Thanks for your response.
I looked into the doc and found the following description
"The oscap utility maps Red Hat Security Advisories to CVE identifiers that
are linked to the National Vulnerability Database and reports which
security advisories are not applied."
However, does Red Hat security advisories capture all CVEs? Or it only
capture its own product related CVEs? If it does not have a comprehensive
CVEs, then do you know how to incorporate the entire NVD vulnerability data?
Thanks,
Su
On Thu, Nov 5, 2015 at 5:06 PM, Shawn Wells <shawn(a)redhat.com> wrote:
On 11/5/15 6:45 PM, Su Zhang wrote:
Hello everyone,
I am new to scap project. I played with OVAL long time ago. I remember
OVAL was able to output a list of CVEs with true or false status indicating
if there is a vulnerability or not within the target system. However, while
I am playing with scap, I can not see such list in the report.html.
Instead, I can only see succeed or failed tests against certain properties.
And only vectors like CCE, CWE are mentioned in the outcome report. Is
there any option I can use to create a CVE only report?
You'll want to use the vulnerability stream that Red Hat provides.
Documentation here:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
In brief:
$ wget
http://www.redhat.com/security/data/oval/com.redhat.rhsa-all.xml$ oscap oval eval
--results rhsa-results-oval.xml --report oval-report.html com.redhat.rhsa-all.xml
You'll get a report that includes the RHSA and CVE numbers, with a brief
description:
http://people.redhat.com/swells/patch_report.html
--
SCAP Security Guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
https://github.com/OpenSCAP/scap-security-guide/
--
Su Zhang