Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5946

Re: "Version less than 0.0" in OVAL definitions

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Mon, 17 May 2021 at 09:58, Serkan Özkan <serkan@vulniq.com> wrote:

> Hello,
> In theory, from version number numbering point of view only, yes less than
> 0.0 is valid. But in practice, as they are used in Debian OVAL definitions,
> I don't think they are. I think these state values might be incorrect,
> probably unintentionally. And there are many, thousands, of these less than
> 0.0 versions, I don't think they are actually intended to test for pre
> version 0 releases.
>

Dear Serkan,

There is a problem with the OVAL definitions published in the website. The
definitions are generated from the information available (in webwml files)
in the source code of the website but this is missing version information
in a way that can be properly interpreted by the scripts.

As a consequence, the output (the definitions) does not include an accurate
value for the version. To implement this properly we would need to
re-engineer the script that was created in 2010. Help here would be
appreciated, I can point you to the script + setup if you could help.

Hope above clarifies. Best regards,

Javier

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

"Version less than 0.0" in OVAL definitions Serkan Özkan <serkan@vulniq.com> - 2021-05-16 16:40 +0200
  Re: "Version less than 0.0" in OVAL definitions Holger Levsen <holger@layer-acht.org> - 2021-05-17 08:50 +0200
    Re: "Version less than 0.0" in OVAL definitions Serkan Özkan <serkan@vulniq.com> - 2021-05-17 10:00 +0200
      Re: "Version less than 0.0" in OVAL definitions Javier Fernandez-Sanguino <jfs@debian.org> - 2021-05-17 11:20 +0200
        Re: "Version less than 0.0" in OVAL definitions Sébastien Delafond <seb@debian.org> - 2021-05-17 13:00 +0200
        Re: "Version less than 0.0" in OVAL definitions Serkan Özkan <serkan@vulniq.com> - 2021-05-17 20:20 +0200
          Re: "Version less than 0.0" in OVAL definitions Javier Fernandez-Sanguino <jfs@debian.org> - 2021-05-17 22:00 +0200

csiph-web