Skip to content

Back to the catalog

Why OVAL Feeds Outperform NVD for Linux Vulnerability Management | Blog | Endor Labs
endorlabs.comarticle

Why OVAL Feeds Outperform NVD for Linux Vulnerability Management | Blog | Endor Labs

Endor Labs explains why OVAL (Open Vulnerability and Assessment Language) feeds from Linux distributions like Debian, Ubuntu, and Red Hat produce more accurate vulnerability data than NVD for container/Linux scanning. Using CVE-2022-1587 (PCRE2 DoS) as a case study, it shows how NVD rated the flaw "Critical" (CVSS 9.1) while Ubuntu's OVAL-based advisory rated it "Low" because the distro had already backported a fix into a version string (10.34-7ubuntu0.1) that naive NVD-based scanners would still flag as vulnerable.

TL;DR OVAL feeds from Linux distros give distribution-specific, backport-aware vulnerability data that reduces false positives compared to NVD's generic CPE-based matching, illustrated via CVE-2022-1587.
Open original ↗

CVEs named here

  • CVE-2022-1587

Technologies named here

Techniques named here

  • Distribution-specific version identifier analysis
  • OVAL-based vulnerability auditing

Related in DevSecOps