{"action":"closed","issue":{"url":"https://api.github.com/repos/future-architect/vuls/issues/235","repository_url":"https://api.github.com/repos/future-architect/vuls","labels_url":"https://api.github.com/repos/future-architect/vuls/issues/235/labels{/name}","comments_url":"https://api.github.com/repos/future-architect/vuls/issues/235/comments","events_url":"https://api.github.com/repos/future-architect/vuls/issues/235/events","html_url":"https://github.com/future-architect/vuls/issues/235","id":186094722,"number":235,"title":"Debian 8.6 (jessie) scan does not show vulnerable packages","user":{"login":"jrw171819","id":23141546,"avatar_url":"https://avatars.githubusercontent.com/u/23141546?v=3","gravatar_id":"","url":"https://api.github.com/users/jrw171819","html_url":"https://github.com/jrw171819","followers_url":"https://api.github.com/users/jrw171819/followers","following_url":"https://api.github.com/users/jrw171819/following{/other_user}","gists_url":"https://api.github.com/users/jrw171819/gists{/gist_id}","starred_url":"https://api.github.com/users/jrw171819/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jrw171819/subscriptions","organizations_url":"https://api.github.com/users/jrw171819/orgs","repos_url":"https://api.github.com/users/jrw171819/repos","events_url":"https://api.github.com/users/jrw171819/events{/privacy}","received_events_url":"https://api.github.com/users/jrw171819/received_events","type":"User","site_admin":false},"labels":[{"id":348093215,"url":"https://api.github.com/repos/future-architect/vuls/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-10-29T18:55:59Z","updated_at":"2016-11-07T02:47:25Z","closed_at":"2016-11-07T02:47:25Z","body":"# Environment\n\nDebian 8.6 (Jessie)\n## Vuls\n\nvuls v0.1.6 6f012fc (we patched the current /scan/debian.go a little (mostly Infof's) to understand the problem)\n## OS\n- Target Server: Debian 8.6\n- Vuls Server: Debian 8.6\n## Go\n- Go version: go1.6 linux/amd64\n# Current Output\n\n[Oct 29 17:05:04] DEBUG [SERVER-Name] Ensure changelog cache: SERVER-Name\n[Oct 29 17:05:04] DEBUG [SERVER-Name] Reuse meta: SERVER-Name\n[Oct 29 17:05:04] DEBUG [localhost] key:SERVER-Name, value:{\"Name\":\"SERVER-Name\",\"Distro\":{\"Family\":\"debian\",\"Release\":\"8.6\"},\"Packs\":[{\"Name                    \":\"libdbd-mysql-perl\",\"Version\":\"4.028-2+deb8u1\",\"Release\":\"\",\"NewVersion\":\"4.028-2+deb8u2\",\"NewRelease\":\"\"}]}\n[Oct 29 17:05:04] DEBUG [localhost] key:ghostscript, len: 8635, E: Unable to replace /home/inv...\n[Oct 29 17:05:04] DEBUG [localhost] key:libapache2-mod-php5, len: 26300, E: Unable to replace /home/inv...\n[Oct 29 17:05:04] DEBUG [localhost] key:libdbd-mysql-perl, len: 4248, E: Changelog download failed: ...\n[Oct 29 17:05:04] DEBUG [localhost] key:libgd3, len: 6410, E: Changelog download failed: ...\n[Oct 29 17:05:04] DEBUG [localhost] key:libgs9, len: 8500, E: Changelog download failed: ...\n[Oct 29 17:05:04] DEBUG [localhost] key:libgs9-common, len: 8500, E: Changelog download failed: ...\n[Oct 29 17:05:04] DEBUG [localhost] key:linux-image-3.16.0-4-amd64, len: 54537, E: Unable to replace /home/inv...\n[Oct 29 17:05:04] DEBUG [localhost] key:linux-libc-dev, len: 54402, E: Changelog download failed: ...\n[Oct 29 17:05:04] DEBUG [localhost] key:php5-cli, len: 26300, E: Unable to replace /home/inv...\n[Oct 29 17:05:04] DEBUG [localhost] key:php5-common, len: 26300, E: Unable to replace /home/inv...\n[Oct 29 17:05:04] DEBUG [localhost] key:php5-curl, len: 26165, E: Changelog download failed: ...\n[Oct 29 17:05:04] DEBUG [localhost] key:php5-gd, len: 26165, E: Changelog download failed: ...\n[Oct 29 17:05:04] DEBUG [localhost] key:php5-mcrypt, len: 26165, E: Changelog download failed: ...\n[Oct 29 17:05:04] DEBUG [localhost] key:php5-mysql, len: 26165, E: Changelog download failed: ...\n[Oct 29 17:05:04] DEBUG [localhost] key:php5-readline, len: 26165, E: Changelog download failed: ...\n[Oct 29 17:05:04] DEBUG [localhost] key:tzdata, len: 7257, tzdata (2016h-0+deb8u1) stable...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 8635, E: Unable to replace /home/inv...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: ghostscript (9.06~dfsg-2+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 26165, E: Changelog download failed: ...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: php5 (5.6.24+dfsg-0+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 26165, E: Changelog download failed: ...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: php5 (5.6.24+dfsg-0+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 54402, E: Changelog download failed: ...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: linux (3.16.36-1+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 54537, E: Unable to replace /home/inv...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: linux (3.16.36-1+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 4248, E: Changelog download failed: ...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: libdbd-mysql-perl (4.028-2+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 26300, E: Unable to replace /home/inv...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: php5 (5.6.24+dfsg-0+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 26165, E: Changelog download failed: ...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: php5 (5.6.24+dfsg-0+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 26300, E: Unable to replace /home/inv...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: php5 (5.6.24+dfsg-0+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 6410, E: Changelog download failed: ...