AppThreat's vulnerability database and package search library with a built-in file based storage. OSV, CVE, GitHub, npm are the primary sources of vulnerabilities.
Project description
Introduction
This repo is a vulnerability database and package search for sources such as Aqua Security vuln-list, OSV, NVD, GitHub, and NPM. Vulnerability data are downloaded from the sources and stored in a custom file based storage with indexes to allow offline access and quick searches.
Vulnerability Data sources
- Linux vuln-list (Forked from AquaSecurity)
- OSV
- NVD
- GitHub
- NPM
Linux distros
- AlmaLinux
- Debian
- Alpine
- Amazon Linux
- Arch Linux
- RHEL/CentOS
- Rocky Linux
- Ubuntu
- OpenSUSE/SLES
- Photon
- Chainguard
- Wolfi OS
Installation
pip install appthreat-vulnerability-db
Usage
This package is ideal as a library for managing vulnerabilities. This is used by dep-scan, a free open-source dependency audit tool. However, there is a limited cli capability available with few features to test this tool directly.
Download pre-built database
Use the ORAS cli to download a pre-built database containing all application and OS vulnerabilities.
export VDB_HOME=$HOME/vdb
oras pull ghcr.io/appthreat/vdb:v5 -o $VDB_HOME
Cache vulnerability data
Cache application vulnerabilities
vdb --cache
Typical size of this database is over 1.1 GB.
Cache application and OS vulnerabilities
vdb --cache-os
Note the size of the database with OS vulnerabilities is over 3.1 GB.
Cache from just OSV
vdb --cache --only-osv
It is possible to customise the cache behaviour by increasing the historic data period to cache by setting the following environment variables.
- NVD_START_YEAR - Default: 2018. Supports upto 2002
- GITHUB_PAGE_COUNT - Default: 2. Supports upto 20
Periodic sync
To periodically sync the latest vulnerabilities and update the database cache.
vdb --sync
Basic search
It is possible to perform simple search using the cli.
vdb --search android:8.0
vdb --search google:android:8.0
vdb --search android:8.0,simplesamlphp:1.14.11
Syntax is package:version,package:version or vendor : package : version (Without space)
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for appthreat-vulnerability-db-5.1.1.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | f01d9c227fe9e4336b9f700c8d9e597cb76449dfcf5bc1cb07ef689433cf4005 |
|
MD5 | 847117f6c360639f6ff64f5c7b988512 |
|
BLAKE2b-256 | 5bee1360db61adfdad9aa8253277e222769e74077f6822e464599f1e55504a22 |
Hashes for appthreat_vulnerability_db-5.1.1-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 719673b1750508ab0b21b7197090753143ebe4cb22667f024d96ba9d37526d4b |
|
MD5 | 5ccfbe42eccf7ba471b72c089cf1029b |
|
BLAKE2b-256 | 31e15317645214a62bc07eec1210bcf1d5d48ac8c7f27e82676f6a2e61e737c3 |