Bug#988316: debsecan: Alert on already upgraded packages with higher version number

[Mike Morraye]

Package: debsecan
Version: 0.4.19
Severity: normal

Debsecan alerts on an issue, where it should not:

root@eb7632717672:# debsecan --suite=buster --only-fixed --format detail
CVE-2020-27350 (fixed)
APT had several integer overflows and underflows while parsing .deb pa
...
installed: apt 1.8.2.3
(built from apt 1.8.2.3)
fixed in unstable: apt 2.1.13 (source package)
fixed on branch: apt 1.4.11 (source package)
fixed on branch: apt 1.8.2.2 (source package)
fix is available for the selected suite (buster)

Debsecan recommends version 1.8.2.2, but detected the
installed version to be 1.8.2.3.

The content of /var/lib/dpkg/status for apt is:

Package: apt
Status: install ok installed
Priority: important
Section: admin
Installed-Size: 4064
Maintainer: APT Development Team <de...@lists.debian.org>
Architecture: amd64
Version: 1.8.2.3
<sip>

The expected behaviour would be to not have this listed as vulnerable
since the version number dictates it to be fixed.

I have compared this with following previous issues:
* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823664
* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898458

I deemed these to be not relevant enough as the version string changed
quite a bit more.

-- System Information:
Debian Release: 10.9
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.121-linuxkit (SMP w/2 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_RANDSTRUCT
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) (ignored:
LC_ALL set to en_US.utf8), LANGUAGE=en_US:en (charmap=UTF-8) (ignored:
LC_ALL set to en_US.utf8)
Shell: /bin/sh linked to /bin/dash
Init: unable to detect

Versions of packages debsecan depends on:
ii ca-certificates 20200601~deb10u2
ii debconf [debconf-2.0] 1.5.71
ii python 2.7.16-1
ii python-apt 1.8.4.3

Versions of packages debsecan recommends:
ii cronie [cron] 1.5.5-3
ii exim4-daemon-light [mail-transport-agent] 4.92-8+deb10u6

debsecan suggests no packages.

-- debconf information:
debsecan/mailto: root
debsecan/report: true
debsecan/suite: GENERIC
debsecan/source:

[Tom Laermans]

Hi,

Any updates on this? debsecan has been misreporting the apt CVE on all
of my buster machines for at least a month now.

Tom