vulsio / vulsctl

Easy setup tool for Vuls

Vulsctl

Vulsctl was created to ease setup for Vuls. Each shell script is a wrapper for docker command.

For details, see

• Install with vulsctl
• Install with vulsctl on host
• Tutorial

vulsctl's Issues

How to dump default sqllite data to mysql

I have set the config.toml like flowing but not dump to mysql; i should change the comand-line like --config or --dbtype --dbstring of shell scripts.

# https://vuls.io/docs/en/usage-settings.html#servers-section
[servers]
[servers.testserver]
host = "192.168.51.252"
port = "22"
user = "root"
keyPath = "/root/.ssh/id_rsa"
scanMode = [ "fast-root" ]

[cveDict]
type = "mysql"
url = "root:vulspa55@tcp(127.0.0.1:3306)/vuls_cve?parseTime=true"

[ovalDict]
type = "mysql"
url = "root:vulspa55@tcp(127.0.0.1:3306)/vuls_goval?parseTime=true"

[gost]
type = "mysql"
url = "root:vulspa55@tcp(127.0.0.1:3306)/vuls_gost?parseTime=true"

[exploit]
type = "mysql"
url = "root:vulspa55@tcp(127.0.0.1:3306)/vuls_exploit?parseTime=true"

vuls fails to detect CentOS Stream 8 on remote host

Scenario

Run "vuls configtest" or "vuls scan" for remote host with Centos Stream 8 on remote host.

Expected result

CentOS Stream 8 OS is properly detected and "config-test" or "scan" command completes.

Actual result

Command generates "Panic: runtime error: slice bounds out of range [:-1]" and is stuck forever.

# vuls configtest -debug -config=config.toml

[Feb 13 18:02:45]  INFO [localhost] vuls-v0.19.3-build-20220213_175535_0733561
[Feb 13 18:02:45]  INFO [localhost] Validating config...
[Feb 13 18:02:45]  INFO [localhost] Detecting Server/Container OS...
[Feb 13 18:02:45]  INFO [localhost] Detecting OS of servers...
[Feb 13 18:02:45] DEBUG [localhost] Validating SSH Settings for Server:remotehost ...
[Feb 13 18:02:45] DEBUG [localhost] Executing... /usr/bin/ssh -G -p 222 -l root 10.23.0.22
[Feb 13 18:02:45] DEBUG [localhost] Setting SSH User:root for Server:remotehost ...
[Feb 13 18:02:45] DEBUG [localhost] Validating SSH HostName:10.23.0.22 for Server:remotehost ...
[Feb 13 18:02:45] DEBUG [localhost] Setting SSH Port:222 for Server:remotehost ...
[Feb 13 18:02:45] DEBUG [localhost] Checking if the host's public key is in known_hosts...
[Feb 13 18:02:45] DEBUG [localhost] Executing... /usr/bin/ssh-keygen -F "[10.23.0.22]:222" -f ~/.ssh/known_hosts
[Feb 13 18:02:45] DEBUG [localhost] Executing... ls /etc/debian_version
[Feb 13 18:02:45] DEBUG [localhost] execResult: servername: remotehost
  cmd: /usr/bin/ssh -tt -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/home/sbcadmin/.vuls/controlmaster-%r-remotehost.%p -o Controlpersist=10m -l root -p 222 -i /home/sbcadmin/.ssh/id_rsa -o PasswordAuthentication=no 10.23.0.22 stty cols 1000; ls /etc/debian_version
  exitstatus: 2
  stdout: ls: cannot access '/etc/debian_version': No such file or directory

  stderr:
  err: %!s(<nil>)
[Feb 13 18:02:45] DEBUG [localhost] Not Debian like Linux. execResult: servername: remotehost
  cmd: /usr/bin/ssh -tt -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/home/sbcadmin/.vuls/controlmaster-%r-remotehost.%p -o Controlpersist=10m -l root -p 222 -i /home/sbcadmin/.ssh/id_rsa -o PasswordAuthentication=no 10.23.0.22 stty cols 1000; ls /etc/debian_version
  exitstatus: 2
  stdout: ls: cannot access '/etc/debian_version': No such file or directory

