danbeard/libscanner

RPM/SWID vulnerability scanner

libscanner's Issues

Download path

It has changed. It's now along the lines of:

https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.json.gz
https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-recent.json.gz

And so on.

Attribute "prev" (= previous versions affected too) ignored in nvdcve.xml

If a vulnerability impacts not only one software version but all previous ones, cli.py doesn't check if our software version is impacted.

Example:
Run a vulnerability check (cli.py), on a packages list containing linux-4.11.4 or below.

Expected behavior: vulnerability CVE-2017-1000364 is listed on the output (affects linux-4.11.5 and previous versions)

Observed behavior: no vulnerability found.

The flag "and all previous versions" is given through the "prev" XML attribute, in element "vers":

  <entry type="CVE" name="CVE-2017-1000364" seq="2017-1000364" published="2017-06-19" modified="2018-01-04" severity="Medium" CVSS_version="2.0" CVSS_score="6.2" CVSS_base_score="6.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="1.9" CVSS_vector="(AV:L/AC:H/Au:N/C:C/I:C/A:C)">
    <vuln_soft>
      <prod name="linux_kernel" vendor="linux">
        <vers num="4.11.5" prev="1"/>
      </prod>
    </vuln_soft>
  </entry>