just counting results of:
> apt list --upgradable
> or
> apt list --upgradeable
> ?

"WARNING: apt does not have a stable CLI interface. Use with caution in scripts."

So I chose to exercise caution.

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web