Skip to content

Pre-release cve-bin-tool v3.4.1rc0

Pre-release
Pre-release
Compare
Choose a tag to compare
@terriko terriko released this 13 Jun 18:39
· 20 commits to main since this release
v3.4.1rc0
20e33f6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This is a release candidate (pre-release) for CVE Binary Tool v3.4.1. Full release will follow once any issues have been addressed (or a week from now if no issues are found)

This release contains a large number of bug fixes and new checkers (especially thanks to @ffontaine and @qmfrederik), as well as contributions from many people who participated in the selection process for Google Summer of Code 2025. Thank you!

What's Changed

Open for shorter list of new features/fixes (no chore/ci pull requests) * docs: add missing release notes to RELEASE.md by @uday-rana in https://github.com//pull/4464 * test: purl in productinfo by @AryanBakliwal in https://github.com//pull/4476 * fix: changed metric ids in cvedb to constants (#4473) by @weichslgartner in https://github.com//pull/4475 * feat(checker): add dlt-daemon by @ffontaine in https://github.com//pull/4513 * feat(checker): add linuxptp checker by @ffontaine in https://github.com//pull/4512 * docs: Add docstrings for VEXGenerate class and methods by @vroomvee in https://github.com//pull/4544 * docs: add docstrings to parsers/env.py by @anchita20 in https://github.com//pull/4552 * fix: csv output under windows with correct newlines (#4557) by @weichslgartner in https://github.com//pull/4558 * docs(available_fix/debian_cve_tracker): Add comprehensive docstrings for improved readability and maintainability by @vroomvee in https://github.com//pull/4546 * fix: drop .fr from debian urls by @ffontaine in https://github.com//pull/4533 * Update scorecard.yml by @sfblackl-intel in https://github.com//pull/4617 * test: fix test_output_cyclonedx by @joydeep049 in https://github.com//pull/4622 * feat: add json2 schema and test by @AryanBakliwal in https://github.com//pull/4623 * fix: treat 1.0 and 1 as the same for excel users by @terriko in https://github.com//pull/4543 * feat(parser): add conan parser by @AryanBakliwal in https://github.com//pull/4569 * docs: Update Sphinx and myst-parser versions; resolve warnings by @giacob500 in https://github.com//pull/4581 * feat(checker): add oath_toolkit checker by @ffontaine in https://github.com//pull/4523 * feat(checker): add cpp-httplib checker by @ffontaine in https://github.com//pull/4522 * test: basic execution test for EPSS #4484 by @weichslgartner in https://github.com//pull/4510 * fix: support .arr, support ios/wasm binaries by @iaincoulter in https://github.com//pull/4521 * feat: add universal fix to allow python detection on DLLs by @jananir640 in https://github.com//pull/4538 * fix: update subversion pattern by @ffontaine in https://github.com//pull/4635 * feat(checker): add orc by @ffontaine in https://github.com//pull/4636 * Improved the alt-text in Architecture and Metrics in Manual.md, solves #4604 by @vedpawar2254 in https://github.com//pull/4650 * fix: update busybox checker by @ffontaine in https://github.com//pull/4679 * fix: Adds mismatch in package_data to resolve `ModuleNotFoundError` by @Prtm2110 in https://github.com//pull/4669 * fix: sbom parse inaccurate log by @AryanBakliwal in https://github.com//pull/4683 * fix: update dlt-daemon checker by @ffontaine in https://github.com//pull/4701 * fix: update openssl checker by @ffontaine in https://github.com//pull/4698 * docs: Fixed a few links in manual.md by @vedpawar2254 in https://github.com//pull/4687 * [DOC] Update allow.txt by @vedpawar2254 in https://github.com//pull/4726 * fix: update location handling by @ffontaine in https://github.com//pull/4769 * fix: update `re.split` calls to use `maxsplit` keyword