Thanks for your response.
I looked into the doc and found the following description

"The oscap utility maps Red Hat Security Advisories to CVE identifiers that are linked to the National Vulnerability Database and reports which security advisories are not applied."

However, does Red Hat security advisories capture all CVEs? Or it only capture its own product related CVEs? If it does not have a comprehensive CVEs, then do you know how to incorporate the entire NVD vulnerability data?



On Thu, Nov 5, 2015 at 5:06 PM, Shawn Wells <> wrote:

On 11/5/15 6:45 PM, Su Zhang wrote:
Hello everyone,

I am new to scap project. I played with OVAL long time ago. I remember OVAL was able to output a list of CVEs with true or false status indicating if there is a vulnerability or not within the target system. However, while I am playing with scap, I can not see such list in the report.html. Instead, I can only see succeed or failed tests against certain properties. And only vectors like CCE, CWE are mentioned in the outcome report. Is there any option I can use to create a CVE only report?

You'll want to use the vulnerability stream that Red Hat provides. Documentation here:

In brief:

$ wget
$ oscap oval eval --results rhsa-results-oval.xml --report oval-report.html com.redhat.rhsa-all.xml
You'll get a report that includes the RHSA and CVE numbers, with a brief description:

SCAP Security Guide mailing list

Su Zhang