OpenSCAP release notes

Updated -

With OpenSCAP, you can perform fully automated compliance audits of Red Hat Enterprise Linux installations according to specified security standards. The OpenSCAP library, with the accompanying oscap command-line utility, is designed to perform configuration and vulnerability scans on a local system, to validate configuration compliance content, and to generate reports and guides based on these scans and evaluations.

1.4.6

Available in RHEL versions: 10.0.Z, 10.2.Z, 10.3.Z

  • CVE-2026-85518: Fix path traversal when dumping SDS components.

1.4.5

Available in RHEL versions: Not available

  • The autotailor command, which serves to create XCCDF Tailoring files on the command line, was updated and improved. Most notable changes are:
    • The autotailor function is fixed so that the extend attribute in the generated XCCDF tailoring file is set correctly and ensure the correct profile is referenced (RHEL-182992).
    • By default, the autotailor command validates variable names, rule IDs, and profile IDs against the provided SCAP data stream (RHEL-143568).
    • The new --no-validate option skips ID validation, reducing overhead on large data streams.
    • The new --local-path option generates local benchmark references in the generated XCCDF tailoring file. Relative paths are preserved, while absolute paths become basenames.
  • Other bug fixes and features:
    • Strings are sanitized internally to prevent errors caused by invalid UTF-8 characters (RHEL-171005).
    • Users can modify the directory where OpenSCAP creates temporary files during operation by setting the TMPDIR environment variable (RHEL-222370.
    • Added support for the yescrypt hashing algorithm in the OpenSCAP shadow probe for shadow_object elements in OVAL 5.11 and newer.
    • HTML guides and reports now label Kickstart, Ignition, and bootc remediation snippets correctly.

1.3.16

Available in RHEL versions: 8.10.Z, 9.2.Z, 9.4.Z, 9.6.Z, 9.7.Z, 9.8.Z, 9.9.Z

  • CVE-2026-85518: Fix path traversal when dumping SDS components

1.3.15

Available in RHEL versions: Not available

  • The autotailor command, which serves to create XCCDF Tailoring files on the command line, was updated and improved. Most notable changes are:
    • The autotailor function is fixed so that the extend attribute in the generated XCCDF tailoring file is set correctly and ensure correct profile is referenced (RHEL-182992).
    • By default, the autotailor command validates variable names, rule IDs, and profile IDs against the provided SCAP data stream (RHEL-143568).
    • The new --no-validate option skips ID validation, reducing overhead on large data streams.
    • The new --local-path option generates local benchmark references in the generated XCCDF tailoring file. Relative paths are preserved, while absolute paths become basenames.
  • Other bug fixes and features:
    • Strings are sanitized internally to prevent errors caused by invalid UTF-8 characters (RHEL-171005).
    • Users can modify the directory where OpenSCAP creates temporary files during operation by setting the TMPDIR environment variable (RHEL-222370).
    • Added support for the yescrypt hashing algorithm in the OpenSCAP shadow probe for shadow_object elements in OVAL 5.11 and newer.
    • HTML guides and reports now label Kickstart, Ignition, and bootc remediation snippets correctly.

1.4.4

Available in RHEL versions: 10.0.Z, 10.2.Z

  • Fixed Bash completion (RHEL-145121).
  • Added an ability to list rules and variables in a profile by the oscap info command (RHEL-143569).
  • Fixed autotailor JSON bugs.
  • Made the autotailor tool use correct XML namespaces.

1.3.14

Available in RHEL versions: 8.10.Z, 9.0.Z, 9.2.Z, 9.4.Z, 9.6.Z, 9.7.Z, 9.8.Z

  • Added the ability to list rules and variables in a profile by the oscap info command.
  • Made the autotailor tool use correct XML namespaces.

1.4.3

Available in RHEL versions: 10.0.Z, 10.1.Z, 10.2 (GA)

  • Added the new --show-rule-details option for the oscap xccdf eval command (RHEL-104651).
  • Updated signature validation to explicitly enable the KeyValue and RSA key data reading.
  • Fixed a memory corruption bug causing a double-free of the error pointer in blueprint fix parsing.
  • Increased array sizes to accommodate null terminators in the compat/dev_to_tty.c and xbase64.c files.
  • Inherited full environment for Bash remediations with the --remediate option.
  • Fixed inverted and incorrect fields in HTML report tables caused by the XSL template processing (RHEL-104073).
  • You can newly specify verbose options at any position of the command line.
  • Added support for the new STIG URL parameter in the --stig-viewer option.
  • Fixed the missing PATH in the oscap-im remediations by inheriting the parent environment.

