could anyone please let me know how to obtain a vulnerability only (CVE) list output

Su Zhang westlifezs at gmail.com
Tue Nov 10 20:04:25 UTC 2015


Thanks for your response.
I looked into the doc and found the following description

"The oscap utility maps Red Hat Security Advisories to CVE identifiers that
are linked to the National Vulnerability Database and reports which
security advisories are not applied."

However, does Red Hat security advisories capture all CVEs? Or it only
capture its own product related CVEs? If it does not have a comprehensive
CVEs, then do you know how to incorporate the entire NVD vulnerability data?

Thanks,

Su

On Thu, Nov 5, 2015 at 5:06 PM, Shawn Wells <shawn at redhat.com> wrote:

>
>
> On 11/5/15 6:45 PM, Su Zhang wrote:
>
> Hello everyone,
>
> I am new to scap project. I played with OVAL long time ago. I remember
> OVAL was able to output a list of CVEs with true or false status indicating
> if there is a vulnerability or not within the target system. However, while
> I am playing with scap, I can not see such list in the report.html.
> Instead, I can only see succeed or failed tests against certain properties.
> And only vectors like CCE, CWE are mentioned in the outcome report. Is
> there any option I can use to create a CVE only report?
>
>
> You'll want to use the vulnerability stream that Red Hat provides.
> Documentation here:
>
> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sect-Practical_Examples.html#sect-Auditing_Security_Vulnerabilities_Example
>
> In brief:
>
> $ wget http://www.redhat.com/security/data/oval/com.redhat.rhsa-all.xml$ oscap oval eval --results rhsa-results-oval.xml --report oval-report.html com.redhat.rhsa-all.xml
>
> You'll get a report that includes the RHSA and CVE numbers, with a brief
> description: http://people.redhat.com/swells/patch_report.html
>
> --
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
>



-- 
Su Zhang
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20151110/880cf4da/attachment.html>


More information about the scap-security-guide mailing list