I'm trying to build a service that can take a distro, package, and a version number, and use that information to check if there's an active CVE out for that tuple.
after some searching, I've found that changelogs reliably cite CVEs, so I was thinking about parsing changelogs for CVE ids and reporting based on that. unfortunately, we run a very heterogenous architecture, with CentOS, Ubuntu, and Debian boxes running our software.
I know that each box can fetch changelogs for itself, but this isn't feasible because of how we set up monitoring (I know I know, but trust me on this one). I have a data dump of the package info for all of these machines sitting on a server, and the data is regularly updated as these boxes phone home.
is there a way to have a single machine that can fetch changelogs for every distro? or do I need an Ubuntu machine to fetch the Ubuntu changelogs, a CentOS one to call
yum changelog, etc.?