How Debian OVAL content is structured

Hello everyone! As we saw in the last episode, the results of vulnerability detection for one host produced by two different APIs can vary greatly. Therefore, in order to find out the truth, it is necessary to understand what vulnerability data is provided by the Linux distribution vendor and how this data is structured. Why is it important to do this? Because using data from a Linux distribution vendor, we can ask vulnerability detection API vendors questions: why are you detecting in a different way than described in this data? And then we will understand what caused the difference. And we will either adjust the API for vulnerability detection, or we will adjust the content of the Linux distribution vendor. Either way, it will be a success! In any case, the transparency of the vulnerability detection process will increase. 00:00 Why is it important? 01:34 Debian OVAL Definitions 02:36 oval::tst:1 Debian 11 is installed 03:22 oval::tst:2 all architecture 04:04 oval::tst:3 glibc DPKG is earlier than 04:41 Simplified data for vulnerability detection Blogpost: #OVAL #Debian #SCAP