Operating system / publisher / software and CVE

[Gruikgruik]

Hello everyone

OCS Inventory version

ocsinventory: 2.12.2
ocsagent: 2.10.2
cve-search 5.1.0
mariadb 10.5
php:8.2
apache: 2.4

Describe the bug

I just set up cve-serach and ocsinventory, everything works well overall.

On the other hand, at the level of the agent reports on machines in centos or rocky linux, the publisher for the perl software (for example) is identified in Centos and Rocky Enterprise Software Foundation. while on ubuntu and debian it is identified as http://dev\.perl\.org/perl5.

Which means that at the CVE level in the software view of the machines, the CVEs do not appear for centos and rocky linux.

I looked at the regex engine, but nothing changes, it does not want to display them or make the link. I may be using it wrong too.

Do you have an idea, a lead ?

Screenshots

exemple for softwares on server centos / rocky Linux

exemple for softwares on server ubuntu / debian

exemple rapport CVE

[Gruikgruik]

Hi,

Has anyone encountered this situation before ?

[Gruikgruik]

Hello everyone,

I'm reviving the subject to find out if anyone has already encountered this situation, or to give me a clue.

---

Bonjour à tous,

Je relance le sujet pour savoir si quelqu'un a déjà rencontré cette situation, ou me donner une piste.

[Lea9250]

Hi @Gruikgruik

Could you share how you configured your regex? It would be helpful to take a look at it.
Additionally, you can enable the debug mode (General configuration > CVE-search management) and check the output of the CVE script. If needed the script can also be run with a debug option to generate more detailed logs.

Best regards,
Léa

[Gruikgruik]

Hi @Lea9250

Thanks for your help. attached the regex configuration

I looked in the configuration for debug mode, is that the one ?

Best regards,

Gruik

[Gruikgruik]

Hi @Lea9250

This does it for all applications on centos and Rocky linux systems

[Gruikgruik]

Hi,

Indeed, in the history of CVEs only applications for systems based on Ubuntu or Debian go back

[Gruikgruik]

Hi and happy new year,

Does anyone have any idea where ocsinventory only lists software related to the debian and ubuntu version?

Because in the CVE History tab at the editor level the names correspond to the ubuntu and debian versions, and not those of rocky linux or centos