# CVE Binary Tool quick start / README
[](https://github.com/intel/cve-bin-tool/actions)
[](https://codecov.io/gh/intel/cve-bin-tool)
[](https://gitter.im/cve-bin-tool/community?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
[](https://cve-bin-tool.readthedocs.io/en/latest/)
[](https://pypi.org/project/cve-bin-tool/)
[](https://github.com/python/black)
[](https://pycqa.github.io/isort/)
[](https://bestpractices.coreinfrastructure.org/projects/5380)
[](https://securityscorecards.dev/viewer/?uri=github.com/intel/cve-bin-tool)
The CVE Binary Tool is a free, open source tool to help you find known vulnerabilities in software, using data from the [National Vulnerability Database](https://nvd.nist.gov/) (NVD) list of [Common Vulnerabilities and Exposures](<https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures#:~:text=Common%20Vulnerabilities%20and%20Exposures%20(CVE)%20is%20a%20dictionary%20of%20common,publicly%20known%20information%20security%20vulnerabilities.>) (CVEs) as well as known vulnerability data from [Redhat](https://access.redhat.com/hydra/rest/securitydata), [Open Source Vulnerability Database (OSV)](https://osv.dev/), [Gitlab Advisory Database (GAD)](https://advisories.gitlab.com/about/index.html), and [Curl](https://curl.se/docs/vuln.json).
CVE Binary Tool uses the NVD API but is not endorsed or certified by the NVD.
The tool has two main modes of operation:
1. A binary scanner which helps you determine which packages may have been included as part of a piece of software. There are <!-- NUMBER OF CHECKERS START-->359<!--NUMBER OF CHECKERS END--> checkers. Our initial focus was on common, vulnerable open source components such as openssl, libpng, libxml2 and expat.
2. Tools for scanning known component lists in various formats, including .csv, several linux distribution package lists, language specific package scanners and several Software Bill of Materials (SBOM) formats.
It is intended to be used as part of your continuous integration system to enable regular vulnerability scanning and give you early warning of known issues in your supply chain. It can also be used to auto-detect components and create SBOMs.
What CVE Binary Tool does when it runs:
1. Download CVE Data (from NVD, Redhat, OSV, Gitlab, and Curl).
- This happens once per day by default, not every time a scan is run.
- On first run, downloading all data can take some time.
2. Create/read a component list. There are two modes of operation:
1. Creates a component list (including versions) using a combination of binary checkers and language component lists (such as python's requirements.txt).
2. Read SBOM (use an existing component list in a standardized Software Bill of Materials format.)
3. Create CVE List
- This looks up all components found or read from an existing bill of materials and reports back any known issues associated with them
4. Include triage/additional data
- There are several options for adding triage/notes, information from previous reports to track vulnerability change over time, or known fix data
5. Generate report in one or more formats (console, json, csv, html, pdf)
For more details, see our [documentation](https://cve-bin-tool.readthedocs.io/en/latest/) or this [quickstart guide](https://cve-bin-tool.readthedocs.io/en/latest/README.html)
- [CVE Binary Tool quick start / README](#cve-binary-tool-quick-start--readme)
- [Installing CVE Binary Tool](#installing-cve-binary-tool)
- [Most popular usage options](#most-popular-usage-options)
- [Finding known vulnerabilities using the binary scanner](#finding-known-vulnerabilities-using-the-binary-scanner)
- [Scanning an SBOM file for known vulnerabilities](#scanning-an-sbom-file-for-known-vulnerabilities)
- [Generating an SBOM](#generating-an-sbom)
- [Triaging vulnerabilities](#triaging-vulnerabilities)
- [Using the tool offline](#using-the-tool-offline)
- [Using CVE Binary Tool in GitHub Actions](#using-cve-binary-tool-in-github-actions)
- [Output Options](#output-options)
- [Configuration](#configuration)
- [Auto-detection of components](#auto-detection-of-components)
- [Binary checker list](#binary-checker-list)
- [Language Specific checkers](#language-specific-checkers)
- [Supported Archive Formats](#supported-archive-formats)
- [Additional Requirements](#additional-requirements)
- [Limitations](#limitations)
- [Feedback \& Contributions](#feedback--contributions)
- [Security Issues](#security-issues)
- [Full option list](#full-option-list)
## Installing CVE Binary Tool
CVE Binary Tool can be installed using pip:
```console
pip install cve-bin-tool
```
If you want to try the latest code from
[the cve-bin-tool github](https://github.com/intel/cve-bin-tool) or do development, you can also `pip install --user -e .` to install a local copy from a directory. The [Contributor Documentation](https://github.com/intel/cve-bin-tool/blob/main/CONTRIBUTING.md) covers how to set up for local development in more detail.
Pip will install the python requirements for you, but for some types of extraction we use system libraries. If you have difficulties extracting files, you may want to look at our [additional Requirements lists for Linux and Windows](#additional-requirements).
On first usage (and by default, once per day) The tool will download vulnerability data from [a set of known vulnerability data sources](https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#data-sources). Due to reliability issues with NVD, as of release 3.3 we will be using our own NVD mirror at [https://cveb.in/](https://cveb.in/) by default rather than contacting NVD directly. If you wish to get data directly from the NVD servers you must [provide your own NVD_API_KEY](https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--nvd-api-key-nvd_api_key) to use their API.
If you are using a release prior to 3.3 that does not use our mirror, please use an NVD_API_KEY as described above.
## Most popular usage options
### Finding known vulnerabilities using the binary scanner
To run the binary scanner on a directory or file:
```bash
cve-bin-tool <directory/file>
```
> **Note**: That this option will also use any [language specific checkers](#language-specific-checkers) to find known vulnerabilities in components.
By default, the tool assumes you are attempting to scan a whole directory, but if you provide it with a single .csv or .json file that lists dependencies it will treat it as a bill of materials. You can also specify bill of materials files directly using [the `--input-file` option](https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-i-input_file---input-file-input_file) or scan SBOMs with the instructions below.
### Scanning an SBOM file for known vulnerabilities
To scan a software bill of materials file (SBOM):
```bash
cve-bin-tool --sbom <sbom_filetype> --sbom-file <sbom_filename>
```
Valid SBOM types are [SPDX](https://spdx.dev/specifications/),
[CycloneDX](https://cyclonedx.org/specification/overview/), and [SWID](https://csrc.nist.gov/projects/software-identification-swid/guidelines).
Scanning of product names within an SBOM file is case insensitive.
The [SBOM scanning how-to guide](https://github.com/intel/cve-bin-tool/blob/main/doc/how_to_guides/sbom.md) provides additional SBOM scanning examples.
### Generating an SBOM
As well as scanning SBOMs, CVE Binary Tool can be used to generate an SBOM from a scan as follows:
```bash
cve-bin-tool --sbom-type <sbom_type> --sbom-format <sbom-format> --sbom-output <sbom_filename> <other scan options as required>
```
Valid SBOM types are [SPDX](https://spdx.dev/specifications/) and [CycloneDX](https://cyclonedx.org/specification/overview/).
The generated SBOM will include product name, version and supplier (where available). License information is not provided.
The [SBOM generation how-to guide](https://github.com/intel/cve-bin-tool/blob/main/doc/how_to_guides/sbom_generation.md) provides additional SBOM generation examples.
### Triaging vulnerabilities
The `--triage-input-file` option can be used to add extra triage data like remarks, comments etc. while scanning a directory so that output will reflect this triage data and you can save time of re-triaging (Usage: `cve-bin-tool --triage-input-file test.vex /path/to/scan`).
The supported format is the [CycloneDX](https://cyclonedx.org/capabilities/vex/) VEX format which can be generated using the `--vex` option.
Typical usage:
1. Generate triage file using `cve-bin-tool /path/to/scan --vex triage.vex`
2. Edit triage.vex with your favourite text editor to provide triage information on the vulnerabilities listed.
3. Use this triage file for future scans as follows: `cve-bin-tool /path/to/scan --triage-input-file triage.vex`
It should be possible to share triage data across different runs of cve-bin-tool or with other tools that support the CycloneDX VEX format. This would be particularly useful for teams that scan related products or containers, teams that need to use multiple tools for compliance reasons, companies that have a central security policy group that provides guidance on vulnerability triage, and more.
