Rule package_rsh_removed could return false positive on Ubuntu with OpenSCAP 1.4.3 #14187
Description
Description of problem:
Since version 1.4.3, OpenSCAP's dpkg probe is able to handle virtual packages.
This causes an issue with the package_rsh_removed rule.
The package_rsh_removed rule checks for the absence of the rsh-client package. However, the rsh-client package could either be the actual unwanted rsh-client package, or a virtual package provided by the openssh-client package.
When the openssh-client package is installed, the virtual package rsh-client is satisfied, hence triggering false positive on the package_rsh_removed rule.
Ubuntu 20.04 and 22.04 both have the issue, since there is a actual rsh-client package present, as well as the rsh-client virtual package provided by the openssh-client package.
Ubuntu 24.04 doesn't have the issue, since the rsh-client package is not present and, while the rsh-client virtual package still exists, it's not provided by any package.
SCAP Security Guide Version:
Operating System Version:
Ubuntu 20.04, 22.04.