Dagda has a parsing error with the image packages about dagda

[scumfrog]

Hi @eliasgranderubio,

I've been doing several tests, and I think this isnt a bug/issue, is a lack of functionality. Other solutions like OpenScap use OVAL definitions (in the case of openscap, RHEL's OVAL definitions), so you can, quickly, see if a package has a revision/patch or not. Several Linux distributions, such as Debian, Ubuntu, RHEL, Arch, already have parsable databases (OVAL):

https://www.debian.org/security/
https://security-tracker.debian.org/tracker/
http://www.ubuntu.com/usn/
https://bazaar.launchpad.net/~ubuntu-security/ubuntu-cve-tracker/
https://rhn.redhat.com/errata/
https://www.redhat.com/security/data/oval/
https://wiki.archlinux.org/index.php/CVEh

Do you have in mind to introduce this functionality in the future? Thanks in advance.

[eliasgranderubio]

Hi @scumfrog,

As you write in your last comment, this is not a real bug/issue, it is a lack of funcionality.

At the moment, Dagda only gets info about version number without epoch, specific release or patch. That is because BugTraq Ids or Exploit-DB have not too many information like CVEs and they are very dificult to standardize.

I'm thinking the best way how to do this standarization for improving the accurate and for avoiding false positives, so any PR with ideas will be appreciated too :-)

[scumfrog]

Sure @eliasgranderubio I'm thinking methods to do the thing in the better way, its hard complicated theme (vulnerability management). We'll keep in touch. Thanks for your help as always.