  stderr:
  err: %!s(<nil>)
[Feb 13 18:02:45] DEBUG [localhost] Executing... ls /etc/fedora-release
[Feb 13 18:02:45] DEBUG [localhost] execResult: servername: remotehost
  cmd: /usr/bin/ssh -tt -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/home/sbcadmin/.vuls/controlmaster-%r-remotehost.%p -o Controlpersist=10m -l root -p 222 -i /home/sbcadmin/.ssh/id_rsa -o PasswordAuthentication=no 10.23.0.22 stty cols 1000; ls /etc/fedora-release
  exitstatus: 2
  stdout: ls: cannot access '/etc/fedora-release': No such file or directory

  stderr:
  err: %!s(<nil>)
[Feb 13 18:02:45] DEBUG [localhost] Executing... ls /etc/oracle-release
[Feb 13 18:02:45] DEBUG [localhost] execResult: servername: remotehost
  cmd: /usr/bin/ssh -tt -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/home/sbcadmin/.vuls/controlmaster-%r-remotehost.%p -o Controlpersist=10m -l root -p 222 -i /home/sbcadmin/.ssh/id_rsa -o PasswordAuthentication=no 10.23.0.22 stty cols 1000; ls /etc/oracle-release
  exitstatus: 2
  stdout: ls: cannot access '/etc/oracle-release': No such file or directory

  stderr:
  err: %!s(<nil>)
[Feb 13 18:02:45] DEBUG [localhost] Executing... ls /etc/almalinux-release
[Feb 13 18:02:45] DEBUG [localhost] execResult: servername: remotehost
  cmd: /usr/bin/ssh -tt -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/home/sbcadmin/.vuls/controlmaster-%r-remotehost.%p -o Controlpersist=10m -l root -p 222 -i /home/sbcadmin/.ssh/id_rsa -o PasswordAuthentication=no 10.23.0.22 stty cols 1000; ls /etc/almalinux-release
  exitstatus: 2
  stdout: ls: cannot access '/etc/almalinux-release': No such file or directory

  stderr:
  err: %!s(<nil>)
[Feb 13 18:02:45] DEBUG [localhost] Executing... ls /etc/rocky-release
[Feb 13 18:02:45] DEBUG [localhost] execResult: servername: remotehost
  cmd: /usr/bin/ssh -tt -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/home/sbcadmin/.vuls/controlmaster-%r-remotehost.%p -o Controlpersist=10m -l root -p 222 -i /home/sbcadmin/.ssh/id_rsa -o PasswordAuthentication=no 10.23.0.22 stty cols 1000; ls /etc/rocky-release
  exitstatus: 2
  stdout: ls: cannot access '/etc/rocky-release': No such file or directory

  stderr:
  err: %!s(<nil>)
[Feb 13 18:02:45] DEBUG [localhost] Executing... ls /etc/centos-release
[Feb 13 18:02:45] DEBUG [localhost] execResult: servername: remotehost
  cmd: /usr/bin/ssh -tt -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/home/sbcadmin/.vuls/controlmaster-%r-remotehost.%p -o Controlpersist=10m -l root -p 222 -i /home/sbcadmin/.ssh/id_rsa -o PasswordAuthentication=no 10.23.0.22 stty cols 1000; ls /etc/centos-release
  exitstatus: 0
  stdout: /etc/centos-release

  stderr:
  err: %!s(<nil>)
[Feb 13 18:02:45] DEBUG [localhost] Executing... cat /etc/centos-release
[Feb 13 18:02:46] DEBUG [localhost] execResult: servername: remotehost
  cmd: /usr/bin/ssh -tt -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/home/sbcadmin/.vuls/controlmaster-%r-remotehost.%p -o Controlpersist=10m -l root -p 222 -i /home/sbcadmin/.ssh/id_rsa -o PasswordAuthentication=no 10.23.0.22 stty cols 1000; cat /etc/centos-release
  exitstatus: 0
  stdout: CentOS Stream release 8

  stderr:
  err: %!s(<nil>)
[Feb 13 18:02:46] DEBUG [localhost] Panic: runtime error: slice bounds out of range [:-1] on remotehost

Problem is reproduced both with "quick install" (via docker) and "manual install on host".

