tech-pkg archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Security numbers in pkgsrc

			Hi tech-pkg@,

I would like to share with you the first run of a very simple tool I just wrote, which name is currently simply "pkgquery" [1]. In essence, all this shell script does at the moment is browse through every package available and either:
- lists all the packages for a given maintainer, eg

   $ pkgquery -M

- lists the known security issues for every package available, eg

   $ pkgquery -S

Of course I have plans to generate different output formats and extend the functionalities. I have just generated a basic security report [2] on the "trunk" branch from the Git conversion for pkgsrc [3] (commit [4]).

It should be relatively easy - and hopefully interesting - to create more elaborate reports out of this, like graphing the amount and type of vulnerabilities over time, for successive releases.

Disclaimer: it will *not* be indicative of how "secure" any release is, was or will be (eg in case of 0days) but it could provide interesting metrics.

First few numbers:
- 1964 active vulnerability entries
- among which 102 different types of vulnerabilities reported, with
   most active entries being Denial of Service: (DoS)

  43 cross-site-scripting
  75 remote-system-access
  83 buffer-overflow
  84 heap-overflow
 156 arbitrary-code-execution
 181 multiple-vulnerabilities
 224 end-of-life
 549 denial-of-service

- affecting a total of 491 packages, with:
   * one vulnerability reported (230), or
   * more than one vulnerability reported (261)
- up to 44 known vulnerabilities for one package:

  25 suse32_libtiff-10.0nb4
  25 suse_libtiff-10.0nb4
  35 suse32_base-12.1nb7
  35 suse_base-12.1nb7
  40 suse32_openssl-10.0nb5
  40 suse_openssl-10.0nb5
  44 suse32_base-10.0nb8
  44 suse_base-10.0nb8

   (there is a pattern here)

Do not hesitate to follow-up for more details.



Home | Main Index | Thread Index | Old Index