On 11/15/17 8:08 PM, 面和毅 wrote:
Dear all,

I'm writing openscap article for Web magazine(ThinkIT/Japan)
, then I found CentOS OVAL file's CESA-2017:XX is not
included on it.

https://oval.cisecurity.org/repository/download/5.11.1/compliance/centos_linux_7.xml

Does somebody know how is the status for the xml file?

CIS maintains their content outside of the CentOS community and has no relation with the SCAP Security Guide project. You'd have to check with CIS about their baselines.

I wish to update it if it will not be released, but before do it
I just want to know is there any reason to stop to develop the xml file.
What's your goal? Would the SSG CentOS content work, or are you looking to develop something with CIS (they are two different communities)?

Also, I modified Red Hat OVAL file for CentOS 7.
But I guess there is some problem if I publish it
on my github, right?

https://www.redhat.com/security/data/oval/
Not sure anyone has asked before. Generally lack of a license means default copyright laws apply... no reproduction/distribution/derivative works.  Clearly that's not the Red Hat way and something that should get cleared up.

Consider emailing site-security@redhat.com to get an official answer.

You'll also want to review what the CentOS team had to say about their CVE process. They make no claims their patches align to Red Hat CVEs -- which is why the Red Hat OVAL feed does not support scanning of CentOS hosts. You may be giving users a very false sense of security. Even more so for regulated environments (who would actually be checking for CVEs).

https://lists.centos.org/pipermail/centos/2014-May/143094.html