Config file

[servers]

[servers.remotehost]
host               = "10.23.0.22"
user               = "root"
port               = "222"
keyPath            = "/home/sbcadmin/.ssh/id_rsa"
scanMode           = ["fast-root"]

Go environment variables should be defined only if Go is not already installed

Go env variables should be set only if go doesn't already exists in the system.

vulsctl/install-host/install.sh

Lines 9 to 17 in c9c0845

	export GOROOT=/usr/local/go;
	export GOPATH=$HOME/go;
	export PATH=$PATH:$GOROOT/bin:$GOPATH/bin;
	if command -v go > /dev/null
	then
	echo "Go is already installed."
	return
	fi

In my case for example, I already installed go and defined $GOPATH variable. So install.sh will define another $GOPATH, and install new go modules there.

If you agree, I can do a quick pull request to fix this.

PS : Thank you for this wonderful tool

Hardcoded version in cvedb does not match with latest release of vuls

Thank you for this great tool.

I found in install-host/cvedb.sh, the version of vuls which has cve.sqlite3.gz is hardcoded as v0.13.1.

vulsctl/install-host/cvedb.sh

Lines 3 to 7 in b1c62ac

	RELEASE=v0.13.1
	URL=https://github.com/future-architect/vuls/releases/download/${RELEASE}/cve.sqlite3.gz
	if [ ! -e ./cve.sqlite3 ]; then
	echo "Fetching cve.sqlite3 from GitHub Vuls: ${URL}"

In the other hand, the latest released version of vuls with cve.sqlite3.gz should be currently v0.15.10.
I don't check the code well but this may cause some schema problem.
If you don't have a reason to keep it as v0.13.1, I can do a pull request to change this oneline.

Regards,

config.toml.remotescan - multiple host example

Hi,

How would multiple hosts be defined in the config.toml the example only shows one host. is servers able to be a group of hosts? How do you define each host?

[servers]
[servers.group1]
host        = "192.168.1.20"
port        = "22"
user        = "vuls"
keyPath     = "/root/.ssh/id_rsa"
host        = "192.168.1.21"
port        = "22"
user        = "vuls"
keyPath     = "/root/.ssh/id_rsa"

or

[servers]
[servers.host1]
host        = "192.168.1.20"
port        = "22"
user        = "vuls"
keyPath     = "/root/.ssh/id_rsa"
[servers.host2]
host        = "192.168.1.21"
port        = "22"
user        = "vuls"
keyPath     = "/root/.ssh/id_rsa"

~

Can not run the "install.sh" Syntax error

wget https://github.com/vulsio/vulsctl/blob/master/install-host/install.sh

sudo chmod +x install.sh && ./install.sh

install.sh: line 7: syntax error near unexpected token newline' install.sh: line 7: '

Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again

The gost shcema has been changed by this pull request.
https://github.com/knqyf263/gost/pull/60

If you get the following Error when fetching gost, please delete the old database and fetch again.

EROR[05-14|09:36:04] Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again 
Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again.

scan fails to complete with error - dial tcp [::1]:25:

Hi,

I'n not sure how to resolve this issue. It seems to try and connect to port 25 and that fails. Running with Debug did not show anything specific. The first mention of anything wrong is the "Error on host" Error message.

[Jun 30 10:36:13]  INFO [host1] Scanning listen port...
[Jun 30 10:36:13]  INFO [host1] Using Port Scanner: Vuls built-in Scanner
[Jun 30 10:36:16] ERROR [localhost] Error on host1, err: [Failed to scan Ports:
    github.com/future-architect/vuls/scanner.Scanner.getScanResults.func1
        /go/src/github.com/future-architect/vuls/scanner/serverapi.go:654
  - dial tcp [::1]:25: connect: cannot assign requested address]


Scan Summary
================
[Reboot Required] host1	Error		Use configtest subcommand or scan with --debug to view the details


[Jun 30 10:36:16] ERROR [localhost] Failed to scan: Failed to scan. err:
    github.com/future-architect/vuls/scanner.Scanner.Scan
        /go/src/github.com/future-architect/vuls/scanner/serverapi.go:103
  - An error occurred on [host1]

Output from netstat

→ netstat -ntlp | grep ":25"
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1375/master         
tcp6       0      0 ::1:25                  :::*                    LISTEN      1375/master  

OVAL database missing Ubuntu 21.04

Running the latest version of vulsctl via docker and having run update-all.sh, performing a scan of a system running Ubuntu 21.04 fails to generate a report because there are no OVAL definitions for 21.04 (I think):

