On 11/15/17 8:08 PM, 面和毅 wrote:
Dear all,
I'm writing openscap article for Web magazine(ThinkIT/Japan)
, then I found CentOS OVAL file's CESA-2017:XX is not
included on it.
https://oval.cisecurity.org/repository/download/5.11.1/compliance/centos_...
Does somebody know how is the status for the xml file?
CIS maintains their content outside of the CentOS community and has no
relation with the SCAP Security Guide project. You'd have to check with
CIS about their baselines.
I wish to update it if it will not be released, but before do it
I just want to know is there any reason to stop to develop the xml file.
What's
your goal? Would the SSG CentOS content work, or are you looking
to develop something with CIS (they are two different communities)?
Also, I modified Red Hat OVAL file for CentOS 7.
But I guess there is some problem if I publish it
on my github, right?
https://www.redhat.com/security/data/oval/ Not sure anyone has asked before.
Generally lack of a license means
default copyright laws apply... no reproduction/distribution/derivative
works. Clearly that's not the Red Hat way and something that should get
cleared up.
Consider emailing site-security(a)redhat.com to get an official answer.
You'll also want to review what the CentOS team had to say about their
CVE process. They make no claims their patches align to Red Hat CVEs --
which is why the Red Hat OVAL feed does not support scanning of CentOS
hosts. You may be giving users a very false sense of security. Even more
so for regulated environments (who would actually be checking for CVEs).
https://lists.centos.org/pipermail/centos/2014-May/143094.html