### Using the tool offline
Specifying the `--offline` option when running a scan ensures that cve-bin-tool doesn't attempt to download the latest database files or to check for a newer version of the tool.
Note that you will need to obtain a copy of the vulnerability data before the tool can run in offline mode. [The offline how-to guide contains more information on how to set up your database.](https://github.com/intel/cve-bin-tool/blob/main/doc/how_to_guides/offline.md)
### Using CVE Binary Tool in GitHub Actions
If you want to integrate cve-bin-tool as a part of your github action pipeline, you can use cve-bin-tool's official GitHub Action. Find more details [here](https://github.com/intel/cve-bin-tool-action/#cve-binary-tool-github-action). The GitHub Action provide reports on the security tab, which is available to open source projects as well as GitHub customers who have paid for that access.
We also provide an example [GitHub action](https://github.com/intel/cve-bin-tool/blob/main/doc/how_to_guides/cve_scanner_gh_action.yml) if you wish to use the tool directly. This may be a good choice for teams who want to store reports in an evidence locker or those who don't have access to the GitHub Security tab.
## Output Options
The CVE Binary Tool provides console-based output by default. If you wish to provide another format, you can specify this and a filename on the command line using `--format`. The valid formats are CSV, JSON, console, HTML and PDF. The output filename can be specified using the `--output-file` flag.
You can also specify multiple output formats by using comma (',') as separator:
```bash
cve-bin-tool file -f csv,json,html -o report
```
Note: You must not use spaces between the commas (',') and the output formats.
The reported vulnerabilities can additionally be reported in the
Vulnerability Exchange (VEX) format by specifying `--vex` command line option.
The generated VEX file can then be used as a `--triage-input-file` to support
a triage process.
If you wish to use PDF support, you will need to install the `reportlab`
library separately.
If you intend to use PDF support when you install cve-bin-tool you can specify it and report lab will be installed as part of the cve-bin-tool install:
```console
pip install cve-bin-tool[PDF]
```
If you've already installed cve-bin-tool you can add reportlab after the fact
using pip:
```console
pip install --upgrade reportlab
```
Note that reportlab was taken out of the default cve-bin-tool install because
it has a known CVE associated with it
([CVE-2020-28463](https://nvd.nist.gov/vuln/detail/CVE-2020-28463)). The
cve-bin-tool code uses the recommended mitigations to limit which resources
added to PDFs, as well as additional input validation. This is a bit of a
strange CVE because it describes core functionality of PDFs: external items,
such as images, can be embedded in them, and thus anyone viewing a PDF could
load an external image (similar to how viewing a web page can trigger external
loads). There's no inherent "fix" for that, only mitigations where users of
the library must ensure only expected items are added to PDFs at the time of
generation.
Since users may not want to have software installed with an open, unfixable CVE
associated with it, we've opted to make PDF support only available to users who
have installed the library themselves. Once the library is installed, the PDF
report option will function.
## Configuration
You can use `--config` option to provide configuration file for the tool. You can still override options specified in config file with command line arguments. See our sample config files in the
[test/config](https://github.com/intel/cve-bin-tool/blob/main/test/config/)
## Auto-detection of components
CVE Binary tool attempts to do auto-detection of components using binary checkers, supported language component lists, and file extraction methods. The supported tools for auto-detection are listed below.
### Binary checker list
The following checkers are available for finding components in binary files:
<!--CHECKERS TABLE BEGIN-->
| | | | Available checkers | | | |
|--------------- |--------------- |------------------ |-------------- |---------------- |------------ |----------------- |
| accountsservice |acpid |apache_http_server |apcupsd |apparmor |asn1c |assimp |
| asterisk |atftp |avahi |axel |bash |bind |binutils |
| bird |bison |bluez |boinc |botan |bro |bubblewrap |
| busybox |bwm_ng |bzip2 |c_ares |capnproto |ceph |chess |
| chrony |civetweb |clamav |collectd |commons_compress |connman |coreutils |
| cpio |cronie |cryptsetup |cups |curl |cvs |darkhttpd |
| dav1d |davfs2 |dbus |debianutils |dhclient |dhcpcd |dhcpd |
| dmidecode |dnsmasq |docker |domoticz |dosfstools |dotnet |dovecot |
| doxygen |dpkg |dropbear |e2fsprogs |ed |elfutils |emacs |
| enscript |exfatprogs |exim |exiv2 |f2fs_tools |faad2 |fastd |
| ffmpeg |file |firefox |flac |fluidsynth |freeradius |freerdp |
| fribidi |frr |gawk |gcc |gdal |gdb |gdk_pixbuf |
| gimp |git |glib |glibc |gmp |gnomeshell |gnupg |
| gnutls |go |gpgme |gpsd |graphicsmagick |grep |grub2 |
| gstreamer |gupnp |gvfs |gzip |haproxy |harfbuzz |haserl |
| hdf5 |heimdal |hostapd |hunspell |hwloc |i2pd |icecast |
| icu |iperf3 |ipmitool |ipsec_tools |iptables |irssi |iucode_tool |
| iwd |jack2 |jacksondatabind |janus |jhead |jq |json_c |
| kbd |keepalived |kerberos |kexectools |kodi |kubernetes |ldns |
| lftp |libarchive |libass |libbpg |libcoap |libconfuse |libcurl |
| libdb |libde265 |libebml |libevent |libexpat |libgcrypt |libgd |
| libgit2 |libheif |libical |libidn2 |libinput |libjpeg |libjpeg_turbo |
| libksba |liblas |libmatroska |libmemcached |libmicrohttpd |libmodbus |libnss |
| libpcap |libraw |librsvg |librsync |libsamplerate |libseccomp |libsndfile |
| libsolv |libsoup |libsrtp |libssh |libssh2 |libtasn1 |libtiff |
| libtomcrypt |libupnp |libuv |libvips |libvirt |libvncserver |libvorbis |
| libvpx |libxslt |lighttpd |linux_kernel |lldpd |logrotate |lrzip |
| lua |luajit |lxc |lynx |lz4 |mailx |mariadb |
| mbedtls |mdadm |memcached |micropython |minetest |mini_httpd |minicom |
| minidlna |miniupnpc |miniupnpd |moby |modsecurity |monit |mosquitto |
| motion |mpg123 |mpv |msmtp |mtr |mupdf |mutt |
| mysql |nano |nasm |nbd |ncurses |neon |nessus |
| netatalk |netdata |netkit_ftp |netpbm |nettle |nghttp2 |nginx |
| ngircd |nmap |node |ntfs_3g |ntp |ntpsec |open_iscsi |
| open_vm_tools |openafs |opencv |openjpeg |openldap |opensc |openssh |
| openssl |openswan |openvpn |p7zip |pango |patch |pcre |
| pcre2 |pcsc_lite |perl |php |picocom |pigz |pixman |
| png |polarssl_fedora |poppler |postgresql |ppp |privoxy |procps_ng |
| proftpd |protobuf_c |pspp |pure_ftpd |putty |python |qemu |
| qpdf |qt |quagga |radare2 |radvd |raptor |rauc |
| rdesktop |readline |rpm |rsync |rsyslog |rtl_433 |rtmpdump |
| runc |rust |samba |sane_backends |sdl |seahorse |shadowsocks_libev |
| snapd |sngrep |snort |socat |sofia_sip |speex |spice |
| sqlite |squashfs |squid |sslh |stellarium |strongswan |stunnel |
| subversion |sudo |suricata |sylpheed |syslogng |sysstat |systemd |
| tar |tcpdump |tcpreplay |terminology |tesseract |thrift |thttpd |
| thunderbird |timescaledb |tinyproxy |tor |tpm2_tss |traceroute |transmission |
| trousers |twonky_server |u_boot |udisks |unbound |unixodbc |upx |
| util_linux |varnish |vim |vlc |vorbis_tools |vsftpd |webkitgtk |
| wget |wireshark |wolfssl |wpa_supplicant |xerces |xml2 |xscreensaver |
| xwayland |yasm |zabbix |zchunk |zeek |zlib |znc |
| zsh |zstandard | | | | | |
<!--CHECKERS TABLE END-->
All the checkers can be found in the checkers directory, as can the
[instructions on how to add a new checker](https://github.com/intel/cve-bin-tool/blob/main/cve_bin_tool/checkers/README.md).
