This release is a pre-release and may not be stable for production use.
Introduction
This repo is a vulnerability database and package search for sources such as AppThreat vuln-list, OSV, NVD, and GitHub. Vulnerability data are downloaded from the sources and stored in a sqlite based storage with indexes to allow offline access and efficient searches.
Why vulnerability db?
A good vulnerability database must have the following properties:
- Accuracy
- Easy to download, integrate, and use
- Performance
Multiple upstream sources are used by vdb to improve accuracy and reduce false negatives. SQLite database containing data in CVE 5.0 schema format is precompiled and distributed as files via ghcr to simplify download. With automatic purl prefix generation even for git repos, searches on the database can be performed with purl, cpe, or even http git url string. Every row in the database uses an open specification such as CVE 5.0 or Package URL (purl and vers) thus preventing the possibility of vendor lock-in.
Freeloaders are welcome!
Vulnerability Data sources
- Linux vuln-list (Forked from AquaSecurity)
- OSV (1)
- NVD
- GitHub
1 - We exclude Linux and oss-fuzz feeds by default. Set the environment variable OSV_INCLUDE_FUZZ to include them.
Linux distros
- AlmaLinux
- Debian
- Alpine
- Amazon Linux
- Arch Linux
- RHEL/CentOS
- Rocky Linux
- Ubuntu
- OpenSUSE/SLES
- Photon
- Chainguard
- Wolfi OS
Installation
pip install appthreat-vulnerability-db
Usage
This package is ideal as a library for managing vulnerabilities. This is used by owasp-dep-scan, a free open-source dependency audit tool. However, there is a limited cli capability available with few features to test this tool directly.
Download pre-built database (Recommended)
Use the ORAS cli to download a pre-built sqlite database (refreshed every 6 hours) containing all application and OS vulnerabilities. This is recommended for all users.
export VDB_HOME=$HOME/vdb
oras pull ghcr.io/appthreat/vdbxz:v6 -o $VDB_HOME
tar -xvf *.tar.xz
rm *.tar.xz
Use any sqlite browser or cli tools to load and query the two databases.
data.index.vdb6 - index db with purl prefix and vers
data.vdb6 - Contains source data in CVE 5.0 format stored as a jsonb blob.
Manually create the vulnerability database
Cache application vulnerabilities
vdb --cache
The typical size of this database is over 1.1 GB.
Cache application and OS vulnerabilities
vdb --cache-os
Note the size of the database with OS vulnerabilities is over 13 GB.
Cache from just OSV
vdb --cache --only-osv
It is possible to customize the cache behavior by increasing the historic data period to cache by setting the following environment variables.
- NVD_START_YEAR - Default: 2018. Supports up to 2002
- GITHUB_PAGE_COUNT - Default: 2. Supports up to 20
CLI search
It is possible to perform a range of searches using the cli.
vdb --search pkg:pypi/xml2dict@0.2.2
# Search based on a purl prefix
vdb --search pkg:pypi/xml2dict
# Full url and short form for swift
vdb --search "pkg:swift/github.com/vapor/vapor@4.39.0"
vdb --search "pkg:swift/vapor/vapor@4.89.0"
# Search by cpe
vdb --search "cpe:2.3:a:npm:gitblame:*:*:*:*:*:*:*:*"
# Search by colon separated values
vdb --search "npm:gitblame:0.0.1"
# Search by CVE id
vdb --search CVE-2024-25169
# Search by git url
vdb --search "https://github.com/electron/electron
License
MIT
Metadata
Release files for appthreat-vulnerability-db 6.0.0rc2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| appthreat-vulnerability-db-6.0.0rc2.tar.gz | 75.5 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| appthreat_vulnerability_db-6.0.0rc2-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 149.9 kB
Release files / appthreat-vulnerability-db-6.0.0rc2.tar.gz
| Download URL | appthreat-vulnerability-db-6.0.0rc2.tar.gz |
|---|---|
| Size | 75.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
66bb26043a55bad6d2477520334413f69c0e2452c6987db20b1086c505726515
|
|
BLAKE2b-256 checksum How to use checksums |
733939abeb3140bd6cb69828f6d5555201a93e2c634e6a8d4b700761adf42e8e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/5.0.0 CPython/3.12.2
|
Release files / appthreat_vulnerability_db-6.0.0rc2-py3-none-any.whl
| Download URL | appthreat_vulnerability_db-6.0.0rc2-py3-none-any.whl |
|---|---|
| Size | 74.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
034020cf0b63fbbd6a6cbaf625b8f9b7d0e42fba74dc14d55af3f0a97b98b1d4
|
|
BLAKE2b-256 checksum How to use checksums |
402d71ecea60a3f3b1c763338a50dbc89af138fb6b9cbd8251517b0aec13d066
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/5.0.0 CPython/3.12.2
|
Security for appthreat-vulnerability-db 6.0.0rc2
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
