did OpenSCAP scan initially and was inform of that the server had 16 hits on definitions that require patching.
performed yum update and rebooted said server and its reflecting the newer version :2.6.32-696.20.1.el6.x86_64
after patching, re-did OpenSCAP scan and the 16 hits are still marked as true. checked CVEs details on redhat forum links for the CVEs and my server should have already have those patched as my kernel is updated.
as precaution, removed older copies of the redhat definition file (Red_Hat_Enterprise_Linux_6.xml) and re did a the evaluation scan. results still presenting as 16 hits on CVE vulnerabilities.
performed manual scan per CVE getting true for them.
output on the results of the indivdual scans as follows as sample.
oscap oval eval --id oval:com.redhat.rhsa:def:20180169 /Red_Hat_Enterprise_Linux_6.xml Definition oval:com.redhat.rhsa:def:20180169: true Evaluation done. [kernel-2.6.32-696.20.1.el6.x86_64.rpm fix as per redhat]
oscap oval eval --id oval:com.redhat.rhsa:def:20180008 /Red_Hat_Enterprise_Linux_6.xml Definition oval:com.redhat.rhsa:def:20180008: true Evaluation done. [kernel-2.6.32-696.18.7.el6.x86_64.rpm fix as per redhat]
Would greatly appreciate for guidance if i did something wrong or insights on what could have resulted in this scenario.
my server version : 2.6.32-696.20.1.el6.x86_64 OpenSCAP version ==== Supported specifications ==== XCCDF Version: 1.2 OVAL Version: 5.11.1 CPE Version: 2.3 CVSS Version: 2.0 CVE Version: 2.0 Asset Identification Version: 1.1 Asset Reporting Format Version: 1.1