False Vulnerability reports from OVAL Content

Problem

Solution

CIS-CAT Pro Assessor CLI is designed primarily to assess CIS Benchmark configuration recommendations. However, it can also assess SCAP and OVAL content.

For Windows Vulnerability reports, the OVAL files are downloaded for these vulnerability assessments from the official OVAL Repository, which is operated by CIS. It is important to note that the content contained in the official OVAL Repository is not authored by CIS – instead, this content is submitted by those making contributions to the OVAL community. So CIS does perform structural QA on the content that is submitted. But CIS does not validate the instructions embodied by the content.

Therefore, there can be issues with the instructions embodied by the OVAL content. To best address these issues, the creator of the content should be tasked to review and fix the content. A GitHub issue can be created in the OVAL Repository to address this, and should include the exact OVAL definition identifier and labeled as a “bug” or “question”.

With this OVAL Community set up, there is a difference in the compatibility and support with CIS-CAT compared to the Benchmarks that are specifically built and updated to run in the CIS-CAT Pro Assessor.

Similarly for the Red Hat, SuSE and Ubuntu Linux Vulnerability content, this content is generated by the community, or in SLES case, Novell