Unmaintained Gentoo packages OID: 1.3.6.1.4.1.25623.1.0.24017 - false positives

Vulnerability Tests
1

On one server Unmaintained Gentoo packages OID: 1.3.6.1.4.1.25623.1.0.24017 is causing a huge list of false-positives. I suspect the check compares the installed package versions to the ones available via the portage package repository.

Since this server is the one with the most recent Gentoo installation I suspect the checks have hardcoded paths.

Previously the default setup was like this:

PORTDIR="/usr/portage"
DISTDIR="/usr/portage/distfiles"
PKGDIR="/usr/portage/packages"

while new Gentoo installs (confirmed by downloading the latest stage3 tarball and having a look at /etc/portage/make.conf) set things differently:

PORTDIR="/var/db/repos/gentoo"
DISTDIR="/var/cache/distfiles"
PKGDIR="/var/cache/binpkgs"

It would be nice to have the checks fixed to take the new default locations into consideration as well, or even better expand the logic to read and parse the output of emerge --info for this.

2

Due to the fact that many repros can mix up a lot of different things. A “portage” location could help, but with the up-to-date Gentoo there is nothing that blocks you under profile 17.1 still maintain it under /usr/portage so you can use a shared profile via nfs across profiles and machines.

3

I’m aware that I can change the default location back to the “old” way of /usr/portage however in my opinion the check should work for distribution default configurations and should take the (recent) change to that into account.

4

There is no distribution default, that is the trick.

The new default is to parse all Repros at: “/etc/portage/repos.conf/” directory and then the check must be done against all reports.

5

That would of course be great and the best solution, so the check would also take “private” repositories one might have into account.

6

So anyone at the community to submit a patch for that VT ?