debsecan does not report a vulnerability?

From	Victor Sudakov <vas@sibptus.ru>
Newsgroups	linux.debian.user
Subject	debsecan does not report a vulnerability?
Date	2020-05-07 11:30 +0200
Message-ID	<A3L0R-4o1-1@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Dear Colleagues,

There is something about debsecan I don't understand, can you please clarify for me?

CVE-2020-1967 was fixed in version 1.1.1d-0+deb10u3, I have
1.1.1d-0+deb10u2 installed, but for some reason debsecan does not report
the vulnerable package:

# dpkg -l | grep openssl
ii  openssl                       1.1.1d-0+deb10u2             amd64        Secure Sockets Layer toolkit - cryptographic utility
# debsecan --suite buster | grep CVE-2020-1967
# 

What am I doing wrong?

I'm familiar with FreeBSD's "pkg audit", maybe I'm misusing debsecan?

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-07 11:30 +0200
  Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-10 17:20 +0200
    Re: debsecan does not report a vulnerability? Ihor Antonov <ngor@antonovs.family> - 2020-05-10 21:10 +0200
      Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-11 09:20 +0200
        Re: debsecan does not report a vulnerability? Ihor Antonov <ihor@antonovs.family> - 2020-05-12 05:00 +0200
          Re: debsecan does not report a vulnerability? David Wright <deblis@lionunicorn.co.uk> - 2020-05-12 05:20 +0200
            Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-12 06:00 +0200
          Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-05-12 05:50 +0200
          motivation for switching to Debian? (was: Re: debsecan does not  report a vulnerability?) Victor Sudakov <vas@sibptus.ru> - 2020-05-12 05:50 +0200
  Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-07-07 09:30 +0200
    Re: debsecan does not report a vulnerability? l0f4r0@tuta.io - 2020-07-07 23:30 +0200
      Re: debsecan does not report a vulnerability? Victor Sudakov <vas@sibptus.ru> - 2020-07-08 04:20 +0200

csiph-web