Using default tag: latest
latest: Pulling from vuls/vuls
Digest: sha256:65e0bb7cdaaebcb05d58c3d4f4139cbc8a89d8544e79f5b5cb055e9fdd0e2a3a
Status: Image is up to date for vuls/vuls:latest
docker.io/vuls/vuls:latest
time="Jul 20 13:22:56" level=info msg="vuls-v0.15.13-build-20210719_203317_9077a83"
time="Jul 20 13:22:56" level=info msg="Validating config..."
time="Jul 20 13:22:56" level=info msg="cveDict.type=sqlite3, cveDict.url=, cveDict.SQLite3Path=/vuls/cve.sqlite3"
time="Jul 20 13:22:56" level=info msg="ovalDict.type=sqlite3, ovalDict.url=, ovalDict.SQLite3Path=/vuls/oval.sqlite3"
time="Jul 20 13:22:56" level=info msg="gost.type=sqlite3, gost.url=, gost.SQLite3Path=/vuls/gost.sqlite3"
time="Jul 20 13:22:56" level=info msg="exploit.type=sqlite3, exploit.url=, exploit.SQLite3Path=/vuls/go-exploitdb.sqlite3"
time="Jul 20 13:22:56" level=info msg="metasploit.type=sqlite3, metasploit.url=, metasploit.SQLite3Path=/vuls/go-msfdb.sqlite3"
time="Jul 20 13:22:56" level=info msg="Loaded: /vuls/results/2021-07-20T13:22:11Z"
time="Jul 20 13:22:56" level=info msg="OVAL ubuntu 21.04 found. defs: 0"
time="Jul 20 13:22:56" level=error msg="Failed to detect Pkg CVE:\n    github.com/future-architect/vuls/detector.Detect\n        /go/src/github.com/future-architect/vuls/detector/detector.go:65\n  - Failed to detect CVE with OVAL:\n    github.com/future-architect/vuls/detector.DetectPkgCves\n        /go/src/github.com/future-architect/vuls/detector/detector.go:179\n  - OVAL entries of ubuntu 21.04 are not found. Fetch OVAL before reporting. For details, see `https://github.com/kotakanbe/goval-dictionary#usage`:\n    github.com/future-architect/vuls/detector.detectPkgsCvesWithOval\n        /go/src/github.com/future-architect/vuls/detector/detector.go:355"

Is it possible to have a summary of all hosts

Using vuls report is it possible to have a summary at the top or bottom that just says

All server : Total: 0 (Critical:0 High:0 Medium:0 Low:0 ?:0) 0/0 Fixed 0 installed 0 poc 0 exploits cisa: 0, uscert: 0, ...

One Line Summary

Server A                   Total: 0 (Critical:0 High:0 Medium:0 Low:0 ?:0) 0/0 Fixed       0 installed     0 poc   0 exploits      cisa: 0, uscert: 0, jpcert: 0 alerts
Server B                   Total: 0 (Critical:0 High:0 Medium:0 Low:0 ?:0) 0/0 Fixed       0 installed     0 poc   0 exploits      cisa: 0, uscert: 0, jpcert: 0 alerts
Server C                   Total: 0 (Critical:0 High:0 Medium:0 Low:0 ?:0) 0/0 Fixed       0 installed     0 poc   0 exploits      cisa: 0, uscert: 0, jpcert: 0 alerts

If you have a lot of servers the "One Line Summary" is a wall of text and you could easily miss if one server has (Critical:1 ..

it would be nice if there was a report summary over all servers.

kind regards,

Scanning & Reporting for Oracle Linux 7.8 fails

Scanning Oracle 7.8 errors without having sudo enabled for the remote ssh account. Note this does not happen with Red Hat 7.8
Reporting on Oracle 7.8 fails with no OVAl's found.
Testing shows that Oracle is not a valid variable for the following scripts.
update-all.sh
oval.sh
gost.sh

System built using https://vuls.io/docs/en/install-with-docker.html

Unsable to start scan from a cron job

Ass no tty is available when running scan.sh from a cron job, scan fails
See pull request #62

parse error on JVNDB-2021-001894

Seems there is something in this data that the cvedb.sh script doesn't like:

