Could not load the CVE OVAL error for Canonical provider's feeds

[Rebits]

Wazuh version	Component	Install type	Install method	Platform
4.7.0	Vulnerability Detector	Manager	Packages	Any

Description

The Vulnerability Detector is failing to correctly parse Canonical provider's feeds. The manager's logs reveal the following errors:

2023/12/01 07:58:24 wazuh-modulesd:vulnerability-detector: ERROR: (5502): Could not load the CVE OVAL for 'TRUSTY'. 'XMLERR: Attribute '?' has no value.'
2023/12/01 07:58:24 wazuh-modulesd:vulnerability-detector: INFO: (5400): Starting 'Ubuntu Xenial' database update.
2023/12/01 07:58:27 sca: INFO: Evaluation finished for policy '/var/ossec/ruleset/sca/cis_ubuntu20-04.yml'
2023/12/01 07:58:27 sca: INFO: Security Configuration Assessment scan finished. Duration: 7 seconds.
2023/12/01 07:58:27 wazuh-modulesd:vulnerability-detector: ERROR: (5502): Could not load the CVE OVAL for 'XENIAL'. 'XMLERR: Attribute '?' has no value.'
2023/12/01 07:58:27 wazuh-modulesd:vulnerability-detector: INFO: (5400): Starting 'Ubuntu Bionic' database update.
2023/12/01 07:58:30 wazuh-modulesd:vulnerability-detector: ERROR: (5502): Could not load the CVE OVAL for 'BIONIC'. 'XMLERR: Attribute '?' has no value.'
2023/12/01 07:58:30 wazuh-modulesd:vulnerability-detector: INFO: (5400): Starting 'Ubuntu Focal' database update.
2023/12/01 07:58:32 wazuh-modulesd:vulnerability-detector: ERROR: (5502): Could not load the CVE OVAL for 'FOCAL'. 'XMLERR: Attribute '?' has no value.'

This issue appears to be linked to recent changes in the feeds from the providers, causing failures within the last 24 hours, as evidenced by the nightly tests:

• 01/12/2023: https://ci.wazuh.info/job/Test_integration/45154/artifact/manager_tests_Test_integration_B45154_20231201003126.txt: The Canonical feed's tests failed
• 30/11/2023: https://ci.wazuh.info/job/Test_integration/45121. Canonical feed's tests did not fail

Steps to reproduce

• Enable Vulnerability Detector and the Canonical provider in a manager:

  <vulnerability-detector>
    <enabled>yes</enabled>
    <interval>5m</interval>
    <min_full_scan_interval>6h</min_full_scan_interval>
    <run_on_start>yes</run_on_start>
....

    <!-- Ubuntu OS vulnerabilities -->
    <provider name="canonical">
      <enabled>yes</enabled>
      <os>trusty</os>
      <os>xenial</os>
      <os>bionic</os>
      <os>focal</os>
      <update_interval>1h</update_interval>
    </provider>

• Restart the manager and observe that the feeds are not correctly parsed:

2023/12/01 08:03:36 wazuh-modulesd:vulnerability-detector: ERROR: (5502): Could not load the CVE OVAL for 'FOCAL'. 'XMLERR: Attribute '?' has no value.'

[Alphaegen]

I've got the same problem on the same Wazuh version. I also had it on a version earlier than the one mentioned in this thread, but I don't remember which one it was as I thought updating it would fix the problem.

Dec 1, 2023 @ 01:39:51.000 wazuh-modulesd:vulnerability-detector INFO  (5400): Starting 'Ubuntu Trusty' database update.
Dec 1, 2023 @ 01:39:52.000 wazuh-modulesd:vulnerability-detector ERROR  (5502): Could not load the CVE OVAL for 'TRUSTY'. 'XMLERR: Attribute '?' has no value.'
Dec 1, 2023 @ 01:39:52.000 wazuh-modulesd:vulnerability-detector INFO  (5400): Starting 'Ubuntu Xenial' database update.
Dec 1, 2023 @ 01:39:52.000 wazuh-modulesd:vulnerability-detector ERROR  (5502): Could not load the CVE OVAL for 'XENIAL'. 'XMLERR: Attribute '?' has no value.'
Dec 1, 2023 @ 01:39:52.000 wazuh-modulesd:vulnerability-detector ERROR  (5513): CVE database could not be updated.
Dec 1, 2023 @ 01:39:53.000 wazuh-modulesd:vulnerability-detector INFO  (5400): Starting 'Ubuntu Bionic' database update.
Dec 1, 2023 @ 01:39:53.000 wazuh-modulesd:vulnerability-detector ERROR  (5502): Could not load the CVE OVAL for 'BIONIC'. 'XMLERR: Attribute '?' has no value.'
Dec 1, 2023 @ 01:39:53.000 wazuh-modulesd:vulnerability-detector INFO  (5400): Starting 'Ubuntu Focal' database update.
Dec 1, 2023 @ 01:39:54.000 wazuh-modulesd:vulnerability-detector ERROR  (5502): Could not load the CVE OVAL for 'FOCAL'. 'XMLERR: Attribute '?' has no value.'
Dec 1, 2023 @ 01:39:54.000 wazuh-modulesd:vulnerability-detector INFO  (5400): Starting 'Ubuntu Jammy' database update.
Dec 1, 2023 @ 01:39:54.000 wazuh-modulesd:vulnerability-detector ERROR  (5502): Could not load the CVE OVAL for 'JAMMY'. 'XMLERR: Attribute '?' has no value.'

[MarcelKemp]

Research

The bug is caused by Canonical adding the following line to the beginning of the OVAL, causing it to fail to parse the feed correctly:

<?xml version="1.0" ?>

Workaround

Download the OVALs to the server locally, unzip them and delete the first line (if it matches):

mkdir custom-ubuntu-ovals-fixed
cd custom-ubuntu-ovals-fixed
curl -SO https://security-metadata.canonical.com/oval/com.ubuntu.jammy.cve.oval.xml.bz2
curl -SO https://security-metadata.canonical.com/oval/com.ubuntu.focal.cve.oval.xml.bz2
curl -SO https://security-metadata.canonical.com/oval/com.ubuntu.bionic.cve.oval.xml.bz2
curl -SO https://security-metadata.canonical.com/oval/com.ubuntu.xenial.cve.oval.xml.bz2
curl -SO https://security-metadata.canonical.com/oval/com.ubuntu.trusty.cve.oval.xml.bz2
bzip2 -d com.ubuntu.*
sed -i '/<?xml version="1.0" ?>/d' com.ubuntu.*

Once the above is done, modify the Canonical provider configuration block, for its corresponding offline update:

As this is an offline update, it is necessary to manually download the feeds to keep them up to date.

    <provider name="canonical">
      <enabled>yes</enabled>
      <os path="/custom-ubuntu-ovals-fixed/com.ubuntu.trusty.cve.oval.xml">trusty</os>
      <os path="/custom-ubuntu-ovals-fixed/com.ubuntu.xenial.cve.oval.xml">xenial</os>
      <os path="/custom-ubuntu-ovals-fixed/com.ubuntu.bionic.cve.oval.xml">bionic</os>
      <os path="/custom-ubuntu-ovals-fixed/com.ubuntu.focal.cve.oval.xml">focal</os>
      <os path="/custom-ubuntu-ovals-fixed/com.ubuntu.jammy.cve.oval.xml">jammy</os>
      <update_interval>1h</update_interval>
    </provider>

Note: Modify the path, depending on where you have executed the commands.

And in the case of using ESM OVALs, apply the same steps but change the links and file names.