Support for new checkers can be requested via
[GitHub issues](https://github.com/intel/cve-bin-tool/issues).
### Language Specific checkers
A number of checkers are available for finding vulnerable components in specific language packages.
| Language | Files supported |
| ---------- | ----------------------------------------------- |
| Dart | `pubspec.lock` |
| Go | `Go.mod` |
| Java | `pom.xml`; JAR, WAR and EAR archives |
| JavaScript | `package-lock.json` |
| Rust | `Cargo.lock` |
| Ruby | `Gemfile.lock` |
| R | `renv.lock` |
| Swift | `Package.resolved` |
| Python | `requirements.txt`, `PKG-INFO`, `METADATA`; .whl and .egg files |
| Perl | `cpanfile` |
More information on [language-specific checkers](https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#language-specific-checkers) can be found in the [CVE Binary Tool manual](https://cve-bin-tool.readthedocs.io/en/latest/MANUAL.html).
### Supported Archive Formats
The following archive formats are currently supported by the auto-extractor:
| Archive Format | File Extension |
| -------------- | ---------------------------------------------- |
| zip | .zip, .exe, .jar, .msi, .egg, .whl, .war, .ear |
| tar | .tar, .tgz, .tar.gz, .tar.xz, .tar.bz2 |
| deb | .deb, .ipk |
| rpm | .rpm |
| cab | .cab |
| apk | .apk |
| zst | .zst |
| pkg | .pkg |
## Additional Requirements
To use the auto-extractor, you may need the following utilities depending on the type of [supported archive formats](#supported-archive-formats) you need to extract.
The utilities below are required to run the full test suite on Linux:
- `file`
- `strings`
- `tar`
- `unzip`
- `rpm2cpio`
- `cpio`
- `ar`
- `cabextract`
Most of these are installed by default on many Linux systems, but `cabextract` and
`rpm2cpio` in particular might need to be installed.
On windows systems, you may need:
- `ar`
- `7z`
- `Expand`
- `pdftotext`
Windows has `Expand` installed by default, but `ar` and `7z` might need to be installed.
If you want to run our test-suite or scan a zstd compressed file, We recommend installing this [7-zip-zstd](https://github.com/mcmilk/7-Zip-zstd)
fork of 7zip. We are currently using `7z` for extracting `jar`, `apk`, `msi`, `exe` and `rpm` files.
To install `ar` you can install MinGW (which has binutils as a part of it) from [here](https://www.mingw-w64.org/downloads/#msys2) and run the downloaded .exe file.
If you get an error about building libraries when you try to install from pip,
you may need to install the Windows build tools. The Windows build tools are
available for free from
<https://visualstudio.microsoft.com/visual-cpp-build-tools/>
If you get an error while installing brotlipy on Windows, installing the
compiler above should fix it.
`pdftotext` is required for running tests. (users of cve-bin-tool may not need it, developers likely will.) The best approach to install it on Windows involves using [conda](https://docs.conda.io/projects/conda/en/latest/user-guide/install/windows.html) (click [here](https://anaconda.org/conda-forge/pdftotext) for further instructions).
You can check [our CI configuration](https://github.com/intel/cve-bin-tool/blob/main/.github/workflows/testing.yml) to see what versions of python we're explicitly testing.
## Limitations
This scanner does not attempt to exploit issues or examine the code in greater
detail; it only looks for library signatures and version numbers. As such, it
cannot tell if someone has backported fixes to a vulnerable version, and it
will not work if library or version information was intentionally obfuscated.
This tool is meant to be used as a quick-to-run, easily-automatable check in a
non-malicious environment so that developers can be made aware of old libraries
with security issues that have been compiled into their binaries.
The tool does not guarantee that any vulnerabilities reported are actually present or exploitable, neither is it able to find all present vulnerabilities with a guarantee.
Users can add triage information to reports to mark issues as false positives, indicate that the risk has been mitigated by configuration/usage changes, and so on.
Triage details can be re-used on other projects so, for example, triage on a Linux base image could be applied to multiple containers using that image.
For more information and usage of triage information with the tool kindly have a look [here](https://cve-bin-tool.readthedocs.io/en/latest/MANUAL.html#triage-input-file-input-file).
If you are using the binary scanner capabilities, be aware that we only have a limited number of binary checkers (see table above) so we can only detect those libraries. Contributions of new checkers are always welcome! You can also use an alternate way to detect components (for example, a bill of materials tool such as [tern](https://github.com/tern-tools/tern)) and then use the resulting list as input to cve-bin-tool to get a more comprehensive vulnerability list.
The tool uses a vulnerability database in order to detect the present vulnerabilities, in case the database is not frequently updated (specially if the tool is used in offline mode), the tool would be unable to detect any newly discovered vulnerabilities. Hence it is highly advised to keep the database updated.
The tool does not guarantee that all vulnerabilities are reported as the tool only has access to a limited number of publicly available vulnerability databases.
Contributions to introduce new sources of data to the tool are always welcome.
Whilst some validation checks are performed on the data within the vulnerability database, the tool is unable to assert the quality of the data or correct any
discrepancies if the data is incomplete or inconsistent. This may result, for example, in some vulnerability reports where the severity is reported as UNKNOWN.
## Feedback & Contributions
Bugs and feature requests can be made via [GitHub
issues](https://github.com/intel/cve-bin-tool/issues). Be aware that these issues are
not private, so take care when providing output to make sure you are not
disclosing security issues in other products.
Pull requests are also welcome via git.
- New contributors should read the [contributor guide](https://github.com/intel/cve-bin-tool/blob/main/CONTRIBUTING.md) to get started.
- Folk who already have experience contributing to open source projects may not need the full guide but should still use the [pull request checklist](https://github.com/intel/cve-bin-tool/blob/main/CONTRIBUTING.md#checklist-for-a-great-pull-request) to make things easy for everyone.
CVE Binary Tool contributors are asked to adhere to the [Python Community Code of Conduct](https://www.python.org/psf/conduct/). Please contact [Terri](https://github.com/terriko/) if you have concerns or questions relating to this code of conduct.
## Security Issues
Security issues with the tool itself can be reported to Intel's security
incident response team via
[https://intel.com/security](https://intel.com/security).
If in the course of using this tool you discover a security issue with someone
else's code, please disclose responsibly to the appropriate party.
