Repository navigation
[backport] Evaluate OVAL state with no entities as true - #2463
Merged
Merged
Conversation
According to the OVAL specification, child entities in state elements have minOccurs=0. A state without any entities imposes no conditions; therefore, any collected system item vacuously satisfies it. Previously, eval_item() in oval_resultTest.c would iterate over an empty list of state contents, leaving the results structure empty. It then passed this empty set to ores_get_result_byopr(), which mapped it to OVAL_RESULT_UNKNOWN. This caused a critical false negative with Canonical's Ubuntu OVAL feeds, which define singleton family_states with no child entities. Because the inventory check evaluated to unknown, every Ubuntu Security Notice (USN) extending that inventory definition failed to evaluate to true, reporting zero vulnerabilities and exiting cleanly with code 0. This patch detects when an OVAL state contains no entities and immediately returns OVAL_RESULT_TRUE. Also adds a regression test suite covering entity-less states and Ubuntu applicability check patterns. Fixes OpenSCAP#2396
|
matusmarhefka
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is a backport of the PR #2452 to the maint-1.3 branch.
According to the OVAL specification, child entities in state elements have minOccurs=0. A state without any entities imposes no conditions; therefore, any collected system item vacuously satisfies it.
Previously, eval_item() in oval_resultTest.c would iterate over an empty list of state contents, leaving the results structure empty. It then passed this empty set to ores_get_result_byopr(), which mapped it to OVAL_RESULT_UNKNOWN.
This caused a critical false negative with Canonical's Ubuntu OVAL feeds, which define singleton family_states with no child entities. Because the inventory check evaluated to unknown, every Ubuntu Security Notice (USN) extending that inventory definition failed to evaluate to true, reporting zero vulnerabilities and exiting cleanly with code 0.
This patch detects when an OVAL state contains no entities and immediately returns OVAL_RESULT_TRUE. Also adds a regression test suite covering entity-less states and Ubuntu applicability check patterns.