"Version less than 0.0" in OVAL definitions

From	Serkan Özkan <serkan@vulniq.com>
Newsgroups	linux.debian.security
Subject	"Version less than 0.0" in OVAL definitions
Date	2021-05-16 16:40 +0200
Message-ID	<Cfq5X-2NL-3@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hello,
We are using Debian OVAL definitions but there are many tests, and states,
that test for dpkg versions being less than 0.0 which is impossible in
practice (right?).
How should we handle these tests/definitions? Should we ignore them or does
0.0 have a special meaning in this case?

<dpkginfo_test check="all" check_existence="at_least_one_exists" comment="linux
is earlier than 0" id="oval:org.debian.oval:tst:22144" version="1" xmlns="
http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:org.debian.oval:obj:195"/>
<state state_ref="oval:org.debian.oval:ste:14430"/>
</dpkginfo_test>
<dpkginfo_test check="all" check_existence="at_least_one_exists" comment="jhead
is earlier than 0" id="oval:org.debian.oval:tst:22145" version="1" xmlns="
http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:org.debian.oval:obj:740"/>
<state state_ref="oval:org.debian.oval:ste:14430"/>
</dpkginfo_test>
...
<dpkginfo_state id="oval:org.debian.oval:ste:14430" version="1" xmlns="
http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<evr datatype="debian_evr_string" operation="less than">0:0</evr>
</dpkginfo_state>
<dpkginfo_state id="oval:org.debian.oval:ste:14431" version="1" xmlns="
http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<evr datatype="debian_evr_string" operation="less than">0:1.14.4-1+deb10u1
</evr>
</dpkginfo_state>
<dpkginfo_state id="oval:org.debian.oval:ste:14432" version="1" xmlns="
http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<evr datatype="debian_evr_string" operation="less than">0:0</evr>
</dpkginfo_state>


Thanks in advance,
Serkan Özkan

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

"Version less than 0.0" in OVAL definitions Serkan Özkan <serkan@vulniq.com> - 2021-05-16 16:40 +0200
  Re: "Version less than 0.0" in OVAL definitions Holger Levsen <holger@layer-acht.org> - 2021-05-17 08:50 +0200
    Re: "Version less than 0.0" in OVAL definitions Serkan Özkan <serkan@vulniq.com> - 2021-05-17 10:00 +0200
      Re: "Version less than 0.0" in OVAL definitions Javier Fernandez-Sanguino <jfs@debian.org> - 2021-05-17 11:20 +0200
        Re: "Version less than 0.0" in OVAL definitions Sébastien Delafond <seb@debian.org> - 2021-05-17 13:00 +0200
        Re: "Version less than 0.0" in OVAL definitions Serkan Özkan <serkan@vulniq.com> - 2021-05-17 20:20 +0200
          Re: "Version less than 0.0" in OVAL definitions Javier Fernandez-Sanguino <jfs@debian.org> - 2021-05-17 22:00 +0200

csiph-web