## Full option list
Usage:
`cve-bin-tool <directory/file to scan>`
<pre>
options:
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-h---help">-h, --help</a> show this help message and exit
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-e-exclude---exclude-exclude">-e EXCLUDE, --exclude</a> EXCLUDE
Comma separated Exclude directory path
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-v---version">-V, --version</a> show program's version number and exit
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--disable-version-check">--disable-version-check</a>
skips checking for a new version
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--disable-validation-check">--disable-validation-check</a>
skips checking xml files against schema
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--offline">--offline</a> operate in offline mode
--detailed add CVE description in csv or json report (no effect on console, html or pdf)
CVE Data Download:
Arguments related to data sources and Cache Configuration
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-n-json-nvdjson-mirrorapiapi2---nvd-json-nvdjson-mirrorapiapi2">-n {api,api2,json,json-mirror,json-nvd}, --nvd {api,api2,json,json-mirror,json-nvd}</a>
choose method for getting CVE lists from NVD
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-u-nowdailyneverlatest---update-nowdailyneverlatest">-u {now,daily,never,latest}, --update {now,daily,never,latest}</a>
update schedule for data sources and exploits database (default: daily)
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--nvd-api-key-nvd_api_key">--nvd-api-key NVD_API_KEY</a>
specify NVD API key (used to improve NVD rate limit)
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-d-nvdosvgadcurl-nvdosvgadcurl----disable-data-source-nvdosvgadcurl-nvdosvgadcurl-">-d DISABLE_DATA_SOURCE, --disable-data-source DISABLE_DATA_SOURCE</a>
comma-separated list of data sources (CURL, EPSS, GAD, NVD, OSV, REDHAT, RSD) to disable (default: NONE)
--use-mirror USE_MIRROR
use an mirror to update the database
Input:
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#directory-positional-argument">directory</a> directory to scan
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-i-input_file---input-file-input_file">-i INPUT_FILE, --input-file INPUT_FILE</a>
provide input filename
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--triage-input-file-input_file">--triage-input-file TRIAGE_INPUT_FILE</a>
provide input filename for triage data
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-c-config---config-config">-C CONFIG, --config CONFIG</a>
provide config file
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-l-package_list---package-list-package_list">-L PACKAGE_LIST, --package-list PACKAGE_LIST</a>
provide package list
--sbom {spdx,cyclonedx,swid}
specify type of software bill of materials (sbom) (default: spdx)
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--sbom-file-sbom_file">--sbom-file SBOM_FILE</a>
provide sbom filename
Output:
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#quiet-mode">-q, --quiet</a> suppress output
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#logging-modes">-l {debug,info,warning,error,critical}, --log {debug,info,warning,error,critical}</a>
log level (default: info)
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-o-output_file---output-file-output_file">-o OUTPUT_FILE, --output-file OUTPUT_FILE</a>
provide output filename (default: output to stdout)
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--html-theme-html_theme">--html-theme HTML_THEME</a>
provide custom theme directory for HTML Report
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-f-csvjsonconsolehtml---format-csvjsonconsolehtml">-f {csv,json,console,html,pdf}, --format {csv,json,console,html,pdf}</a>
update output format (default: console)
specify multiple output formats by using comma (',') as a separator
note: don't use spaces between comma (',') and the output formats.
--generate-config {yaml,toml,yaml,toml,toml,yaml}
generate config file for cve bin tool in toml and yaml formats.
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-c-cvss---cvss-cvss">-c CVSS, --cvss CVSS</a> minimum CVSS score (as integer in range 0 to 10) to report (default: 0)
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-s-lowmediumhighcritical---severity-lowmediumhighcritical">-S {low,medium,high,critical}, --severity {low,medium,high,critical}</a>
minimum CVE severity to report (default: low)
--metrics
check for metrics (e.g., EPSS) from found cves
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--epss-percentile">--epss-percentile EPSS_PERCENTILE</a>
minimum epss percentile of CVE range between 0 to 100 to report
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--epss-probability">--epss-probability EPSS_PROBABILITY</a>
minimum epss probability of CVE range between 0 to 100 to report
--no-0-cve-report only produce report when CVEs are found
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-a-distro_name-distro_version_name---available-fix-distro_name-distro_version_name">-A [<distro_name>-<distro_version_name>], --available-fix [<distro_name>-<distro_version_name>]</a>
Lists available fixes of the package from Linux distribution
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-b-distro_name-distro_version_name---backport-fix-distro_name-distro_version_name">-b [<distro_name>-<distro_version_name>], --backport-fix [<distro_name>-<distro_version_name>]</a>
Lists backported fixes if available from Linux distribution
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--affected-versions">--affected-versions</a> Lists versions of product affected by a given CVE (to facilitate upgrades)
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--vex-vex_file">--vex VEX</a> Provide vulnerability exchange (vex) filename
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--sbom-output-sbom_output">--sbom-output SBOM_OUTPUT</a>
provide software bill of materials (sbom) filename to generate
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--sbom-type">--sbom-type {spdx,cyclonedx}</a>
specify type of software bill of materials (sbom) to generate (default: spdx)
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--sbom-format">--sbom-format {tag,json,yaml}</a>
specify format of software bill of materials (sbom) to generate (default: tag)
Merge Report:
Arguments related to Intermediate and Merged Reports
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-a-intermediate_path---append-intermediate_path">-a [APPEND], --append [APPEND]</a>
save output as intermediate report in json format
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-t-tag---tag-tag">-t TAG, --tag TAG</a> add a unique tag to differentiate between multiple intermediate reports
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-m-intermediate_reports---merge-intermediate_reports">-m MERGE, --merge MERGE</a>
comma separated intermediate reports path for merging
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-f-tags---filter-tags">-F FILTER, --filter FILTER</a>
comma separated tag string for filtering intermediate reports
Checkers:
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-s-skips---skips-skips">-s SKIPS, --skips SKIPS</a>
comma-separated list of checkers to disable
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-r-checkers---runs-checkers">-r RUNS, --runs RUNS</a> comma-separated list of checkers to enable
Database Management:
--import-json IMPORT_JSON
import database from json files chopped by years
--ignore-sig do not verify PGP signature while importing json data
--log-signature-error
when the signature doesn't match log the error only instead of halting (UNSAFE)
--verify PGP_PUBKEY_PATH
verify PGP sign while importing json files
--export-json EXPORT_JSON
export database as json files chopped by years
--pgp-sign PGP_PRIVATE_KEY_PATH
sign exported json files with PGP
--passphrase PASSPHRASE
required passphrase for signing with PGP
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--export-export">--export EXPORT</a> export database filename
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--import-import">--import IMPORT</a> import database filename
Exploits:
--exploits check for exploits from found cves
Deprecated:
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-x---extract">-x, --extract</a> autoextract compressed files
<a href="https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--report">--report</a> Produces a report even if there are no CVE for the respective output format
</pre>
For further information about all of these options, please see [the CVE Binary Tool user manual](https://cve-bin-tool.readthedocs.io/en/latest/MANUAL.html).
