Couldn't find a reliable tool to scan a list of CentOS or RHEL RPM files for vulnerabilities (e.g. list CVEs found for each file).

The goal is to scan the RPM files for vulnerabilities before they are installed (well, shipped to our customers along with our software).

  • Blackduck can scan RPMs
    – Gaius
    Oct 8 '19 at 15:57

I think you need to be clearer about what you mean by "scan for vulnerabilities".

If you mean search the CVE database on NIST for known CVEs that relate to the specific software that the RPM package delivers, then presumably you just want a script which will take the software name of each RPM and search for it.

If you want something that will try to find the actual flaws in the software that's obviously much harder and probably not viable to be honest.


I don't know if any of these will scan RPMs, but they all will work with installed systems (presumably you're willing to install what you ship to customers!) oscap comes with Red Hat so is no cost. Nessus, Qualys, Rapid 7 and I'm sure others all offer commercial products that do scanning as well.


You should follow these steps to make sure every thing is up-to-date and intrusion free

1.You should check Checksum of RPM repo to make sure uptodate with parent repo time by time.

  1. You should deploy some FIM(File integrity monitoring ) solution , if some file changes you should be updated via email/sms.

  2. Update and Upgrade your system regularly (weekly bases)

  • Hello, this doesn't answer the question. Oct 8 '19 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.