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: libgd2 (2.1.0-5+deb8u6) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 7257, tzdata (2016h-0+deb8u1) stable...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: tzdata (2016f-0+deb8u1) stable; urgency=medium\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 26165, E: Changelog download failed: ...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: php5 (5.6.24+dfsg-0+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 26165, E: Changelog download failed: ...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: php5 (5.6.24+dfsg-0+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 26300, E: Unable to replace /home/inv...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: php5 (5.6.24+dfsg-0+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 8500, E: Changelog download failed: ...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: ghostscript (9.06~dfsg-2+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Cache hit: SERVER-Name, len: 8500, E: Changelog download failed: ...\n[Oct 29 17:05:05] DEBUG [SERVER-Name] Found the stop line. line: ghostscript (9.06~dfsg-2+deb8u1) jessie-security; urgency=high\n[Oct 29 17:05:05]  INFO [SERVER-Name](1/16) Scanned ghostscript-9.06~dfsg-2+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](2/16) Scanned php5-mysql-5.6.24+dfsg-0+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](3/16) Scanned php5-gd-5.6.24+dfsg-0+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](4/16) Scanned linux-libc-dev-3.16.36-1+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](5/16) Scanned linux-image-3.16.0-4-amd64-3.16.36-1+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](6/16) Scanned libdbd-mysql-perl-4.028-2+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](7/16) Scanned libapache2-mod-php5-5.6.24+dfsg-0+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](8/16) Scanned php5-curl-5.6.24+dfsg-0+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](9/16) Scanned php5-common-5.6.24+dfsg-0+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](10/16) Scanned libgd3-2.1.0-5+deb8u6 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](11/16) Scanned tzdata-2016f-0+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](12/16) Scanned php5-readline-5.6.24+dfsg-0+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](13/16) Scanned php5-mcrypt-5.6.24+dfsg-0+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](14/16) Scanned php5-cli-5.6.24+dfsg-0+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](15/16) Scanned libgs9-common-9.06~dfsg-2+deb8u1 : []\n[Oct 29 17:05:05]  INFO [SERVER-Name](16/16) Scanned libgs9-9.06~dfsg-2+deb8u1 : []\n[Oct 29 17:05:05] DEBUG [SERVER-Name] 0 Cves are found. cves: []\n[Oct 29 17:05:05]  INFO [SERVER-Name] Fetching CVE details...\n[Oct 29 17:05:05]  INFO [SERVER-Name] Done\n\nScan Result:\nSERVER-Name (debian8.6)\nNo unsecure packages.\n## Actual Behavior\n\nWe are scanning four nearly identical servers (all Debian 8.6) since some weeks, two of them did recently show up unsecure packages, the other two didn't. All Servers were taken out of our weekly upgrade circle, so they were all in the same unpatched state since a while. While two servers were shown corretly as vulnerable, the other two, like the example above, report status healthy, which is clearly wrong. \n\nAfter some research we found out some problems that in sum can lead to this behavior in the end:\n\n1.) It seems, that vuls caches Error-Messages from apt-get/aptitude like (Cache hit: SERVER-Name, len: 26300, E: Unable to replace /home/scanuser/.aptitude/config, file does'nt exist or Cache hit: SERVER-Name, len: 26165, E: Changelog download failed: ...)  like \"real\" changelogs\n2.) The cache does not seem to expire, which leads into the situation, that error messages from apt-get/aptitude once cached are always handled like real changelog entries\n3.) These \"broken\" Changlog entries lead into no CVE-Hits for the package, even if that package was recently upgraded and is very likely unsecure\n4.) The lack of CVE hits for the package obv. leads to a wrongly healthy package\n\n(This is at least our impression, but we are not very familiar with go)\n## Expected Behavior\n\n1.) Error messages from apt-get/aptitude should not be cached - it should be made sure that the cache entry is a valid changelog\n2.) If this is not possible, the cache should maybe expire, or the usermanual should mention that the cache db should be deleted frequently (which works perfectly for us)\n3.) Even if a changelog is unavailable or doesnt say anything useful for an updated package, the chance is pretty high that the server isn't healthy anymore. Missing changelogs should maybe not lead to a healthy server, but to a server with unspecifyable problems.\n## Steps to reproduce the behaviour\n\n1.) Fill your cache.db with some trash, for example by running an older vuls version, that still uses apt-get changelog for debian systems - these requests lead mostly into a 404 error - OR - use a debian system that is not configured for aptitude (and aptitude sudo likewise)\n2.) update your vuls to current version - but do not delete the cache\n3.) Scan - and there you go :)\n## Steps to solve the issue\n\n1.) Aptitude should be added as required package for debian/Ubuntu Systems (and in the sudo Nopassword section), also, aptitude must be manually executed at least once by the scanuser (command aptitude, then close again)\n2.) delete your cache.db (most important)\n## One more thing\n\nYour approach is great, we really appreciate your idea and work! Thank you a lot!\n"}}
{"actor":{"display_login":"kotakanbe"}}