Raw data
{
"_id": null,
"home_page": "https://github.com/intel/cve-bin-tool",
"name": "cve-bin-tool",
"maintainer": "Terri Oda",
"docs_url": null,
"requires_python": ">=3.8",
"maintainer_email": "terri.oda@intel.com",
"keywords": "security, tools, CVE",
"author": "Terri Oda",
"author_email": "terri.oda@intel.com",
"download_url": "https://files.pythonhosted.org/packages/03/ab/4e64465182069ad710fbeb6b34262e7b71d554fcbc767aa4c7b87ffa2e93/cve-bin-tool-3.3.tar.gz",
"platform": null,
"description": "# CVE Binary Tool quick start / README\n\n[](https://github.com/intel/cve-bin-tool/actions)\n[](https://codecov.io/gh/intel/cve-bin-tool)\n[](https://gitter.im/cve-bin-tool/community?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)\n[](https://cve-bin-tool.readthedocs.io/en/latest/)\n[](https://pypi.org/project/cve-bin-tool/)\n[](https://github.com/python/black)\n[](https://pycqa.github.io/isort/)\n[](https://bestpractices.coreinfrastructure.org/projects/5380)\n[](https://securityscorecards.dev/viewer/?uri=github.com/intel/cve-bin-tool)\n\nThe CVE Binary Tool is a free, open source tool to help you find known vulnerabilities in software, using data from the [National Vulnerability Database](https://nvd.nist.gov/) (NVD) list of [Common Vulnerabilities and Exposures](<https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures#:~:text=Common%20Vulnerabilities%20and%20Exposures%20(CVE)%20is%20a%20dictionary%20of%20common,publicly%20known%20information%20security%20vulnerabilities.>) (CVEs) as well as known vulnerability data from [Redhat](https://access.redhat.com/hydra/rest/securitydata), [Open Source Vulnerability Database (OSV)](https://osv.dev/), [Gitlab Advisory Database (GAD)](https://advisories.gitlab.com/about/index.html), and [Curl](https://curl.se/docs/vuln.json).\n\nCVE Binary Tool uses the NVD API but is not endorsed or certified by the NVD.\n\nThe tool has two main modes of operation:\n\n1. A binary scanner which helps you determine which packages may have been included as part of a piece of software. There are <!-- NUMBER OF CHECKERS START-->359<!--NUMBER OF CHECKERS END--> checkers. Our initial focus was on common, vulnerable open source components such as openssl, libpng, libxml2 and expat.\n\n2. Tools for scanning known component lists in various formats, including .csv, several linux distribution package lists, language specific package scanners and several Software Bill of Materials (SBOM) formats. \n\nIt is intended to be used as part of your continuous integration system to enable regular vulnerability scanning and give you early warning of known issues in your supply chain. It can also be used to auto-detect components and create SBOMs.\n\nWhat CVE Binary Tool does when it runs:\n\n\n\n1. Download CVE Data (from NVD, Redhat, OSV, Gitlab, and Curl).\n - This happens once per day by default, not every time a scan is run.\n - On first run, downloading all data can take some time.\n2. Create/read a component list. There are two modes of operation:\n 1. Creates a component list (including versions) using a combination of binary checkers and language component lists (such as python's requirements.txt).\n 2. Read SBOM (use an existing component list in a standardized Software Bill of Materials format.)\n3. Create CVE List\n - This looks up all components found or read from an existing bill of materials and reports back any known issues associated with them\n4. Include triage/additional data\n - There are several options for adding triage/notes, information from previous reports to track vulnerability change over time, or known fix data\n5. Generate report in one or more formats (console, json, csv, html, pdf)\n\nFor more details, see our [documentation](https://cve-bin-tool.readthedocs.io/en/latest/) or this [quickstart guide](https://cve-bin-tool.readthedocs.io/en/latest/README.html)\n\n- [CVE Binary Tool quick start / README](#cve-binary-tool-quick-start--readme)\n - [Installing CVE Binary Tool](#installing-cve-binary-tool)\n - [Most popular usage options](#most-popular-usage-options)\n - [Finding known vulnerabilities using the binary scanner](#finding-known-vulnerabilities-using-the-binary-scanner)\n - [Scanning an SBOM file for known vulnerabilities](#scanning-an-sbom-file-for-known-vulnerabilities)\n - [Generating an SBOM](#generating-an-sbom)\n - [Triaging vulnerabilities](#triaging-vulnerabilities)\n - [Using the tool offline](#using-the-tool-offline)\n - [Using CVE Binary Tool in GitHub Actions](#using-cve-binary-tool-in-github-actions)\n - [Output Options](#output-options)\n - [Configuration](#configuration)\n - [Auto-detection of components](#auto-detection-of-components)\n - [Binary checker list](#binary-checker-list)\n - [Language Specific checkers](#language-specific-checkers)\n - [Supported Archive Formats](#supported-archive-formats)\n - [Additional Requirements](#additional-requirements)\n - [Limitations](#limitations)\n - [Feedback \\& Contributions](#feedback--contributions)\n - [Security Issues](#security-issues)\n - [Full option list](#full-option-list)\n\n## Installing CVE Binary Tool\n\nCVE Binary Tool can be installed using pip:\n\n```console\npip install cve-bin-tool\n```\n\nIf you want to try the latest code from\n[the cve-bin-tool github](https://github.com/intel/cve-bin-tool) or do development, you can also `pip install --user -e .` to install a local copy from a directory. The [Contributor Documentation](https://github.com/intel/cve-bin-tool/blob/main/CONTRIBUTING.md) covers how to set up for local development in more detail.\n\nPip will install the python requirements for you, but for some types of extraction we use system libraries. If you have difficulties extracting files, you may want to look at our [additional Requirements lists for Linux and Windows](#additional-requirements).\n\nOn first usage (and by default, once per day) The tool will download vulnerability data from [a set of known vulnerability data sources](https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#data-sources). Due to reliability issues with NVD, as of release 3.3 we will be using our own NVD mirror at [https://cveb.in/](https://cveb.in/) by default rather than contacting NVD directly. If you wish to get data directly from the NVD servers you must [provide your own NVD_API_KEY](https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--nvd-api-key-nvd_api_key) to use their API.\n\nIf you are using a release prior to 3.3 that does not use our mirror, please use an NVD_API_KEY as described above.\n\n## Most popular usage options\n\n### Finding known vulnerabilities using the binary scanner\n\nTo run the binary scanner on a directory or file:\n\n```bash\ncve-bin-tool <directory/file>\n```\n\n> **Note**: That this option will also use any [language specific checkers](#language-specific-checkers) to find known vulnerabilities in components.\n\nBy default, the tool assumes you are attempting to scan a whole directory, but if you provide it with a single .csv or .json file that lists dependencies it will treat it as a bill of materials. You can also specify bill of materials files directly using [the `--input-file` option](https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-i-input_file---input-file-input_file) or scan SBOMs with the instructions below.\n\n### Scanning an SBOM file for known vulnerabilities\n\nTo scan a software bill of materials file (SBOM):\n\n```bash\ncve-bin-tool --sbom <sbom_filetype> --sbom-file <sbom_filename>\n```\n\nValid SBOM types are [SPDX](https://spdx.dev/specifications/),\n[CycloneDX](https://cyclonedx.org/specification/overview/), and [SWID](https://csrc.nist.gov/projects/software-identification-swid/guidelines).\nScanning of product names within an SBOM file is case insensitive.\n\nThe [SBOM scanning how-to guide](https://github.com/intel/cve-bin-tool/blob/main/doc/how_to_guides/sbom.md) provides additional SBOM scanning examples.\n\n### Generating an SBOM\n\nAs well as scanning SBOMs, CVE Binary Tool can be used to generate an SBOM from a scan as follows:\n\n```bash\ncve-bin-tool --sbom-type <sbom_type> --sbom-format <sbom-format> --sbom-output <sbom_filename> <other scan options as required>\n```\n\nValid SBOM types are [SPDX](https://spdx.dev/specifications/) and [CycloneDX](https://cyclonedx.org/specification/overview/).\n\nThe generated SBOM will include product name, version and supplier (where available). License information is not provided.\n\nThe [SBOM generation how-to guide](https://github.com/intel/cve-bin-tool/blob/main/doc/how_to_guides/sbom_generation.md) provides additional SBOM generation examples.\n\n### Triaging vulnerabilities\n\nThe `--triage-input-file` option can be used to add extra triage data like remarks, comments etc. while scanning a directory so that output will reflect this triage data and you can save time of re-triaging (Usage: `cve-bin-tool --triage-input-file test.vex /path/to/scan`).