1.3.13

Available in RHEL versions: 8.10.Z, 9.0.Z, 9.2.Z, 9.4.Z, 9.6.Z, 9.7.Z, 9.8 (GA)

  • Fixed the missing PATH in the oscap-im remediations by inheriting the parent environment.
  • Fixed inverted and incorrect fields in HTML report tables caused by the XSL template processing (RHEL-104073).
  • Added a warning that the --local-files option only works with SCAP 1.3 source data streams (RHEL-74343).
  • Added support for the new STIG URL parameter in the --stig-viewer option.

1.4.2

Available in RHEL versions: 10.0.Z

  • Fixed thread synchronization problems.
  • Fixed the textfilecontent54_test element for negative instance numbers.
  • Fixed signature processing in the rpminfo_test element.

1.3.12

Available in RHEL versions: 8.10.Z EUS, 9.0.Z EUS, 9.2.Z EUS, 9.4.Z EUS, 9.6.Z EUS

  • Fixed thread synchronization problems.
  • OpenSCAP now properly handles the OSCAP_PROBE_IGNORE_PATHS environment variable value, excluding all paths in the list (RHEL-67297).
  • Fixed processing of tailored DISA content (RHEL-34104).
  • Fixed the textfilecontent54_test element for negative instance numbers.
  • Fixed signature processing in the rpminfo_test element.

1.4.1

Available in RHEL versions: 10.0 (GA)

  • Introduced new tool oscap-im that can be used in Containerfiles to build hardened bootable container images for Image Mode RHEL systems.
  • The oscap info subcommand no longer prints SCAP source data stream component references.
  • Fixed error when applying tailoring on DISA SCAP content caused by incorrect xlink namespace processing.

1.3.11

Available in RHEL versions: 9.6

  • Introduced new tool oscap-im that can be used in Containerfiles to build hardened bootable container images for Image Mode RHEL systems.
  • The oscap info subcommand no longer prints SCAP source data stream component references.
  • Fixed error when applying tailoring on DISA SCAP content caused by incorrect xlink namespace processing.
  • Fixed RPM probes in bootable container images build environment ([RHEL-55251]https://issues.redhat.com/browse/RHEL-55251)).

1.4.0

Available in RHEL versions: 10.0.beta

  • Introduced the ability to generate Kickstarts for unattended RHEL installation using the oscap xccdf generate fix --fix-type kickstart command.
  • Removed the cve, cvss, and cvrf modules.
  • Removed the ds submodules: sds-compose, sds-add, sds-split, rds-create, and rds-split.
  • Removed the --template, --oval-template, and --sce-template options from the xccdf generate submodule.
  • Removed the --skip-valid option (replaced by --skip-validation).
  • Add the ability to process JSON tailoring files containing multiple profiles by the autotailor tool.
  • Removed the openscap-devel, openscap-engine-sce-devel, and openscap-python3 subpackages.

1.3.10

Available in RHEL versions: 8.6.Z EUS, 8.8.Z EUS, 8.9.Z, 9.0.Z EUS, 9.2.Z EUS, 9.3.Z

  • Added the --reference option for selecting rules based on their references (RHEL-1479).
  • The autotailor utility now allows changing the role and severity of rules in XCCDF tailoring files (RHEL-1477) and can convert JSON tailoring into XCCDF tailoring format.
  • Generated blueprint remediations have been improved and become self-contained (RHEL-1476).
  • OpenSCAP now lists all environment variables affecting its execution and their values if you run the scanner with verbosity level INFO or DEVEL.
  • Added two environment variables for working around memory issues in OpenSCAP (RHEL-4141, RHEL-11925).
    • You can configure the maximum amount of items collected by OpenSCAP probes by using the OSCAP_PROBE_MAX_COLLECTED_ITEMS environment variable.
    • You can specify directory paths that should be skipped during the scanning by setting the OSCAP_PROBE_IGNORE_PATHS environment variable.
  • Fixed file names of the CPE OVAL result files (RHEL-7050).
  • References in HTML reports and guides are now presented in a table and are grouped by reference target.

1.3.8

Available in RHEL versions: 8.6.Z EUS, 8.8.Z, 8.9, 9.0.Z EUS, 9.2.Z, 9.3

  • Fixed systemd probes to not ignore some systemd units.
  • Added offline capabilities to the shadow OVAL probe.
  • Added offline capabilities to the sysctl OVAL probe.
  • Added auristorfs to the list of network filesystems.
  • Created a workaround for issues with tailoring files produced by the autotailor utility.

1.3.7

Available in RHEL versions: 8.8 and 9.2

  • Fixed error when processing OVAL filters RHBZ#2126882.
  • OpenSCAP no longer emits invalid empty xmlfilecontent items if XPath does not match RHBZ#2139060.
  • Prevented Failed to check available memory errors RHBZ#2111040.

Comments