INFO[07-14|16:49:46] Already up to date
INFO[07-14|16:49:46] Fetching... https://jvndb.jvn.jp/ja/feed/checksum.txt
INFO[07-14|16:49:46] Fetched... https://jvndb.jvn.jp/ja/feed/checksum.txt
INFO[07-14|16:49:46] Newly     : https://jvndb.jvn.jp/ja/rss/years/jvndb_2021.rdf
INFO[07-14|16:49:46] Up to date: https://jvndb.jvn.jp/ja/rss/jvndb.rdf
INFO[07-14|16:49:46] Up to date: https://jvndb.jvn.jp/ja/rss/jvndb_new.rdf
INFO[07-14|16:49:46] Fetcling CVE information from JVN.
INFO[07-14|16:49:46] Fetching... https://jvndb.jvn.jp/ja/rss/years/jvndb_2021.rdf
INFO[07-14|16:49:53] Fetched... https://jvndb.jvn.jp/ja/rss/years/jvndb_2021.rdf
EROR[07-14|16:49:53] Failed to fetch JVN: Failed to convert to model. JVN: JVNDB-2021-001894, err: Failed to validate a value: component cannot contain whitespace:: nano 10gx: Parse error

While I'm sure it is a bad data issue, the script should probably just note the problem and continue with the rest

如何制作/导入自定义漏洞库

Sometimes, we need to expand on the existing vulnerability library of vuls and make a custom vulnerability library. How to deal with this situation?

Database update error when running install-host/update-all.sh

After having upgraded vuls to the latest version (0.14.1), I ran the script install-host/update-all.sh and during the update process this error has been displayed:

INFO[01-04|15:55:12] Initialize Database 
2021-01-04T15:55:12.350+0100	DEBUG	db path: db/trivy.db
2021-01-04T15:55:12.377+0100	DEBUG	git pull
2021-01-04T15:55:14.792+0100	DEBUG	From https://github.com/aquasecurity/vuln-list
 * branch            master     -> FETCH_HEAD
fatal: This operation must be run in a work tree

error in vulnerability DB initialize: error in vulnsrc clone or pull: failed to pull repository: error in git pull: failed to exec: exit status 128
INFO[01-04|15:55:14] Initialize Database 
INFO[01-04|15:55:14] Opening DB.                              db=sqlite3
INFO[01-04|15:55:14] Migrating DB.                            db=sqlite3

After some debugging process, the guilty script is gost.sh and the issue can be replicated by simply running ./gost.sh --redhat.

To solve this issue, I had to rename the vulnerabilities folder from vuln-list to vuln-list.old and re-run the update-all.sh script.

Once done, the folder vuln-list has been re-created and the error is gone:

INFO[01-04|16:10:30] Initialize Database 
2021-01-04T16:10:30.343+0100	DEBUG	db path: db/trivy.db
2021-01-04T16:10:30.401+0100	DEBUG	remove an existed directory
INFO[01-04|16:12:54] Opening DB.                              db=sqlite3
INFO[01-04|16:12:54] Migrating DB.                             db=sqlite3

I don't have enough knowledge in golang programming to debug the gost binary myself unfortunately.

Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again

[root@localhost install-host]# sh update-all.sh
...
Fetching cve.sqlite3 from GitHub Vuls: https://github.com/future-architect/vuls/releases/download/v0.13.1/cve.sqlite3.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   620  100   620    0     0   1516      0 --:--:-- --:--:-- --:--:--  1519
100  481M  100  481M    0     0  6011k      0  0:01:21  0:01:21 --:--:-- 6391k
EROR[09-20|08:50:49] Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again 
Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again.
EROR[09-20|08:50:49] Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again 
Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again.

It seems that something wrong with cvedb.sh, so I try:

[root@localhost install-host]# go-cve-dictionary fetch nvd
EROR[09-20|08:52:51] Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again 
Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again.
[root@localhost install-host]# go-cve-dictionary fetch jvn
EROR[09-20|08:52:57] Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again 
Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again.

All related project are up to date after execute upgrade.sh, vulsctl also is the latest version.
These error still occur after execute "rm *.sqlite3" and update-all.sh again.

