#988316 debsecan: Alert on already upgraded packages with higher version number

Package:
debsecan
Source:
debsecan
Submitter:
Mike Morraye
Date:
2021-06-17 14:57:04 UTC
Severity:
normal
#988316#5
Date:
2021-05-10 10:43:29 UTC
From:
To:
Debsecan alerts on an issue, where it should not:

root@eb7632717672:# debsecan --suite=buster --only-fixed --format detail
CVE-2020-27350 (fixed)
   APT had several integer overflows and underflows while parsing .deb pa
...
   installed: apt 1.8.2.3
              (built from apt 1.8.2.3)
   fixed in unstable: apt 2.1.13 (source package)
   fixed on branch:   apt 1.4.11 (source package)
   fixed on branch:   apt 1.8.2.2 (source package)
   fix is available for the selected suite (buster)

Debsecan recommends version 1.8.2.2, but detected the
installed version to be 1.8.2.3.

The content of /var/lib/dpkg/status for apt is:

Package: apt
Status: install ok installed
Priority: important
Section: admin
Installed-Size: 4064
Maintainer: APT Development Team <deity@lists.debian.org>
Architecture: amd64
Version: 1.8.2.3
<sip>

The expected behaviour would be to not have this listed as vulnerable
since the version number dictates it to be fixed.

I have compared this with following previous issues:
* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823664
* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898458

I deemed these to be not relevant enough as the version string changed
quite a bit more.
#988316#10
Date:
2021-05-28 11:41:55 UTC
From:
To:
Hi,

Any updates on this? debsecan has been misreporting the apt CVE on all
of my buster machines for at least a month now.

Tom