LowHOST-CVE-003Patch and Vulnerability ManagementServer

Vulnerability Snapshot Outdated or Test Data

Checks installed packages against an offline vulnerability snapshot.

Why It Matters: Known vulnerable package versions can expose a server to documented attacks.
How It Detects: Reads installed package versions and matches OSV ecosystem ranges; each match names its matcher (exact version or range) and the snapshot date. When the binary carries only the test fixture snapshot (a source build without 'make vulndb'), the check reports Incomplete rather than Pass, because no advisory data was available.
How to Fix: Install the vendor security update. For a source build, run 'make vulndb' to embed a snapshot generated from OSV and CISA KEV, then rebuild.
How to Verify: Re-run OpenVAPT after patching and confirm the finding is absent.
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Control Category: Patch and Vulnerability Management: CIS Controls v8 7, 2; NIST CSF 2.0 ID.RA, PR.PS
Fix Effort: Medium
CIS Controls v8 Safeguard: 7.3
NIST CSF 2.0 Subcategory: ID.RA-01, PR.PS-02
CWE: CWE-1104
OWASP Top 10: A06:2021
NIST SP 800-53 Rev. 5: SI-2, RA-5
References: OSV vulnerability database
NVD
CISA KEV

Learn the theory behind this check: P10 Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities.

Source Code

The complete file that defines this check. Run it with openvapt scan --only HOST-CVE-003, or read it offline with openvapt explain HOST-CVE-003.

internal/checks/host/cve.go · Lines 1-97View on GitHub at This Commit

1package host
2
3import (
"context"
"fmt"
"strings"
"time"
8
"github.com/openvapt/openvapt/internal/check"
"github.com/openvapt/openvapt/internal/checks/collect"
"github.com/openvapt/openvapt/internal/sys"
12)
13
14var cveRefs = []check.Ref{{Title: "OSV vulnerability database", URL: "https://osv.dev/"}, {Title: "NVD", URL: "https://nvd.nist.gov/"}, {Title: "CISA KEV", URL: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}}
15var cveStandards = check.Standards{CWE: []string{"CWE-1104"}, OWASP: []string{"A06:2021"}, NIST: []string{"SI-2", "RA-5"}}
16
17func init() {
for _, spec := range []struct {
id, title string
sev       check.Severity
kev, age  bool
cvss      string
}{
// Representative vectors: a vulnerable package usually needs a reachable
// code path (AC:H); a known exploited one is used in the wild (AC:L);
// an outdated snapshot only hides information.
{"HOST-CVE-001", "Installed OS Packages With Known Vulnerabilities", check.High, false, false, "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},
{"HOST-CVE-002", "Known Exploited Vulnerabilities Present", check.Critical, true, false, "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},
{"HOST-CVE-003", "Vulnerability Snapshot Outdated or Test Data", check.Low, false, true, "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},
} {
x := spec
check.Register(&check.Check{
	ID:        x.id,
	Title:     x.title,
	Domain:    check.DomainHost,
	Severity:  x.sev,
	Category:  check.CatPatch,
	Effort:    check.EffortMedium,
	CVSS:      x.cvss,
	Summary:   "Checks installed packages against an offline vulnerability snapshot.",
	Rationale: "Known vulnerable package versions can expose a server to documented attacks.",
	Detection: "Reads installed package versions and matches OSV ecosystem ranges; each match names its matcher (exact version or range) and the snapshot date. When the binary carries only the test fixture snapshot (a source build without 'make vulndb'), the check reports Incomplete rather than Pass, because no advisory data was available.",
	Fix:       "Install the vendor security update. For a source build, run 'make vulndb' to embed a snapshot generated from OSV and CISA KEV, then rebuild.",
	Verify:    "Re-run OpenVAPT after patching and confirm the finding is absent.",
	Refs:      cveRefs,
	Standards: cveStandards,
	Run: func(ctx context.Context, s sys.System) []check.Result {
		db, e := collect.VulnDB(ctx, s)
		if e != nil {
			return []check.Result{check.IncompleteR("vulnerability snapshot", "Snapshot could not be read")}
		}
		if db.Header.Fixture {
			return []check.Result{check.IncompleteR("vulnerability snapshot", "No advisory data: the embedded snapshot is test fixture data", collect.FixtureNotice, db.Notice())}
		}
		if x.age {
			if old, _ := db.Age(time.Now()); old {
				return []check.Result{check.FailR("vulnerability snapshot", db.Notice())}
			}
			return []check.Result{check.PassR("vulnerability snapshot", db.Notice())}
		}
		items, ok := collect.HostInventory(ctx, s)
		if !ok {
			return []check.Result{check.IncompleteR("OS package inventory", "Installed packages could not be fully inventoried", db.Notice())}
		}
		var out []check.Result
		for _, p := range items {
			for _, m := range db.Match(p.Ecosystem, p.Package, p.Version) {
				a := m.Advisory
				if x.kev && !a.KEV {
					continue
				}
				if !x.kev && a.Severity != "high" && a.Severity != "critical" {
					continue
				}
				fixed := "not specified"
				for _, af := range a.Affected {
					if af.Ecosystem == p.Ecosystem && af.Package == p.Package {
						for _, r := range af.Ranges {
							for _, ev := range r.Events {
								if ev.Fixed != "" {
									fixed = ev.Fixed
								}
							}
						}
					}
				}
				out = append(out, check.FailR(p.Package, fmt.Sprintf("%s %s: %s (%s), fixed in %s, severity %s", p.Package, p.Version, a.ID, strings.Join(a.Aliases, ", "), fixed, a.Severity), "matcher: "+p.Matcher(m.Matcher), db.Notice()))
			}
		}
		if len(out) == 0 {
			return []check.Result{check.PassR("OS package inventory", "No matching advisories in the embedded snapshot", db.Notice())}
		}
		return out
	},
})
}
97}

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Cite This Page

If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.

