4 ms·
Funny; our RHEL systems were a nightmare for compliance actually. Most of the tools the auditor/pentester type people use only search for, (completely fake exam
by cyberpunk 3y ago
Funny; our RHEL systems were a nightmare for compliance actually. Most of the tools the auditor/pentester type people use only search for, (completely fake example) libfoo 1.x.2 having a security hole, and redhat's libfoo 1.x.2-wibble13 even though it has a backported fix, is flagged as vulnerable.
For each one of these packages, it's a crazy process to prove that the CVE they reported isn't actually there, and it delays our accreditation to the point where it was easier for us to change distro than go thorough hundreds of these..
- NovemberWhiskey 3y agot.b.h. all this tells me is that your pentesters are bad.
- cyberpunk 3y agoBingo. We don't get to choose them, though, and they hold the strings on the certifications that our business needs. Sometimes it's easier to bend.
- attentive 3y agoIf they make a claim that some package has CVE and you can demonstrate that to be false as per official distro changelogs etc they can go hike.
- _ea1k 3y agoThe problem is that if they don't fix the tool, you'll get to tell them that every week (or however often they scan). Dealing with bad security audits isn't fun.
- bonzini 3y agoYou used to pay Red Hat, did you try passing them the hot potato?
- mshook 3y agoPretty much but that's my experience as well, I made the same comment above...
- jabl 3y agoPerhaps auditing tools should do something better than just comparing version numbers as released by upstream? Maybe Ubuntu LTS does less security backports than RHEL, but that doesn't make it better per se (saying this as an Ubuntu user).