Backport-aware CVE detection for Debian/SUSE-style distributions
I'm a Linux administrator, and recently I've been wondering why many security tools (for example, Wazuh) do not properly understand distribution backporting. As a result, they constantly report messages like "258,235 vulnerabilities are open", even though the system is actually patched.
I use an RSS feed tool to track Debian Security Advisories, so I read these updates very frequently. However, some advisories affect packages I'm not even sure are installed in my environment. Because of that, I regularly have to query the entire server fleet via Ansible to check whether a package is present anywhere. After that, I manually review the CVE score and the vulnerability description to decide whether action is needed.
This made me wonder: why is there no tool (I'm using Debian) that automates this process? Given how large the ecosystem is, I assumed someone must have already built something like this, but I couldn't find anything that really fits. Unfortunately, I also don't have the time to build and maintain such a tool myself.
The idea would be a solution that understands backporting across different distributions (Debian, SUSE, etc.) and produces an accurate CVE list based on what is actually installed and already fixed via backports. I know PatchMon is not a full security tool, but I think something along these lines could still be very helpful for many admins.
Originally requested by gamingapple_it in Discord #ideas.
5 Comments
We are using Wazuh in our company to monitor more than 1,500 dedicated and virtual servers, but the CVE list is extremely noisy due to false positives.
·6 months agoI started building this out ans was able to combine all the CVE databases into a common format but it was at the early stages.
I need to dig out the code from my broken laptop and carry on with it. 🙂
some very valid points you’re raising and this will be done for sure
Please do it better than most existing security tools and make the system backport-aware. I know this is difficult, since it would require parsing the Debian Security Advisory feed and correlating it with backported package versions from the linked advisories, but a solution like this would be incredibly valuable not just for Debian, and certainly not easy to implement.
Yeah, I use Wazuh too, it's very noisy and too detailed - I got some inspiration from there but it will get done for sure. 🙂