\nThe supported format is the [CycloneDX](https://cyclonedx.org/capabilities/vex/) VEX format which can be generated using the `--vex` option.\n\nTypical usage:\n\n1. Generate triage file using `cve-bin-tool /path/to/scan --vex triage.vex`\n2. Edit triage.vex with your favourite text editor to provide triage information on the vulnerabilities listed.\n3. Use this triage file for future scans as follows: `cve-bin-tool /path/to/scan --triage-input-file triage.vex`\n\nIt should be possible to share triage data across different runs of cve-bin-tool or with other tools that support the CycloneDX VEX format. This would be particularly useful for teams that scan related products or containers, teams that need to use multiple tools for compliance reasons, companies that have a central security policy group that provides guidance on vulnerability triage, and more.\n\n### Using the tool offline\n\nSpecifying the `--offline` option when running a scan ensures that cve-bin-tool doesn't attempt to download the latest database files or to check for a newer version of the tool.\n\nNote that you will need to obtain a copy of the vulnerability data before the tool can run in offline mode. [The offline how-to guide contains more information on how to set up your database.](https://github.com/intel/cve-bin-tool/blob/main/doc/how_to_guides/offline.md)\n\n### Using CVE Binary Tool in GitHub Actions\n\nIf you want to integrate cve-bin-tool as a part of your github action pipeline, you can use cve-bin-tool's official GitHub Action. Find more details [here](https://github.com/intel/cve-bin-tool-action/#cve-binary-tool-github-action). The GitHub Action provide reports on the security tab, which is available to open source projects as well as GitHub customers who have paid for that access. \n\nWe also provide an example [GitHub action](https://github.com/intel/cve-bin-tool/blob/main/doc/how_to_guides/cve_scanner_gh_action.yml) if you wish to use the tool directly. This may be a good choice for teams who want to store reports in an evidence locker or those who don't have access to the GitHub Security tab.\n\n## Output Options\n\nThe CVE Binary Tool provides console-based output by default. If you wish to provide another format, you can specify this and a filename on the command line using `--format`. The valid formats are CSV, JSON, console, HTML and PDF. The output filename can be specified using the `--output-file` flag.\n\nYou can also specify multiple output formats by using comma (',') as separator:\n\n```bash\ncve-bin-tool file -f csv,json,html -o report\n```\n\nNote: You must not use spaces between the commas (',') and the output formats.\n\nThe reported vulnerabilities can additionally be reported in the\nVulnerability Exchange (VEX) format by specifying `--vex` command line option.\nThe generated VEX file can then be used as a `--triage-input-file` to support\na triage process.\n\nIf you wish to use PDF support, you will need to install the `reportlab`\nlibrary separately.\n\nIf you intend to use PDF support when you install cve-bin-tool you can specify it and report lab will be installed as part of the cve-bin-tool install:\n\n```console\npip install cve-bin-tool[PDF]\n```\n\nIf you've already installed cve-bin-tool you can add reportlab after the fact\nusing pip:\n\n```console\npip install --upgrade reportlab\n```\n\nNote that reportlab was taken out of the default cve-bin-tool install because\nit has a known CVE associated with it\n([CVE-2020-28463](https://nvd.nist.gov/vuln/detail/CVE-2020-28463)). The\ncve-bin-tool code uses the recommended mitigations to limit which resources\nadded to PDFs, as well as additional input validation. This is a bit of a\nstrange CVE because it describes core functionality of PDFs: external items,\nsuch as images, can be embedded in them, and thus anyone viewing a PDF could\nload an external image (similar to how viewing a web page can trigger external\nloads). There's no inherent \"fix\" for that, only mitigations where users of\nthe library must ensure only expected items are added to PDFs at the time of\ngeneration.\n\nSince users may not want to have software installed with an open, unfixable CVE\nassociated with it, we've opted to make PDF support only available to users who\nhave installed the library themselves. Once the library is installed, the PDF\nreport option will function.\n\n## Configuration\n\nYou can use `--config` option to provide configuration file for the tool. You can still override options specified in config file with command line arguments. See our sample config files in the\n[test/config](https://github.com/intel/cve-bin-tool/blob/main/test/config/)\n\n## Auto-detection of components\n\nCVE Binary tool attempts to do auto-detection of components using binary checkers, supported language component lists, and file extraction methods. The supported tools for auto-detection are listed below.\n\n### Binary checker list\n\nThe following checkers are available for finding components in binary files:\n\n<!--CHECKERS TABLE BEGIN-->\n| | | | Available checkers | | | |\n|--------------- |--------------- |------------------ |-------------- |---------------- |------------ |----------------- |\n| accountsservice |acpid |apache_http_server |apcupsd |apparmor |asn1c |assimp |\n| asterisk |atftp |avahi |axel |bash |bind |binutils |\n| bird |bison |bluez |boinc |botan |bro |bubblewrap |\n| busybox |bwm_ng |bzip2 |c_ares |capnproto |ceph |chess |\n| chrony |civetweb |clamav |collectd |commons_compress |connman |coreutils |\n| cpio |cronie |cryptsetup |cups |curl |cvs |darkhttpd |\n| dav1d |davfs2 |dbus |debianutils |dhclient |dhcpcd |dhcpd |\n| dmidecode |dnsmasq |docker |domoticz |dosfstools |dotnet |dovecot |\n| doxygen |dpkg |dropbear |e2fsprogs |ed |elfutils |emacs |\n| enscript |exfatprogs |exim |exiv2 |f2fs_tools |faad2 |fastd |\n| ffmpeg |file |firefox |flac |fluidsynth |freeradius |freerdp |\n| fribidi |frr |gawk |gcc |gdal |gdb |gdk_pixbuf |\n| gimp |git |glib |glibc |gmp |gnomeshell |gnupg |\n| gnutls |go |gpgme |gpsd |graphicsmagick |grep |grub2 |\n| gstreamer |gupnp |gvfs |gzip |haproxy |harfbuzz |haserl |\n| hdf5 |heimdal |hostapd |hunspell |hwloc |i2pd |icecast |\n| icu |iperf3 |ipmitool |ipsec_tools |iptables |irssi |iucode_tool |\n| iwd |jack2 |jacksondatabind |janus |jhead |jq |json_c |\n| kbd |keepalived |kerberos |kexectools |kodi |kubernetes |ldns |\n| lftp |libarchive |libass |libbpg |libcoap |libconfuse |libcurl |\n| libdb |libde265 |libebml |libevent |libexpat |libgcrypt |libgd |\n| libgit2 |libheif |libical |libidn2 |libinput |libjpeg |libjpeg_turbo |\n| libksba |liblas |libmatroska |libmemcached |libmicrohttpd |libmodbus |libnss |\n| libpcap |libraw |librsvg |librsync |libsamplerate |libseccomp |libsndfile |\n| libsolv |libsoup |libsrtp |libssh |libssh2 |libtasn1 |libtiff |\n| libtomcrypt |libupnp |libuv |libvips |libvirt |libvncserver |libvorbis |\n| libvpx |libxslt |lighttpd |linux_kernel |lldpd |logrotate |lrzip |\n| lua |luajit |lxc |lynx |lz4 |mailx |mariadb |\n| mbedtls |mdadm |memcached |micropython |minetest |mini_httpd |minicom |\n| minidlna |miniupnpc |miniupnpd |moby |modsecurity |monit |mosquitto |\n| motion |mpg123 |mpv |msmtp |mtr |mupdf |mutt |\n| mysql |nano |nasm |nbd |ncurses |neon |nessus |\n| netatalk |netdata |netkit_ftp |netpbm |nettle |nghttp2 |nginx |\n| ngircd |nmap |node |ntfs_3g |ntp |ntpsec |open_iscsi |\n| open_vm_tools |openafs |opencv |openjpeg |openldap |opensc |openssh |\n| openssl |openswan |openvpn |p7zip |pango |patch |pcre |\n| pcre2 |pcsc_lite |perl |php |picocom |pigz |pixman |\n| png |polarssl_fedora |poppler |postgresql |ppp |privoxy |procps_ng |\n| proftpd |protobuf_c |pspp |pure_ftpd |putty |python |qemu |\n| qpdf |qt |quagga |radare2 |radvd |raptor |rauc |\n| rdesktop |readline |rpm |rsync |rsyslog |rtl_433 |rtmpdump |\n| runc |rust |samba |sane_backends |sdl |seahorse |shadowsocks_libev |\n| snapd |sngrep |snort |socat |sofia_sip |speex |spice |\n| sqlite |squashfs |squid |sslh |stellarium |strongswan |stunnel |\n| subversion |sudo |suricata |sylpheed |syslogng |sysstat |systemd |\n| tar |tcpdump |tcpreplay |terminology |tesseract |thrift |thttpd |\n| thunderbird |timescaledb |tinyproxy |tor |tpm2_tss |traceroute |transmission |\n| trousers |twonky_server |u_boot |udisks |unbound |unixodbc |upx |\n| util_linux |varnish |vim |vlc |vorbis_tools |vsftpd |webkitgtk |\n| wget |wireshark |wolfssl |wpa_supplicant |xerces |xml2 |xscreensaver |\n| xwayland |yasm |zabbix |zchunk |zeek |zlib |znc |\n| zsh |zstandard | | | | | |\n\n<!--CHECKERS TABLE END-->\n\nAll the checkers can be found in the checkers directory, as can the\n[instructions on how to add a new checker](https://github.com/intel/cve-bin-tool/blob/main/cve_bin_tool/checkers/README.md).\nSupport for new checkers can be requested via\n[GitHub issues](https://github.com/intel/cve-bin-tool/issues).\n\n### Language Specific checkers\n\nA number of checkers are available for finding vulnerable components in specific language packages.