On 11/5/15 6:45 PM, Su Zhang wrote:
Hello everyone,
I am new to scap project. I played with OVAL long time ago. I remember OVAL was able to output a list of CVEs with true or false status indicating if there is a vulnerability or not within the target system. However, while I am playing with scap, I can not see such list in the report.html. Instead, I can only see succeed or failed tests against certain properties. And only vectors like CCE, CWE are mentioned in the outcome report. Is there any option I can use to create a CVE only report?
You'll want to use the vulnerability stream that Red Hat provides. Documentation here:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sect-Practical_Examples.html#sect-Auditing_Security_Vulnerabilities_Example
In brief:
$You'll get a report that includes the RHSA and CVE numbers, with a brief description: http://people.redhat.com/swells/patch_report.htmlwget http://www.redhat.com/security/data/oval/com.redhat.rhsa-all.xml
$oscap oval eval --results rhsa-results-oval.xml --report oval-report.html com.redhat.rhsa-all.xml
--
SCAP Security Guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
https://github.com/OpenSCAP/scap-security-guide/