Skip to content

Releases: intel/cve-bin-tool

CVE Binary Tool pre-release 3.3a0

30 Nov 22:28
@terriko terriko
v3.3a0
c3cb38e
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Binary Tool pre-release 3.3a0 Pre-release
Pre-release

Preview release for 3.3, which will hopefully be coming in December.

There's a lot of changes in this release (see below, more curated release notes to come), but I'm particularly eager to have people try out the new version compare function and make sure it is sufficiently robust for arbitrary versions, as we needed to migrate away from the function provided in python packaging as it could not handle some of the versions we see in the NVD data.

What's Changed

  • fix: java parser failing to match vendor on product without '-' by @bcieszko in #2961
  • feat(checker): New checker request - GNU emacs by @bcieszko in #2941
  • chore: update SBOM for Python 3.7 by @github-actions in #3025
  • chore: update SBOM for Python 3.10 by @github-actions in #3024
  • chore: update SBOM for Python 3.9 by @github-actions in #3023
  • chore: update SBOM for Python 3.8 by @github-actions in #3022
  • chore: update SBOM for Python 3.11 by @github-actions in #3021
  • [StepSecurity] Apply security best practices by @step-security-bot in #3031
  • fix: Enhance SBOM docs (fixes #2922) by @offsake in #3029
  • ci: adjust dependabot config to limit false positives by @terriko in #3033
  • chore: update checkers table by @github-actions in #3026
  • chore: bump to dev version 3.2.2dev0 by @terriko in #3019
  • chore(deps): bump actions/dependency-review-action from 2.5.1 to 3.0.4 by @dependabot in #3034
  • chore: update SBOM for Python 3.7 by @github-actions in #3040
  • chore: update SBOM for Python 3.8 by @github-actions in #3039
  • chore: update SBOM for Python 3.9 by @github-actions in #3038
  • chore: update SBOM for Python 3.11 by @github-actions in #3037
  • chore: update SBOM for Python 3.10 by @github-actions in #3036
  • feat(checker): add mini_httpd checker by @ffontaine in #3020
  • feat(checker): add libmicrohttpd checker by @ffontaine in #3014
  • ci: fix dependabot config by @terriko in #3041
  • chore: update pre-commit config by @github-actions in #2968
  • feat(checker): add cpio checker by @ffontaine in #3013
  • ci: Harden GitHub Actions [StepSecurity] by @step-security-bot in #3043
  • feat(checker): add sngrep checker by @ffontaine in #3035
  • feat(checker): add fluidsynth checker by @ffontaine in #3012
  • feat(checker): add pixman checker by @ffontaine in #3010
  • feat(checker): add ldns checker by @ffontaine in #3004
  • feat(checker): add gzip checker by @ffontaine in #2998
  • chore: update checkers table by @github-actions in #3044
  • ci: Dependabot "duplicated" lines and ignore "*" by @terriko in #3045
  • chore(deps): bump github/codeql-action from 2.1.27 to 2.3.5 by @dependabot in #3049
  • chore(deps): bump actions/dependency-review-action from 3.0.4 to 3.0.6 by @dependabot in #3051
  • chore(deps): bump actions/checkout from 3.1.0 to 3.5.2 by @dependabot in #3050
  • chore: update pre-commit config by @github-actions in #3048
  • ci: pin dependency-review linux, fix dependabot by @terriko in #3055
  • feat(checker): add gdk-pixbuf checker by @ffontaine in #3011
  • feat(checker): add libtasn1 checker by @ffontaine in #3000
  • feat(checker): add dmidecode checker by @ffontaine in #2997
  • feat(checker): add libgd checker by @ffontaine in #2978
  • feat: merged report content change and comments added in html reports by @gvozzolo in #2913
  • feat: add support for pgp signing (#2577) by @b31ngd3v in #2882
  • chore: update checkers table by @github-actions in #3061
  • chore: update SBOM for Python 3.8 by @github-actions in #3070
  • chore: update SBOM for Python 3.7 by @github-actions in #3069
  • chore: update SBOM for Python 3.10 by @github-actions in #3068
  • chore: update SBOM for Python 3.9 by @github-actions in #3067
  • chore: update SBOM for Python 3.11 by @github-actions in #3066
  • ci: up timeouts on short and long tests by @terriko in #3072
  • feat(checker): add udisks checker by @ffontaine in #2999
  • feat(scanner): slight update in version display by @ffontaine in #3063
  • feat(checker): add readline checker by @ffontaine in #2976
  • feat(checker): add ntfs-3g checker by @ffontaine in #2973
  • feat(checker): add ngircd checker by @ffontaine in #3003
  • feat(checker): add libmodbus checker by @ffontaine in #3002
  • feat(checker): add coreutils checker by @ffontaine in #3001
  • fix: improve openssl checker by @ffontaine in #2987
  • chore(deps): bump actions/upload-artifact from 3.1.0 to 3.1.2 by @dependabot in #3052
  • chore: update SBOM for Python 3.8 by @github-actions in #3082
  • fix: root file path of vulnerable component is missing by @b31ngd3v in #3088
  • chore: update SBOM for Python 3.9 by @github-actions in #3081
  • chore: update SBOM for Python 3.10 by @github-actions in #3080
  • chore: update SBOM for Python 3.11 by @github-actions in #3079
  • chore: update SBOM for Python 3.7 by @github-actions in #3078
  • chore: update checkers table by @github-actions in #3073
  • chore(deps): bump step-security/harden-runner from 2.4.0 to 2.4.1 by @dependabot in #3090
  • chore(deps-dev): bump pre-commit from 3.3.2 to 3.3.3 by @dependabot in #3087
  • chore(deps): bump github/codeql-action from 2.3.5 to 2.20.0 by @dependabot in #3086
  • chore(deps): bump peter-evans/create-pull-request from 5.0.1 to 5.0.2 by @dependabot in #3085
  • chore(deps): bump actions/checkout from 3.5.2 to 3.5.3 by @dependabot in #3084
  • fix: improve luajit checker by @ffontaine in #2993
  • fix: improve gimp checker by @ffontaine in #2992
  • ci: Automatically committing/suggesting linter fixes for PRs by @metabiswadeep in #3017
  • chore(deps): bump sphinx from 4.4.0 to 7.0.1 in /doc by @dependabot in #3056
  • fix: improve nghttp2 checker by @ffontaine in #2991
  • docs: adding database schema by @Rexbeast2 in #3097
  • chore(deps): bump github/codeql-action from 2.20.0 to 2.20.1 by @dependabot in #3098
  • fix: fix xerces CPE ID by @ffontaine in #2932
  • docs: including doc in build by @Rexbeast2 in #3102
  • chore: update SBOM for Python 3.8 by @github-actions in #3111
  • chore: update SBOM for Python 3.11 by @github-actions in #3110
  • chore: update SBOM for Python 3.7 by @github-actions in #3109
  • chore: update SBOM for Python 3.10 by @github-actions in #3108
  • chore: update SBOM for Python 3.9 by @github-actions in #3107
  • fix: report is not generated when no CVEs detected (#3028) by @b31ngd3v in #3075
  • ci: dedeuplicate usage of codeql by @metabiswadeep in #3100
  • feat: adding epss data by @Rexbeast...
Read more