\n\n| Language | Files supported |\n| ---------- | ----------------------------------------------- |\n| Dart | `pubspec.lock` |\n| Go | `Go.mod` |\n| Java | `pom.xml`; JAR, WAR and EAR archives |\n| JavaScript | `package-lock.json` |\n| Rust | `Cargo.lock` |\n| Ruby | `Gemfile.lock` |\n| R | `renv.lock` |\n| Swift | `Package.resolved` |\n| Python | `requirements.txt`, `PKG-INFO`, `METADATA`; .whl and .egg files |\n| Perl | `cpanfile` |\n\nMore information on [language-specific checkers](https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#language-specific-checkers) can be found in the [CVE Binary Tool manual](https://cve-bin-tool.readthedocs.io/en/latest/MANUAL.html).\n\n### Supported Archive Formats\n\nThe following archive formats are currently supported by the auto-extractor:\n\n| Archive Format | File Extension |\n| -------------- | ---------------------------------------------- |\n| zip | .zip, .exe, .jar, .msi, .egg, .whl, .war, .ear |\n| tar | .tar, .tgz, .tar.gz, .tar.xz, .tar.bz2 |\n| deb | .deb, .ipk |\n| rpm | .rpm |\n| cab | .cab |\n| apk | .apk |\n| zst | .zst |\n| pkg | .pkg |\n\n## Additional Requirements\n\nTo use the auto-extractor, you may need the following utilities depending on the type of [supported archive formats](#supported-archive-formats) you need to extract.\n\nThe utilities below are required to run the full test suite on Linux:\n\n- `file`\n- `strings`\n- `tar`\n- `unzip`\n- `rpm2cpio`\n- `cpio`\n- `ar`\n- `cabextract`\n\nMost of these are installed by default on many Linux systems, but `cabextract` and\n`rpm2cpio` in particular might need to be installed.\n\nOn windows systems, you may need:\n\n- `ar`\n- `7z`\n- `Expand`\n- `pdftotext`\n\nWindows has `Expand` installed by default, but `ar` and `7z` might need to be installed.\nIf you want to run our test-suite or scan a zstd compressed file, We recommend installing this [7-zip-zstd](https://github.com/mcmilk/7-Zip-zstd)\nfork of 7zip. We are currently using `7z` for extracting `jar`, `apk`, `msi`, `exe` and `rpm` files.\nTo install `ar` you can install MinGW (which has binutils as a part of it) from [here](https://www.mingw-w64.org/downloads/#msys2) and run the downloaded .exe file.\n\nIf you get an error about building libraries when you try to install from pip,\nyou may need to install the Windows build tools. The Windows build tools are\navailable for free from\n<https://visualstudio.microsoft.com/visual-cpp-build-tools/>\n\nIf you get an error while installing brotlipy on Windows, installing the\ncompiler above should fix it.\n\n`pdftotext` is required for running tests. (users of cve-bin-tool may not need it, developers likely will.) The best approach to install it on Windows involves using [conda](https://docs.conda.io/projects/conda/en/latest/user-guide/install/windows.html) (click [here](https://anaconda.org/conda-forge/pdftotext) for further instructions).\n\nYou can check [our CI configuration](https://github.com/intel/cve-bin-tool/blob/main/.github/workflows/testing.yml) to see what versions of python we're explicitly testing.\n\n## Limitations\n\nThis scanner does not attempt to exploit issues or examine the code in greater\ndetail; it only looks for library signatures and version numbers. As such, it\ncannot tell if someone has backported fixes to a vulnerable version, and it\nwill not work if library or version information was intentionally obfuscated.\n\nThis tool is meant to be used as a quick-to-run, easily-automatable check in a\nnon-malicious environment so that developers can be made aware of old libraries\nwith security issues that have been compiled into their binaries.\n\nThe tool does not guarantee that any vulnerabilities reported are actually present or exploitable, neither is it able to find all present vulnerabilities with a guarantee.\n\nUsers can add triage information to reports to mark issues as false positives, indicate that the risk has been mitigated by configuration/usage changes, and so on.\n\nTriage details can be re-used on other projects so, for example, triage on a Linux base image could be applied to multiple containers using that image.\n\nFor more information and usage of triage information with the tool kindly have a look [here](https://cve-bin-tool.readthedocs.io/en/latest/MANUAL.html#triage-input-file-input-file).\n\nIf you are using the binary scanner capabilities, be aware that we only have a limited number of binary checkers (see table above) so we can only detect those libraries. Contributions of new checkers are always welcome! You can also use an alternate way to detect components (for example, a bill of materials tool such as [tern](https://github.com/tern-tools/tern)) and then use the resulting list as input to cve-bin-tool to get a more comprehensive vulnerability list.\n\nThe tool uses a vulnerability database in order to detect the present vulnerabilities, in case the database is not frequently updated (specially if the tool is used in offline mode), the tool would be unable to detect any newly discovered vulnerabilities. Hence it is highly advised to keep the database updated.\n\nThe tool does not guarantee that all vulnerabilities are reported as the tool only has access to a limited number of publicly available vulnerability databases.\nContributions to introduce new sources of data to the tool are always welcome.\n\nWhilst some validation checks are performed on the data within the vulnerability database, the tool is unable to assert the quality of the data or correct any\ndiscrepancies if the data is incomplete or inconsistent. This may result, for example, in some vulnerability reports where the severity is reported as UNKNOWN.\n\n## Feedback & Contributions\n\nBugs and feature requests can be made via [GitHub\nissues](https://github.com/intel/cve-bin-tool/issues). Be aware that these issues are\nnot private, so take care when providing output to make sure you are not\ndisclosing security issues in other products.\n\nPull requests are also welcome via git.\n\n- New contributors should read the [contributor guide](https://github.com/intel/cve-bin-tool/blob/main/CONTRIBUTING.md) to get started.\n- Folk who already have experience contributing to open source projects may not need the full guide but should still use the [pull request checklist](https://github.com/intel/cve-bin-tool/blob/main/CONTRIBUTING.md#checklist-for-a-great-pull-request) to make things easy for everyone.\n\nCVE Binary Tool contributors are asked to adhere to the [Python Community Code of Conduct](https://www.python.org/psf/conduct/). Please contact [Terri](https://github.com/terriko/) if you have concerns or questions relating to this code of conduct.\n\n## Security Issues\n\nSecurity issues with the tool itself can be reported to Intel's security\nincident response team via\n[https://intel.com/security](https://intel.com/security).\n\nIf in the course of using this tool you discover a security issue with someone\nelse's code, please disclose responsibly to the appropriate party.\n\n\n## Full option list\n\nUsage:\n`cve-bin-tool <directory/file to scan>`\n\n<pre>\noptions:\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-h---help\">-h, --help</a> show this help message and exit\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-e-exclude---exclude-exclude\">-e EXCLUDE, --exclude</a> EXCLUDE\n Comma separated Exclude directory path\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-v---version\">-V, --version</a> show program's version number and exit\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--disable-version-check\">--disable-version-check</a>\n skips checking for a new version\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--disable-validation-check\">--disable-validation-check</a>\n skips checking xml files against schema\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--offline\">--offline</a> operate in offline mode\n --detailed add CVE description in csv or json report (no effect on console, html or pdf)\n\nCVE Data Download:\n Arguments related to data sources and Cache Configuration\n\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-n-json-nvdjson-mirrorapiapi2---nvd-json-nvdjson-mirrorapiapi2\">-n {api,api2,json,json-mirror,json-nvd}, --nvd {api,api2,json,json-mirror,json-nvd}</a>\n choose method for getting CVE lists from NVD\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-u-nowdailyneverlatest---update-nowdailyneverlatest\">-u {now,daily,never,latest}, --update {now,daily,never,latest}</a>\n update schedule for data sources and exploits database (default: daily)\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--nvd-api-key-nvd_api_key\">--nvd-api-key NVD_API_KEY</a>\n specify NVD API key (used to improve NVD rate limit)\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-d-nvdosvgadcurl-nvdosvgadcurl----disable-data-source-nvdosvgadcurl-nvdosvgadcurl-\">-d