diff --git a/oval/redhat.go b/oval/redhat.go index c554adf4..ff519618 100644 --- a/oval/redhat.go +++ b/oval/redhat.go @@ -100,7 +100,7 @@ func (o RedHatBase) update(r *models.ScanResult, defPacks defPacks) (nCVEs int) cveContents := vinfo.CveContents if v, ok := vinfo.CveContents[ctype]; ok { if v.LastModified.After(ovalContent.LastModified) { - util.Log.Debugf("%s, OvalID: %d ignroed: ", + util.Log.Debugf("%s, OvalID: %d ignored: ", cve.CveID, defPacks.def.ID) } else { util.Log.Debugf("%s OVAL will be overwritten", cve.CveID) diff --git a/scan/redhatbase.go b/scan/redhatbase.go index 79d05787..2cc270f1 100644 --- a/scan/redhatbase.go +++ b/scan/redhatbase.go @@ -279,13 +279,13 @@ func (o *redhatBase) parseInstalledPackages(stdout string) (models.Packages, mod // openssl 0 1.0.1e 30.el6.11 x86_64 lines := strings.Split(stdout, "\n") for _, line := range lines { - if trimed := strings.TrimSpace(line); len(trimed) != 0 { + if trimmed := strings.TrimSpace(line); len(trimmed) != 0 { pack, err := o.parseInstalledPackagesLine(line) if err != nil { return nil, nil, err } - // Kernel package may be isntalled multiple versions. + // `Kernel` and `kernel-devel` package may be installed multiple versions. // From the viewpoint of vulnerability detection, // pay attention only to the running kernel isKernel, running := isRunningKernel(pack, o.Distro.Family, o.Kernel) diff --git a/scan/redhatbase_test.go b/scan/redhatbase_test.go index ec8a4c94..a52eeec7 100644 --- a/scan/redhatbase_test.go +++ b/scan/redhatbase_test.go @@ -25,10 +25,10 @@ func TestParseInstalledPackagesLinesRedhat(t *testing.T) { }{ { in: `openssl 0 1.0.1e 30.el6.11 x86_64 - Percona-Server-shared-56 1 5.6.19 rel67.0.el6 x84_64 - kernel 0 2.6.32 696.20.1.el6 x86_64 - kernel 0 2.6.32 696.20.3.el6 x86_64 - kernel 0 2.6.32 695.20.3.el6 x86_64`, +Percona-Server-shared-56 1 5.6.19 rel67.0.el6 x84_64 +kernel 0 2.6.32 696.20.1.el6 x86_64 +kernel 0 2.6.32 696.20.3.el6 x86_64 +kernel 0 2.6.32 695.20.3.el6 x86_64`, kernel: models.Kernel{}, packages: models.Packages{ "openssl": models.Package{ @@ -50,10 +50,46 @@ func TestParseInstalledPackagesLinesRedhat(t *testing.T) { }, { in: `openssl 0 1.0.1e 30.el6.11 x86_64 - Percona-Server-shared-56 1 5.6.19 rel67.0.el6 x84_64 - kernel 0 2.6.32 696.20.1.el6 x86_64 - kernel 0 2.6.32 696.20.3.el6 x86_64 - kernel 0 2.6.32 695.20.3.el6 x86_64`, +Percona-Server-shared-56 1 5.6.19 rel67.0.el6 x84_64 +kernel 0 2.6.32 696.20.1.el6 x86_64 +kernel 0 2.6.32 696.20.3.el6 x86_64 +kernel 0 2.6.32 695.20.3.el6 x86_64 +kernel-devel 0 2.6.32 696.20.1.el6 x86_64 +kernel-devel 0 2.6.32 696.20.3.el6 x86_64 +kernel-devel 0 2.6.32 695.20.3.el6 x86_64`, + kernel: models.Kernel{Release: "2.6.32-696.20.3.el6.x86_64"}, + packages: models.Packages{ + "openssl": models.Package{ + Name: "openssl", + Version: "1.0.1e", + Release: "30.el6.11", + }, + "Percona-Server-shared-56": models.Package{ + Name: "Percona-Server-shared-56", + Version: "1:5.6.19", + Release: "rel67.0.el6", + }, + "kernel": models.Package{ + Name: "kernel", + Version: "2.6.32", + Release: "696.20.3.el6", + }, + "kernel-devel": models.Package{ + Name: "kernel-devel", + Version: "2.6.32", + Release: "696.20.3.el6", + }, + }, + }, + { + in: `openssl 0 1.0.1e 30.el6.11 x86_64 +Percona-Server-shared-56 1 5.6.19 rel67.0.el6 x84_64 +kernel 0 2.6.32 696.20.1.el6 x86_64 +kernel 0 2.6.32 696.20.3.el6 x86_64 +kernel 0 2.6.32 695.20.3.el6 x86_64 +kernel-devel 0 2.6.32 696.20.1.el6 x86_64 +kernel-devel 0 2.6.32 696.20.3.el6 x86_64 +kernel-devel 0 2.6.32 695.20.3.el6 x86_64`, kernel: models.Kernel{Release: "2.6.32-695.20.3.el6.x86_64"}, packages: models.Packages{ "openssl": models.Package{ @@ -71,6 +107,11 @@ func TestParseInstalledPackagesLinesRedhat(t *testing.T) { Version: "2.6.32", Release: "695.20.3.el6", }, + "kernel-devel": models.Package{ + Name: "kernel-devel", + Version: "2.6.32", + Release: "695.20.3.el6", + }, }, }, } diff --git a/scan/utils.go b/scan/utils.go index a40d5021..5cb98f6d 100644 --- a/scan/utils.go +++ b/scan/utils.go @@ -22,7 +22,8 @@ func isRunningKernel(pack models.Package, family string, kernel models.Kernel) ( return false, false case config.RedHat, config.Oracle, config.CentOS, config.Amazon: - if pack.Name == "kernel" { + switch pack.Name { + case "kernel", "kernel-devel": ver := fmt.Sprintf("%s-%s.%s", pack.Version, pack.Release, pack.Arch) return true, kernel.Release == ver }