Contributors

terriko, ffontaine, and 41 other contributors
Loading

CVE Binary Tool 3.2.1

18 May 22:26
@terriko terriko
v3.2.1
92d27dc
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Binary Tool 3.2.1

Due to a change in the data used for the curl data source, we're issuing a slightly out of band point release for users unable to use 3.2.

There are a number of checker updates to address false positives, new checkers, and other bug fixes and features as described below.

One commonly requested feature has made it into this release: generation of SBOMs. Please try it out and let us know where it can be improved!

Thanks especially to the many new contributors in this release (you can see the list at the bottom)

  • Many of you joined us via the Google Summer of Code 2023 selection process: I wish we'd had mentors and slots available to have more of you as paid contributors this year!
  • Some of you also joined us via the Intel Open Source Hackathon: thank you so much for taking the time to work with us and it's been a delight to work with so many experienced coders during the event.
  • And some of you just stopped by on your own with great ideas and fixes. Thank you!

What's Changed

Read more

Contributors

raboof, jarebear6expepjozn6rakjq5iczi3irqwphcvb, and 28 other contributors
Loading

CVE Bin Tool pre-release 3.2.1rc0

11 May 23:54
@terriko terriko
v3.2.1rc0
e19ee4b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Bin Tool pre-release 3.2.1rc0 Pre-release
Pre-release

Due to a change in the data used for the curl data source, we're issuing a slightly out of band point release for users unable to use 3.2.

There are a number of checker updates to address false positives, new checkers, and other bug fixes and features as described below.

One commonly requested feature has made it into this release: generation of SBOMs. Please try it out and let us know where it can be improved!

What's Changed

Read more

Contributors

raboof, jarebear6expepjozn6rakjq5iczi3irqwphcvb, and 28 other contributors
Loading

CVE Binary Tool 3.2

19 Dec 18:46
@terriko terriko
v3.2
639fd49
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Binary Tool 3.2

New features from our GSoC 2022 participants:

  • @yashugarg added a large number of tests and work on fuzzing our interfaces
  • @rhythmrx9 aded new data sources (we now support advisories from Gitlab, OSV and Redhat as well as NVD)
  • @XDRAGON2002 for the new parsers that allow us to scan things like Ruby Gemfiles, Rust cargo files, and more.

Other interesting features in this release:

  • @ffontaine has added a large number of new checkers, pushing us well over 200 binary checkers.
  • @anthonyharrison has added initial support for NVD API 2.0. Note that at the time this was added the 2.0 version didn't work with their API keys, so the code behaves accordingly.