Maybe v0.13.1/cve.sqlite3.gz is a too old version for latest version of vuls, I guess.

upgrade.sh failed

Hi guys,

try to install vulsctl on host. Following steps worked:

1. sudo bash install.sh
2. update-all.sh
3. sudo bash upgrade.sh - failed - with following message:

sudo bash upgrade.sh
go-cve-dictionary upgrading...
upgrade.sh: Zeile 11: cd: /src/github.com/vulsio/go-cve-dictionary: Datei oder Verzeichnis nicht gefunden
fatal: Kein Git-Repository (oder irgendeines der Elternverzeichnisse): .git
make: „install“ ist bereits aktuell.
goval-dictionary upgrading...
upgrade.sh: Zeile 16: cd: /src/github.com/vulsio/goval-dictionary: Datei oder Verzeichnis nicht gefunden
fatal: Kein Git-Repository (oder irgendeines der Elternverzeichnisse): .git
make: „install“ ist bereits aktuell.
gost(go-security-tracker) installing...
upgrade.sh: Zeile 21: cd: /src/github.com/vulsio/gost: Datei oder Verzeichnis nicht gefunden
fatal: Kein Git-Repository (oder irgendeines der Elternverzeichnisse): .git
make: „install“ ist bereits aktuell.
go-exploitdb installing...
upgrade.sh: Zeile 26: cd: /src/github.com/vulsio/go-exploitdb: Datei oder Verzeichnis nicht gefunden
fatal: Kein Git-Repository (oder irgendeines der Elternverzeichnisse): .git
make: „install“ ist bereits aktuell.
go-msfdb installing...
upgrade.sh: Zeile 31: cd: /src/github.com/vulsio/go-msfdb: Datei oder Verzeichnis nicht gefunden
fatal: Kein Git-Repository (oder irgendeines der Elternverzeichnisse): .git
make: „install“ ist bereits aktuell.
Vuls installing...
upgrade.sh: Zeile 36: cd: /src/github.com/future-architect/vuls: Datei oder Verzeichnis nicht gefunden
fatal: Kein Git-Repository (oder irgendeines der Elternverzeichnisse): .git
make: „install“ ist bereits aktuell.
cp: Aufruf von stat für '/bin/go-cve-dictionary' nicht möglich: Datei oder Verzeichnis nicht gefunden
cp: Aufruf von stat für '/bin/go-exploitdb' nicht möglich: Datei oder Verzeichnis nicht gefunden
cp: Aufruf von stat für '/bin/gost' nicht möglich: Datei oder Verzeichnis nicht gefunden
cp: Aufruf von stat für '/bin/goval-dictionary' nicht möglich: Datei oder Verzeichnis nicht gefunden
cp: Aufruf von stat für '/bin/vuls' nicht möglich: Datei oder Verzeichnis nicht gefunden
cp: Aufruf von stat für '/bin/go-msfdb' nicht möglich: Datei oder Verzeichnis nicht gefunden
Done.

I'm using Ubuntu [Linux 5.11.0-37-generic #41~20.04.2-Ubuntu SMP]

Hope you can help

OVAL database not working

Hello,

I am experiencing an issue when trying to report on ubuntu hosts with the OVAL db. When I run oval.sh --ubuntu I get this warning:

WARN[07-19|14:43:49] Failed to parse string timeformat="[2006-01-02 2006-01-02 15:04:05 2006-01-02 15:04:05 +0000 2006-01-02 15:04:05 UTC]" target string="2023-02-14 17:00:00 CET"

...but the download seems to finish successfully.

INFO[07-19|15:26:03] Deleting old Definitions...
18665 / 18665 [---------------------------------------------------------------------------------------------------------------------------] 100.00% 9713 p/s
INFO[07-19|15:26:05] Inserting new Definitions...
18665 / 18665 [---------------------------------------------------------------------------------------------------------------------------] 100.00% 3474 p/s
INFO[07-19|15:26:11] Finish                                   Updated=18665

When I open the sqlite3 db and inspect the tables they seem to be fully populated. However when I run report.sh I get this message:

time="Jul 19 15:09:24" level=info msg="Skip OVAL and Scan with gost alone."
time="Jul 19 15:09:24" level=info msg="[Reboot Required] *******: 0 CVEs are detected with OVAL"
...
No CVE-IDs are found in updatable packages.
1637 installed

This is an issue that never occurred in the past and has only cropped up since the oval.sh script was updated.

Thank you,
Mike