Tell a real vulnerability from a version-string false positive

short · 30 min · Objective 3.6

Task

Run a compliance scan, then investigate one reported CVE and establish whether the host is actually vulnerable -- because a scanner comparing version strings reports fixes it cannot see. Learn the two commands that settle it.

Steps

  1. Run an OpenSCAP evaluation against a CIS profile and skim the results. Note the score and pick one failing rule. A CIS profile checks CONFIGURATION -- it reports no vulnerable packages at all. For those, ask the security advisory data: dnf updateinfo list --security (or, on RHEL, an oscap oval eval against Red Hat's published OVAL feed). Pick one package and one CVE from it, or a CVE a version-only scanner has flagged against a package you have, and set them: PKG=<package>; CVE=CVE-XXXX-YYYY.
  2. For the package, read its changelog: rpm -q --changelog "$PKG" | head -40. Look for a line mentioning the CVE.
  3. Cross-check with the vendor's security metadata: dnf updateinfo info --cve "$CVE". Establish whether the fix is already present in the installed version despite the version number.
  4. State the conclusion: is this a real exposure or a backport the scanner miscounted? Explain how you know.
  5. Now find something a version scanner would miss entirely: run ss -tlnp and find a service bound to 0.0.0.0 that should be local, or a default credential. Argue why that misconfiguration is a bigger practical risk than the CVE in step 4.
  6. Distinguish a Level 1 from a Level 2 finding in the scan output, and explain which you would apply to a production fleet without testing.

Verify

rpm -q --changelog "$PKG" | grep -i "$CVE" && echo "fix is backported into the installed version"
dnf updateinfo list --cve "$CVE"        # empty: no pending update for it on this host
ss -tlnp | grep -v '127.0.0.1\|::1' | grep LISTEN

If the changelog names the CVE, the host is patched and the scanner produced a false positive from the unchanged version number. If dnf updateinfo list still lists it, there is a real update to apply. One of the two must be true, and you should be able to say which.

Notes

The reachable misconfiguration in step 5 is the point that outlasts any single CVE. Exploiting a flaw needs it to be present, reachable and worth the effort; default credentials on an exposed interface need none of those. A version scanner never looks.

This is an independent study companion for CompTIA Linux+ and is not produced by or endorsed by CompTIA.