Ubuntu 24.04 - Fail to produce a valid STIG Viewer XCCDF (.xml) report.

[CosmicWaffle99]

Description of problem:

When evaluating an Ubuntu 24.04 LTS Docker container image using the Ubuntu 24.04 STIG V1R5 profile, the normal XCCDF results are generated correctly, but the OpenSCAP --stig-viewer output contains zero rule results.

The same evaluation produces 648 elements when using --results, while the file generated using --stig-viewer contains zero elements.

As a result, the generated STIG Viewer XML cannot be used successfully with DISA STIG Viewer 3.8.

I am reporting this to ComplianceAsCode to determine whether the generated Ubuntu 24.04 STIG V1R5 content contains the STIG reference/mapping metadata required by OpenSCAP's --stig-viewer transformation.

SCAP Security Guide Version:

SCAP Security Guide (SSG) 0.1.82

Profile:
Title: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide (STIG) V1R5 Id: xccdf_org.ssgproject.content_profile_stig

OpenSCAP version: 1.4.4

STIG Viewer version: 3.8

Operating System Version:

Ubuntu 24.04 LTS Docker container image

Steps to Reproduce:

1. Verify the Ubuntu 24.04 STIG profile:
   oscap info /usr/share/xml/scap/ssg/ssg-ubuntu2404-ds.xml
   The profile is reported as:
   Title: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide (STIG) V1R5
   Id: xccdf_org.ssgproject.content_profile_stig

2. Evaluate an Ubuntu 24.04 Docker image and generate both normal XCCDF and STIG Viewer results from the same evaluation:oscap-docker image <IMAGE_ID> xccdf eval
   --profile xccdf_org.ssgproject.content_profile_stig
   --results normal-results.xml
   --stig-viewer stig-viewer-results.xml
   /usr/share/xml/scap/ssg/ssg-ubuntu2404-ds.xml

3. Count the XCCDF results:
   echo "Normal XCCDF results:"
   grep -c '' normal-results.xml

echo "STIG Viewer results:"
grep -c '' stig-viewer-results.xml

echo "Normal rule-results:"
grep -c '<rule-result ' normal-results.xml

echo "STIG Viewer rule-results:"
grep -c '<rule-result ' stig-viewer-results.xml

Observed Results:

Normal XCCDF results:
648
STIG Viewer results:
0
Normal rule-results:
648
STIG Viewer rule-results:
0

Attempt to import stig-viewer-results.xml into DISA STIG Viewer 3.8:
Import Failed
The selected file could not be parsed as a valid XCCDF or CMRS Results file. Please verify the file format and try again.

Expected Results:

STIG Viewer results and STIG Viewer rule-results should match with the Normal rule-results.
STIG Viewer import ox the XCCDF xml file should be successful.

Additional Information/Debugging Steps:

The following check was performed against the SSG 0.1.82 Ubuntu 24.04 source data stream:

echo "SV identifiers:"
grep -o 'SV-[A-Za-z0-9_-]*'
/usr/share/xml/scap/ssg/ssg-ubuntu2404-ds.xml
| sort -u | wc -l

echo "Vulnerability IDs:"
grep -o 'V-[0-9]*'
/usr/share/xml/scap/ssg/ssg-ubuntu2404-ds.xml
| sort -u | wc -l

echo "CCI identifiers:"
grep -o 'CCI-[0-9]*'
/usr/share/xml/scap/ssg/ssg-ubuntu2404-ds.xml
| sort -u | wc -l

Results:

SV identifiers:
0
Vulnerability IDs:
1
CCI identifiers:
0

This may indicate that the generated Ubuntu 24.04 data stream does not contain the DISA STIG reference/mapping information in the format expected by OpenSCAP's --stig-viewer transformation. However, I am not certain whether these identifiers are expected to appear directly in the generated source data stream, so this information is provided for debugging rather than as a conclusion about the root cause.

OpenSCAP also reports the following warning during the Docker image evaluation:
"W: oscap: Requested offline mode is not supported by uname probe."
Despite this warning, normal XCCDF evaluation completes and produces 648 rule results, so the warning does not appear to explain why only the --stig-viewer output contains zero results.

Performing the equivalent scan against an Ubuntu 22.04 Docker image using the Ubuntu 22.04 SSG STIG profile successfully produces STIG Viewer rule results.