argument by @emmanuel-ferdman in https://github.com//pull/4709 * fix: update openjpeg checker by @ffontaine in https://github.com//pull/4727 * feat(checker): add xz checker by @ffontaine in https://github.com//pull/4728 * fix: set asyncio_default_fixture_loop_scope (fixes #4685) by @rukhshan23 in https://github.com//pull/4708 * feat(checker): add wavpack checker by @ffontaine in https://github.com//pull/4729 * feat(checker): add apr checker by @ffontaine in https://github.com//pull/4731 * feat(checker): Detect jasper 2.x, as found in msys/cygwin by @qmfrederik in https://github.com//pull/4734 * feat(checker): add redis checker by @ffontaine in https://github.com//pull/4762 * feat(checker): add boa checker by @ffontaine in https://github.com//pull/4763 * feat(checker): add toybox checker by @ffontaine in https://github.com//pull/4764 * feat(checker): add indent checker by @ffontaine in https://github.com//pull/4774 * fix: update linuxptp pattern by @ffontaine in https://github.com//pull/4765 * feat(checker): Add djvulibre by @qmfrederik in https://github.com//pull/4738 * feat(checker): add cflow checker by @ffontaine in https://github.com//pull/4781 * fix: update linux_kernel pattern by @ffontaine in https://github.com//pull/4767 * feat(checker): Add gettext by @qmfrederik in https://github.com//pull/4741 * fix: drop .br, .de, .fr and .us from debian urls by @ffontaine in https://github.com//pull/4803 * feat(checker): add uwsgi checker by @ffontaine in https://github.com//pull/4768 * test(output_engine): add regression tests for unset data by @JigyasuRajput in https://github.com//pull/4788 * fix: handle unknown values in metric_finder (Fixes #4578) by @vedpawar2254 in https://github.com//pull/4682 * fix(checker): Improve OpenSSL pattern matching by @qmfrederik in https://github.com//pull/4802 * feat(checker): add inetutils checker by @ffontaine in https://github.com//pull/4778 * feat(checker): add openvswitch checker by @ffontaine in https://github.com//pull/4780 * fix: update strongswan checker by @ffontaine in https://github.com//pull/4782 * fix: update openswan pattern by @ffontaine in https://github.com//pull/4783 * feat(checker): add libreoffice checker by @ffontaine in https://github.com//pull/4784 * fix: update gettext checker by @ffontaine in https://github.com//pull/4809 * feat(checker): add gsasl checker by @ffontaine in https://github.com//pull/4810 * feat(checker): add libreswan checker by @ffontaine in https://github.com//pull/4814 * fix: add json extension when building cyclonedx SBOM by @ffontaine in https://github.com//pull/4820 * feat(checkers): Add SASL by @qmfrederik in https://github.com//pull/4757 * feat(checkers): Add guile by @qmfrederik in https://github.com//pull/4756 * feat(checker): Add OpenBLAS by @qmfrederik in https://github.com//pull/4743 * feat(checker): Add Thread Building Blocks by @qmfrederik in https://github.com//pull/4744 * fix: Support FFmpeg versions with 'n' prefix by @qmfrederik in https://github.com//pull/4745 * fix: update avahi checker by @ffontaine in https://github.com//pull/4821 * feat(checker): add libyang checker by @ffontaine in https://github.com//pull/4817 * fix: Improve nghttp2 heuristics by @qmfrederik in https://github.com//pull/4748 * feat(checker): add xpdf checker by @ffontaine in https://github.com//pull/4815 * fix: Improve FreeRDP detection logic by @qmfrederik in https://github.com//pull/4751 * feat(checkers): Add clang by @qmfrederik in https://github.com//pull/4754 * feat(checker): Add imagemagick by @qmfrederik in https://github.com//pull/4739 * fix: Improve subversion detection logic by @qmfrederik in https://github.com//pull/4749 * fix: Improve .NET detection by @qmfrederik in https://github.com//pull/4750 * fix: Improve Heimdal detection by @qmfrederik in