Recent searches
Search options
Administered by:
Uh, is it normal for an automated #security scanner to be unaware of #debian patched packages?
Like how OpenSSH 9.2p1 is vulnerable to CVE-2023-38408 but the Debian version 1:9.2p1-2+deb12u5 is patched. But the security scanner sees the "9.2p1" string and sounds the alarm.
https://security-tracker.debian.org/tracker/CVE-2023-38408
Is this a common problem for people running Debian servers?
@teleclimber Yes. Most security scanners (Pentesters) are that stupid.
I speak from experience, trying to tell customers that just because it said the server they installed have a vulnerable version of something or other installed, that's not actually the case.
The ones that *actually* try to break stuff (like using known issues, fuzzing input and such) are great, though. Use those.