# Machine-Readable Security Data (Errata, OVAL, CSAF)

TuxCare provides machine-readable security data for ELS for Runtimes in the following formats:

• Errata — qualified security and selected bug-fix errata advisories
• OVAL — Open Vulnerability and Assessment Language patch definitions for use with OpenSCAP and similar tools
• CSAF — Common Security Advisory Framework advisories in OASIS CSAF 2.0 format (VEX and Security Advisory)
• RSS — release feeds for tracking updates

Released fixes are also available via cve.tuxcare.com and security.tuxcare.com.

# PHP

# Python

# Node.js

# Ruby

# How to use OVAL

OVAL can be used with the OpenSCAP tool.

1. Install OpenSCAP

   RPMDEB

   

   yum install openscap openscap-utils scap-security-guide -y

2. Download an OVAL stream. For example, Python on EL 8:

   wget https://security.tuxcare.com/oval/els_alt_python/el8/oval.xml
   

3. Run a scan:

   oscap oval eval --results result.xml --report report.xml oval.xml
   

# How to use CSAF

Common Security Advisory Framework (CSAF) is a machine-readable format, standardized by OASIS. TuxCare publishes CSAF VEX and Security Advisory files in CSAF 2.0 format at security.tuxcare.com.

provider-metadata.json is available at:

• csaf.data.security.tuxcare.com
• tuxcare.com/.well-known/csaf/provider-metadata.json

The CSAF files are published in JSON format — OASIS provides a list of reference tools that support CSAF.