0

did OpenSCAP scan initially and was inform of that the server had 16 hits on definitions that require patching.

performed yum update and rebooted said server and its reflecting the newer version :2.6.32-696.20.1.el6.x86_64

after patching, re-did OpenSCAP scan and the 16 hits are still marked as true. checked CVEs details on redhat forum links for the CVEs and my server should have already have those patched as my kernel is updated.

as precaution, removed older copies of the redhat definition file (Red_Hat_Enterprise_Linux_6.xml) and re did a the evaluation scan. results still presenting as 16 hits on CVE vulnerabilities.

performed manual scan per CVE getting true for them.

output on the results of the indivdual scans as follows as sample.

oscap oval eval --id oval:com.redhat.rhsa:def:20180169 /Red_Hat_Enterprise_Linux_6.xml Definition oval:com.redhat.rhsa:def:20180169: true Evaluation done. [kernel-2.6.32-696.20.1.el6.x86_64.rpm fix as per redhat]

oscap oval eval --id oval:com.redhat.rhsa:def:20180008 /Red_Hat_Enterprise_Linux_6.xml Definition oval:com.redhat.rhsa:def:20180008: true Evaluation done. [kernel-2.6.32-696.18.7.el6.x86_64.rpm fix as per redhat]

Would greatly appreciate for guidance if i did something wrong or insights on what could have resulted in this scenario.

my server version : 2.6.32-696.20.1.el6.x86_64 OpenSCAP version ==== Supported specifications ==== XCCDF Version: 1.2 OVAL Version: 5.11.1 CPE Version: 2.3 CVSS Version: 2.0 CVE Version: 2.0 Asset Identification Version: 1.1 Asset Reporting Format Version: 1.1

Zak SiJie Ang
  • 3
  • 3

1 Answers1

0

the scan is reporting true because you have still installed the older kernel packages on your system. Please try removing the older kernel (2.6.32-696.18.7) from your system and scan again - it should no more report that your system is vulnerable.

tux
  • 16
  • noted on that. thanks for the advice:) will test it out and verify if its working – Zak SiJie Ang Mar 21 '18 at 03:58
  • Hi, removed the old kernels, leaving only the latest kernel, and it still shows me that the patches for the previous kernels are still marked as true in the latest openscap scan:( – Zak SiJie Ang Mar 27 '18 at 07:55