Thanks also to @BreadGenie for code review and mentoring support as well as a number of contributions listed below. A special shout out to @b31ngd3v and @metabiswadeep whose first contributions are in this release but they've been the first of many, as well as the many other folk who got their first commits in via Hacktoberfest or GSoC or goodfirstissue.dev or however you found us. Thanks to everyone for being part of this release!

Full change list

Read more

Contributors

wyattearp, raboof, and 55 other contributors
Loading

CVE Bin Tool pre-release 3.2rc0

14 Dec 06:04
@terriko terriko
v3.2rc0
2fe8ffc
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Bin Tool pre-release 3.2rc0 Pre-release
Pre-release

Preview release for 3.2.

We're currently seeing an issue in our testing system where Windows systems are taking a long time to upgrade the database to store additional data source information. Windows users are particularly encouraged to try this pre-release to see if you have any issues!

When updating your database, make sure your NVD_API_KEY is set and you may have better results using -u now to get a fresh database.

What's Changed

Read more

Contributors

wyattearp, raboof, and 55 other contributors
Loading

CVE Binary Tool 3.1.2

08 Dec 23:09
@terriko terriko
v3.1.2
859bac6
Compare
Choose a tag to compare
CVE Binary Tool 3.1.2

Minor update to force a downgrade of packaging to allow use of LegacyVersion (fixes #2428)

This is intended to be a temporary fix while we finish up the 3.2 release, but I believe we will be able to backport the removal for LegacyVersion without much trouble, so there may be one more release for the 3.1 tree if it looks like 3.2 is going to take more than a week.

Full Changelog: v3.1.1...v3.1.2

Loading

CVE Binary Tool 3.1.1

21 Jun 23:21
@terriko terriko
v3.1.1
abffa0d
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Binary Tool 3.1.1

Minor typo necessitated a version bump + new release.

What's Changed

Full Changelog: v3.1...v3.1.1

Contributors

terriko
Loading

CVE Binary Tool 3.1

19 Apr 23:05
@terriko terriko
v3.1
1231185
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Binary Tool 3.1

CVE Binary Tool 3.1

This release is dedicated to the person who sent me cookies after I was griping about differences in Python 3.7 error handling on Twitter. They were delicious, thank you! Thanks also to the many new contributors who have joined us as part of Google Summer of Code 2022. You can see many new folk had their first commits in this release!

New Features

  • CVE Binary Tool 3.1 adds support for NVD API keys. An NVD API key allows registered users to make a greater number of requests to the API. At this time, the NVD API documentation says, "The public rate limit (without an API key) is 10 requests in a rolling 60 second window; the rate limit with an API key is 100 requests in a rolling 60 second window."
    • cve-bin-tool updates once per day by default to limit connections to NVD, but users in shared environments or running more frequent updates have occasionally seen 403 errors due to exceeded rate limits. Using an API key should alleviate those issues going forwards.
  • New support for scanning Java and JavaScript packages has been added. (Yes, this will now detect log4j packages.) The language-specific packages we support now are Java, JavaScript and Python.
  • A new offline flag (--offline) has been added to disable all network requests for use in isolated environments. A guide for using --offline mode can be found here.
  • New support VEX (Vulnerabity Expolitabity Exchange) files. Files could be generated following a scan and then used as a supported triage file.
  • Extractor support has been extended to include WAR, EAR, pkg and zst files.
  • New checkers: Libsrtp, libseccomp, libebml, libsolv

Changed Features

  • Some users had expressed concern that they would prefer not to install the Reportlab dependency on their systems due to security concerns if the library is mis-used, so we no longer install it by default.
    • Users intending to use PDF export can use pip install cve-bin-tool[PDF] to add reportlab to their install. or pip install reportlab if they decide they want it later.
    • Similarly, users can pip uninstall reportlab at any time and cve-bin-tool will continue to function although without the ability to export PDF files. Users can generate their own using pdf reports using print-to-pdf on an HTML report if needed.
  • Python 3.6 support and testing has been dropped as Python 3.6 has reached end of life. (This may affect some users on CentOS.)

New Contributors

Full Change List

Read more

Contributors

terriko, anthonyharrison, and 13 other contributors
Loading

CVE Binary Tool 3.1rc3

13 Apr 20:03
@terriko terriko
v3.1rc3
4758941
Compare
Choose a tag to compare
CVE Binary Tool 3.1rc3 Pre-release
Pre-release

Full Changelog: v3.1rc2...v3.1rc3

Loading

CVE Binary Tool 3.1rc2

13 Apr 19:27
@terriko terriko
v3.1rc2
830ae7a
Compare
Choose a tag to compare
CVE Binary Tool 3.1rc2 Pre-release
Pre-release

Potentially the final release candidate for CVE Binary Tool 3.1. (Note the change in naming scheme to match the pip upload)

What's Changed

  • fix: add None checks to run_java_checker by @terriko in #1630
  • docs: add link to offline guide, rearrange order by @terriko in #1633
  • test: add test for null byte in filename by @terriko in #1635

Full Changelog: v3.1.pre1...v3.1rc2

Contributors

terriko
Loading