Skip to content

0.4.7 — audit-driven correctness & security hardening

Choose a tag to compare

View all tags
@btdt1983 btdt1983 released this 19 Jul 19:25
v0.4.7
f85f4be

0.4.7 — audit-driven correctness & security hardening

A adversarial review of the whole codebase; every real defect it surfaced is fixed. No user-facing surface change (no new commands, flags, or config keys).

Truthfulness (remediation engine)

  • Auto-rollback now reports honestly. A rollback whose file restore or service revert failed no longer stamps a clean rollback — the CLI and the audit log were reporting "reverted, service left healthy" on a half-reverted host.
  • Empty plans are no longer "applied". A prose-only fix plan (no commands) is no longer reported as applied; the dashboard apply path was writing a false applied audit entry for a no-op.

Security

  • Exported-script heredoc break-out closed. fix --export-script now uses a unique heredoc delimiter, so crafted/hallucinated file content can't terminate the heredoc early and inject commands the operator runs as root.
  • OVAL decompression-bomb guard. The OVAL feed is now decompressed with a size cap (it runs as root during update-oval / auto-refresh) and refuses a DOCTYPE.

Robustness — never abort the scan

  • Malformed CVE-feed JSON (NVD / EPSS / CISA-KEV) can no longer crash a whole scan; enrichment fails per-finding.
  • A package-less oscap advisory is no longer dropped on an empty-but-successful updateinfo set — that was silently hiding real, unpatched advisories.

Lower-severity

Null-tolerant report/dashboard rendering, version-ordered (not install-ordered) kernel-currency check, corrupt-config tolerance, string-aware model-JSON extraction, a capped dashboard request body, and more.

305 tests (+12 regressions), bandit medium+ clean.

Install / upgrade

Existing techhack-repo users: sudo dnf upgrade vulnscan-ai
Fresh install: https://vulnscan-ai.techhack.nl

Assets 5
Loading