https://github.com//pull/4746 * fix: drop location handling by @ffontaine in https://github.com//pull/4822 * fix: Be flexible in zlib versions by @qmfrederik in https://github.com//pull/4753 * fix: properly format assertion error messages by @emmanuel-ferdman in https://github.com//pull/4840 * feat(checker): Detect libicu 61, as found in msys/cygwin by @qmfrederik in https://github.com//pull/4737 * fix: dotnet test bug by @Saksham-Sirohi in https://github.com//pull/4842 * fix(file): handle PermissionError exception by @ffontaine in https://github.com//pull/4853 * fix(scanner): don't set filepath as purl by @ffontaine in https://github.com//pull/4855 * test(output_engine): improve tests coverage output_engine by @JigyasuRajput in https://github.com//pull/4799 * feat(checker): add liblouis checker by @ffontaine in https://github.com//pull/4816 * fix(sbom): correctly handle multiple vendors by @ffontaine in https://github.com//pull/4857 * feat(checker): Add cairo by @qmfrederik in https://github.com//pull/4740 * fix: update perl checker by @ffontaine in https://github.com//pull/4856 * feat(checker): add ruby checker by @ffontaine in https://github.com//pull/4858 * feat(checker): Detect Python 3.12.x by @captainreality in https://github.com//pull/4860 * feat(checker): add libcap checker by @ffontaine in https://github.com//pull/4870 * feat(checker): add pjsip checker by @ffontaine in https://github.com//pull/4869 * feat(checker): Add jbig by @qmfrederik in https://github.com//pull/4742 * feat(checker): Add lzo2 by @qmfrederik in https://github.com//pull/4747 * Create accessability.md file by @WhataTiberius in https://github.com//pull/4616 * fix: Handle failed purl2cpe download at first run by @stvml in https://github.com//pull/4895 * fix: update cairo pattern by @ffontaine in https://github.com//pull/4898 * fix: update sngrep checker by @ffontaine in https://github.com//pull/4899 * fix: update pjsip pattern by @ffontaine in https://github.com//pull/4896 * feat(sbom): add --sbom-strip-root by @ffontaine in https://github.com//pull/4852 * fix(nvd): handle 'unknown' score value and prevent ValueError by @JigyasuRajput in https://github.com//pull/4772 * test: add test for mismatch package build by @kanakOS01 in https://github.com//pull/4785 * fix: week error in fuzzing scripts by @its403 in https://github.com//pull/4897 * fix: address deprecation warnings in test_checkers by @Saksham-Sirohi in https://github.com//pull/4819 * docs: fix remarks options to have no spaces by @terriko in https://github.com//pull/4867 * fix(output): normalize severity values to prevent HTML report failure by @JigyasuRajput in https://github.com//pull/4786 * test: fix and improve html tests by @hai1337 in https://github.com//pull/4908 * feat(parser): add OpenWrt opkg parser by @ffontaine in https://github.com//pull/4901 * test(parsers): Add tests for js and Python parsers by @JigyasuRajput in https://github.com//pull/4878 * fix(sbom): correctly handle multiple vendors (second try) by @ffontaine in https://github.com//pull/4866 * fix(test_scanner.py): Add test for unopenable file condition by @JigyasuRajput in https://github.com//pull/4834 * fix: Support detecting multiple product versions by @stvml in https://github.com//pull/4911 * docs: increase docstring coverage to 100% by @hai1337 in https://github.com//pull/4913 * feat: improve wording and accessibility in HTML report template by @hai1337 in https://github.com//pull/4914 * docs: minor README improvements by @hai1337 in https://github.com//pull/4915 * docs: improve test README by @hai1337 in https://github.com//pull/4916 * docs: Fix broken links by @Shrishti1701 in https://github.com//pull/4931 * fix: update IGNORE_PATTERNS documentation by @ffontaine in https://github.com//pull/4937 * feat(output_engine): add --strip-scan-dir by @ffontaine in https://github.com//pull/4930 * fix(sbom): handle linux_kernel by @ffontaine in https://github.com//pull/4935 * fix: enhance test_checkers to cover new situations by @Saksham-Sirohi in https://github.com//pull/4942 * docs: update function name from get_version() to get_versions() by @Devesh-Yadav10 in https://github.com//pull/4945 * fix: HTML report does not include all CVEs correctly by @Arnavk194 in https://github.com//pull/4936 * fix: run CI after PR title change by @stvml in https://github.com//pull/4958 * feat(checker): add fuse checker by @ffontaine in https://github.com//pull/4976 * feat(checkers): Add support for llvm by @qmfrederik in https://github.com//pull/4752 * fix: update json-c checker by @ffontaine in https://github.com//pull/4995 * feat(checker): add cups-filters by @ffontaine in https://github.com//pull/4979 * feat(checker): add firejail checker by @ffontaine in https://github.com//pull/4980 * feat(checker): add zbar by @ffontaine in https://github.com//pull/4981 * feat(checker): add ofono checker by @ffontaine in https://github.com//pull/4996 * fix: Be more flexible in GCC detection logic by @qmfrederik in https://github.com//pull/4755 * fix: update libuv checker by @ffontaine in https://github.com//pull/4999 * test: add invalid package to test language scanner by @hai1337 in https://github.com//pull/4918 * feat(checker): add augeas checker by @ffontaine in https://github.com//pull/5021 * fix(gsutil): Add graceful error handling for missing gsutil by @JigyasuRajput in https://github.com//pull/4833 * fix:Add pyproject.toml by @vedpawar2254 in https://github.com//pull/4873 * fix: spdx sbom cpe bug by @AryanBakliwal in https://github.com//pull/4733 * fix: update gcc checker by @ffontaine in https://github.com//pull/5001 * test(package_list_parser): Improve test coverage for `package_list` by @JigyasuRajput in https://github.com//pull/4909 * fix: pin lib4sbom to 0.8.2 due to bug (fixes #5031) by @terriko in https://github.com//pull/5043 * fix(docstrings): add blank line before example by @kehan-zhou in https://github.com//pull/5033 * fix: improve curl checker pattern by @ffontaine in https://github.com//pull/5048 * fix: update docker checker by @ffontaine in https://github.com//pull/5005 * fix: Make extraction work for MSI files when unzip and 7zip installed by @captainreality in https://github.com//pull/4973 * test: Add CVE mapping test for GnuTLS 3.8.0 by @tutou2356 in https://github.com//pull/4998 * feat(checker): allow to disable language checker by @ffontaine in https://github.com//pull/5049 * fix: update procps-ng checker by @ffontaine in https://github.com//pull/5081 * fix: update linuxptp checker by @ffontaine in https://github.com//pull/5103 * fix: update ffmpeg checker by @ffontaine in https://github.com//pull/5096 * fix: update opkg parser by @ffontaine in https://github.com//pull/5104 * docs: fixes #5071 updated MANUAL.md for --skips flag by @NischalPaliwal in https://github.com//pull/5098 * fix: improved metadata handling for NVD mirror (fixes #5093) by @anthonyharrison in https://github.com//pull/5102 * fix(fuzzing): Fix fuzzing workflow by correcting the PYTHONPATH by @alex-ter in https://github.com//pull/5125 * feat: No-Scan SOC for binary checker pipeline by @joydeep049 in https://github.com//pull/5122 * fix: fixes 5095 nvd_sources.py logging by @zjn268 in https://github.com//pull/5127 * feat(checker): add musl by @ffontaine in https://github.com//pull/5113 * refactor: use XDG_CACHE_HOME for default cache directory by @rilnicki in https://github.com//pull/5083
Open for full list of pull requests merged (quite long)

New Contributors

Full Changelog: v3.4...v3.4.1rc0

Contributors

terriko, ffontaine, and 37 other contributors
Assets 4
Loading