APA 7

OpenVAPT. (2026). HOST-CVE-003 Vulnerability Snapshot Outdated or Test Data (Version 0.1.0-alpha.6). OpenVAPT Check Catalogue. Retrieved October 16, 2026, from https://openvapt.com/checks/HOST-CVE-003.html

In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.

BibTeX

@misc{openvapt_host_cve_003,
  author       = {{OpenVAPT}},
  title        = {{HOST-CVE-003 Vulnerability Snapshot Outdated or Test Data}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/checks/HOST-CVE-003.html}},
  note         = {OpenVAPT Check Catalogue, version 0.1.0-alpha.6. Accessed 16 October 2026}
}

Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.

Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.

Cite This Work: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version 0.1.0-alpha.6) [Computer software]. https://github.com/OpenVAPT/openvapt

1	package host
2
3	import (
4	"context"
5	"fmt"
6	"strings"
7	"time"
8
9	"github.com/openvapt/openvapt/internal/check"
10	"github.com/openvapt/openvapt/internal/checks/collect"
11	"github.com/openvapt/openvapt/internal/sys"
12	)
13
14	var cveRefs = []check.Ref{{Title: "OSV vulnerability database", URL: "https://osv.dev/"}, {Title: "NVD", URL: "https://nvd.nist.gov/"}, {Title: "CISA KEV", URL: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}}
15	var cveStandards = check.Standards{CWE: []string{"CWE-1104"}, OWASP: []string{"A06:2021"}, NIST: []string{"SI-2", "RA-5"}}
16
17	func init() {
18	for _, spec := range []struct {
19	id, title string
20	sev check.Severity
21	kev, age bool
22	cvss string
23	}{
24	// Representative vectors: a vulnerable package usually needs a reachable
25	// code path (AC:H); a known exploited one is used in the wild (AC:L);
26	// an outdated snapshot only hides information.
27	{"HOST-CVE-001", "Installed OS Packages With Known Vulnerabilities", check.High, false, false, "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},
28	{"HOST-CVE-002", "Known Exploited Vulnerabilities Present", check.Critical, true, false, "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},
29	{"HOST-CVE-003", "Vulnerability Snapshot Outdated or Test Data", check.Low, false, true, "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},
30	} {
31	x := spec
32	check.Register(&check.Check{
33	ID: x.id,
34	Title: x.title,
35	Domain: check.DomainHost,
36	Severity: x.sev,
37	Category: check.CatPatch,
38	Effort: check.EffortMedium,
39	CVSS: x.cvss,
40	Summary: "Checks installed packages against an offline vulnerability snapshot.",
41	Rationale: "Known vulnerable package versions can expose a server to documented attacks.",
42	Detection: "Reads installed package versions and matches OSV ecosystem ranges; each match names its matcher (exact version or range) and the snapshot date. When the binary carries only the test fixture snapshot (a source build without 'make vulndb'), the check reports Incomplete rather than Pass, because no advisory data was available.",
43	Fix: "Install the vendor security update. For a source build, run 'make vulndb' to embed a snapshot generated from OSV and CISA KEV, then rebuild.",
44	Verify: "Re-run OpenVAPT after patching and confirm the finding is absent.",
45	Refs: cveRefs,
46	Standards: cveStandards,
47	Run: func(ctx context.Context, s sys.System) []check.Result {
48	db, e := collect.VulnDB(ctx, s)
49	if e != nil {
50	return []check.Result{check.IncompleteR("vulnerability snapshot", "Snapshot could not be read")}
51	}
52	if db.Header.Fixture {
53	return []check.Result{check.IncompleteR("vulnerability snapshot", "No advisory data: the embedded snapshot is test fixture data", collect.FixtureNotice, db.Notice())}
54	}
55	if x.age {
56	if old, _ := db.Age(time.Now()); old {
57	return []check.Result{check.FailR("vulnerability snapshot", db.Notice())}
58	}
59	return []check.Result{check.PassR("vulnerability snapshot", db.Notice())}
60	}
61	items, ok := collect.HostInventory(ctx, s)
62	if !ok {
63	return []check.Result{check.IncompleteR("OS package inventory", "Installed packages could not be fully inventoried", db.Notice())}
64	}
65	var out []check.Result
66	for _, p := range items {
67	for _, m := range db.Match(p.Ecosystem, p.Package, p.Version) {
68	a := m.Advisory
69	if x.kev && !a.KEV {
70	continue
71	}
72	if !x.kev && a.Severity != "high" && a.Severity != "critical" {
73	continue
74	}
75	fixed := "not specified"
76	for _, af := range a.Affected {
77	if af.Ecosystem == p.Ecosystem && af.Package == p.Package {
78	for _, r := range af.Ranges {
79	for _, ev := range r.Events {
80	if ev.Fixed != "" {
81	fixed = ev.Fixed
82	}
83	}
84	}
85	}
86	}
87	out = append(out, check.FailR(p.Package, fmt.Sprintf("%s %s: %s (%s), fixed in %s, severity %s", p.Package, p.Version, a.ID, strings.Join(a.Aliases, ", "), fixed, a.Severity), "matcher: "+p.Matcher(m.Matcher), db.Notice()))
88	}
89	}
90	if len(out) == 0 {
91	return []check.Result{check.PassR("OS package inventory", "No matching advisories in the embedded snapshot", db.Notice())}
92	}
93	return out
94	},
95	})
96	}
97	}