CVE not detected but present in database

[Obanni]

Hello, I used Vuls to find the vulnerability CVE-2020-11651. However, it does not work, the version of the package and CVE is well found but nothing does not appear in the report.

Package

Package is found inside the /results/.json

"salt":{ "name":"salt", "version":"2017.7.5", "release":"1.el7", "newVersion":"", "newRelease":"", "arch":"noarch", "repository":"", "changelog":{ "contents":"", "method":"" } }, "salt-master":{ "name":"salt-master", "version":"2017.7.5", "release":"1.el7", "newVersion":"", "newRelease":"", "arch":"noarch", "repository":"", "changelog":{ "contents":"", "method":"" } }

CVE

CVE can be found in the cve.sqlite3

OVAL

Result

CVE is not detected and does not appear with $ ./report.sh | grep 2020-11651

Config

[servers]

[servers.x-x-x-x]
host = "x.x.x.x"
port = "22"
user = "root"
keyPath = "/root/.ssh/id_rsa"

[exploit]
type = "sqlite3"
sqlite3Path = "/vuls/go-exploitdb.sqlite3"

[cveDict]
type = "sqlite3"
sqlite3Path = "/vuls/cve.sqlite3"

[ovalDict]
type = "sqlite3"
sqlite3Path = "/vuls/oval.sqlite3"

[kotakanbe]

Vuls uses OVAL data to scan RHEL and CentOS7.

CVE-2020-11651 is not in OVAL for Red Hat Enterprise Linux 7.

 ubuntu@dev  ~│work  curl https://www.redhat.com/security/data/oval/Red_Hat_Enterprise_Linux_7.xml | grep CVE-2020-11651
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 15.6M    0 15.6M    0     0  25.5M      0 --:--:-- --:--:-- --:--:-- 25.5M
 ✗  ubuntu@dev  ~│work

https://access.redhat.com/security/cve/cve-2020-11651

According to the Red Hat page, CVE-2020-11651 does not seem to affect RHEL7.

[hachh]

Hi,

I understand that CVE-2020-1165 does not affect RHEL7 product, but it affects saltstack that can be installed on RHEL7 with saltstask redhat repository.
So how are we supposed to detect this vulnerability ? Does it need specific database because this package is not included in RHEL repository ?

[kotakanbe]

Yes, it's difficult without that database. I don't know if the database is public.

Or, try the following and let me know the results.
(I don't have that environment, so I want you to try it in your environment.)

Will CVE-2020-1165 be detected when the following command is issued?

yum --security updateinfo list updates
yum --security updateinfo updates

If CVE-2020-1165 can be detected above, it can be achieved by executing the above command on the server to be scanned. Additional implementation is needed though.