2 ms·

> It seems all this tool does is some kind of version matching (i.e. "a CVE has been reported for version x.y.z of software A, so a server running x.y.z is vuln

> It seems all this tool does is some kind of version matching (i.e. "a CVE has been reported for version x.y.z of software A, so a server running x.y.z is vulnerable"). This is a poor proxy for the actual existence of a vulnerability It sounds as though it's illustrative of a problem with either the index the scanner software is referring to or the update methodology the distro relies on. Debian don't really fix the software without incrementing the version number in some fashion, do they?

zerocrates 7y ago
It's pretty typical for these "backported" packages to have version numbers that only differ from the original by a suffix, and that suffix often only appears in the package manager. For example, the Debian stable Apache package is currently version 2.4.38-3+deb10u3, but Apache will typically report something less than all that information, like just 2.4.38. If it's really just looking at exposed version numbers, there's plenty of other problems, like servers that are configured to not expose their version numbers.