Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #828617

Bug#864728: security.debian.org: OVAL def generator generates tests only for source packages

Show all headers | View raw

Control: severity -1 wishlist

Hi

On Tue, Jun 13, 2017 at 04:12:48PM +0000, 0x2a wrote:
> Package: security.debian.org
> Severity: important
> 
> The generated OVAL tests only check the version of the source
> package, not packages built from it.
> 
> An example would be DSA-3872-1 (CVE-2017-5461, CVE-2017-5462,
> CVE-2017-7502), where the test checks the *nss* package, not
> *libnss3*, thus causing a false negative, since *nss* is not
> installed.

Some background: For our security-tracker we are intrested tracking
fixes to the respective source packages. The OVAL files are generated
out of that information of the security-tracker, thus as well only
tracking source packages. 

Regards,
Salvatore

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#864728: security.debian.org: OVAL def generator generates tests only for source packages 0x2a <0x2a@correcthorsebatterystaple.xyz> - 2017-06-13 18:20 +0200
  Bug#864728: security.debian.org: OVAL def generator generates tests only for source packages Salvatore Bonaccorso <carnil@debian.org> - 2017-06-13 22:10 +0200
    Bug#864728: security.debian.org: OVAL def generator generates tests only for source packages 0x2a <0x2a@correcthorsebatterystaple.xyz> - 2017-06-16 16:40 +0200

csiph-web