DISABLE_DATA_SOURCE, --disable-data-source DISABLE_DATA_SOURCE</a>\n comma-separated list of data sources (CURL, EPSS, GAD, NVD, OSV, REDHAT, RSD) to disable (default: NONE) \n\n --use-mirror USE_MIRROR\n use an mirror to update the database\n\nInput:\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#directory-positional-argument\">directory</a> directory to scan\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-i-input_file---input-file-input_file\">-i INPUT_FILE, --input-file INPUT_FILE</a>\n provide input filename\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--triage-input-file-input_file\">--triage-input-file TRIAGE_INPUT_FILE</a>\n provide input filename for triage data\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-c-config---config-config\">-C CONFIG, --config CONFIG</a>\n provide config file\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-l-package_list---package-list-package_list\">-L PACKAGE_LIST, --package-list PACKAGE_LIST</a>\n provide package list\n --sbom {spdx,cyclonedx,swid}\n specify type of software bill of materials (sbom) (default: spdx)\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--sbom-file-sbom_file\">--sbom-file SBOM_FILE</a>\n provide sbom filename\n\nOutput:\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#quiet-mode\">-q, --quiet</a> suppress output\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#logging-modes\">-l {debug,info,warning,error,critical}, --log {debug,info,warning,error,critical}</a>\n log level (default: info)\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-o-output_file---output-file-output_file\">-o OUTPUT_FILE, --output-file OUTPUT_FILE</a>\n provide output filename (default: output to stdout)\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--html-theme-html_theme\">--html-theme HTML_THEME</a>\n provide custom theme directory for HTML Report\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-f-csvjsonconsolehtml---format-csvjsonconsolehtml\">-f {csv,json,console,html,pdf}, --format {csv,json,console,html,pdf}</a>\n update output format (default: console)\n specify multiple output formats by using comma (',') as a separator\n note: don't use spaces between comma (',') and the output formats.\n --generate-config {yaml,toml,yaml,toml,toml,yaml}\n generate config file for cve bin tool in toml and yaml formats.\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-c-cvss---cvss-cvss\">-c CVSS, --cvss CVSS</a> minimum CVSS score (as integer in range 0 to 10) to report (default: 0)\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-s-lowmediumhighcritical---severity-lowmediumhighcritical\">-S {low,medium,high,critical}, --severity {low,medium,high,critical}</a>\n minimum CVE severity to report (default: low)\n --metrics \n check for metrics (e.g., EPSS) from found cves\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--epss-percentile\">--epss-percentile EPSS_PERCENTILE</a>\n minimum epss percentile of CVE range between 0 to 100 to report\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--epss-probability\">--epss-probability EPSS_PROBABILITY</a>\n minimum epss probability of CVE range between 0 to 100 to report\n --no-0-cve-report only produce report when CVEs are found\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-a-distro_name-distro_version_name---available-fix-distro_name-distro_version_name\">-A [<distro_name>-<distro_version_name>], --available-fix [<distro_name>-<distro_version_name>]</a>\n Lists available fixes of the package from Linux distribution\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-b-distro_name-distro_version_name---backport-fix-distro_name-distro_version_name\">-b [<distro_name>-<distro_version_name>], --backport-fix [<distro_name>-<distro_version_name>]</a>\n Lists backported fixes if available from Linux distribution\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--affected-versions\">--affected-versions</a> Lists versions of product affected by a given CVE (to facilitate upgrades)\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--vex-vex_file\">--vex VEX</a> Provide vulnerability exchange (vex) filename\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--sbom-output-sbom_output\">--sbom-output SBOM_OUTPUT</a>\n provide software bill of materials (sbom) filename to generate\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--sbom-type\">--sbom-type {spdx,cyclonedx}</a>\n specify type of software bill of materials (sbom) to generate (default: spdx)\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--sbom-format\">--sbom-format {tag,json,yaml}</a>\n specify format of software bill of materials (sbom) to generate (default: tag)\n\nMerge Report:\n Arguments related to Intermediate and Merged Reports\n\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-a-intermediate_path---append-intermediate_path\">-a [APPEND], --append [APPEND]</a>\n save output as intermediate report in json format\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-t-tag---tag-tag\">-t TAG, --tag TAG</a> add a unique tag to differentiate between multiple intermediate reports\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-m-intermediate_reports---merge-intermediate_reports\">-m MERGE, --merge MERGE</a>\n comma separated intermediate reports path for merging\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-f-tags---filter-tags\">-F FILTER, --filter FILTER</a>\n comma separated tag string for filtering intermediate reports\n\nCheckers:\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-s-skips---skips-skips\">-s SKIPS, --skips SKIPS</a>\n comma-separated list of checkers to disable\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-r-checkers---runs-checkers\">-r RUNS, --runs RUNS</a> comma-separated list of checkers to enable\n\nDatabase Management:\n --import-json IMPORT_JSON\n import database from json files chopped by years\n --ignore-sig do not verify PGP signature while importing json data\n --log-signature-error\n when the signature doesn't match log the error only instead of halting (UNSAFE)\n --verify PGP_PUBKEY_PATH\n verify PGP sign while importing json files\n --export-json EXPORT_JSON\n export database as json files chopped by years\n --pgp-sign PGP_PRIVATE_KEY_PATH\n sign exported json files with PGP\n --passphrase PASSPHRASE\n required passphrase for signing with PGP\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--export-export\">--export EXPORT</a> export database filename\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--import-import\">--import IMPORT</a> import database filename\n\nExploits:\n --exploits check for exploits from found cves\n\nDeprecated:\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#-x---extract\">-x, --extract</a> autoextract compressed files\n <a href=\"https://github.com/intel/cve-bin-tool/blob/main/doc/MANUAL.md#--report\">--report</a> Produces a report even if there are no CVE for the respective output format\n</pre>\n\nFor further information about all of these options, please see [the CVE Binary Tool user manual](https://cve-bin-tool.readthedocs.io/en/latest/MANUAL.html).\n",
"bugtrack_url": null,
"license": "GPL-3.0-or-later",
"summary": "CVE Binary Checker Tool",
"version": "3.3",
"project_urls": {
"Homepage": "https://github.com/intel/cve-bin-tool"
},
"split_keywords": [
"security",
" tools",
" cve"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "92ed294f1199bd2ccfd2ef83e368113b943c00304e8cf7983e8f8260f41b091a",
"md5": "e5634e2598546e25c1cdf0157a0b90a1",
"sha256": "6fb514fb80e4b7bbc07297f46b288e1be52d3e34d89744d2596965cdf581c0b8"
},
"downloads": -1,
"filename": "cve_bin_tool-3.3-py3-none-any.whl",
"has_sig": false,
"md5_digest": "e5634e2598546e25c1cdf0157a0b90a1",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": ">=3.8",
"size": 1677839,
"upload_time": "2024-04-11T16:54:29",
"upload_time_iso_8601": "2024-04-11T16:54:29.224316Z",
"url": "https://files.pythonhosted.org/packages/92/ed/294f1199bd2ccfd2ef83e368113b943c00304e8cf7983e8f8260f41b091a/cve_bin_tool-3.3-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "03ab4e64465182069ad710fbeb6b34262e7b71d554fcbc767aa4c7b87ffa2e93",
"md5": "d4fa0f134c672e9795c497b46537e6c4",
"sha256": "bf50d76df2489806d73e6b7172ade16b4ee7278e1be29b64fe86366d6badc4d5"
},
"downloads": -1,
"filename": "cve-bin-tool-3.3.tar.gz",
"has_sig": false,
"md5_digest": "d4fa0f134c672e9795c497b46537e6c4",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=3.8",
"size": 1581562,
"upload_time": "2024-04-11T16:54:32",
"upload_time_iso_8601": "2024-04-11T16:54:32.035157Z",
"url": "https://files.pythonhosted.org/packages/03/ab/4e64465182069ad710fbeb6b34262e7b71d554fcbc767aa4c7b87ffa2e93/cve-bin-tool-3.3.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-04-11 16:54:32",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "intel",
"github_project": "cve-bin-tool",
"travis_ci": false,
"coveralls": true,
"github_actions": true,
"requirements": [],
"lcname": "cve-bin-tool"
}
JSON
