Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1110959" data-attributes="member: 96560">I prefer to search for Live data myself:&nbsp;&nbsp; <a href="https://www.tenable.com/cve" target="_blank">Common Vulnerabilities and Exposures (CVEs)</a> . Oval relies on old static data available on the ubuntu server: security-metadata.canonical.com . I suspect it only reports Patched vulnerablities, because all of the items in that list says &#039;patch&#039;. There has to be some undergoing evaluation, and some that have undergone evaluation and are rated unimportant and so on. Imho, it is more useful to see what a potential attacker sees when he is doing reconnaissance.On the other hand ubuntu&#039;s site revealed things I have missed when doing my searches. Ubuntu knows the complete list of components that are in use in it&#039;s releases. I need to be more careful and expand my searching. That oval report is good for people who need to do extensive testing before patching and are forever behind in patching. I don&#039;t have any custom applications that requires me to do testing. Ubuntu&#039;s own testing is good enough for me.</blockquote>

[QUOTE="Victor M, post: 1110959, member: 96560"] I prefer to search for Live data myself: [URL='https://www.tenable.com/cve']Common Vulnerabilities and Exposures (CVEs)[/URL] . Oval relies on old static data available on the ubuntu server: security-metadata.canonical.com . I suspect it only reports Patched vulnerablities, because all of the items in that list says 'patch'. There has to be some undergoing evaluation, and some that have undergone evaluation and are rated unimportant and so on. Imho, it is more useful to see what a potential attacker sees when he is doing reconnaissance. On the other hand ubuntu's site revealed things I have missed when doing my searches. Ubuntu knows the complete list of components that are in use in it's releases. I need to be more careful and expand my searching. That oval report is good for people who need to do extensive testing before patching and are forever behind in patching. I don't have any custom applications that requires me to do testing. Ubuntu's own testing is good enough for me. [/QUOTE]

Verification