Red Hat CVE Checker

A tool to analyze vulnerability scanner reports against Red Hat's VEX (Vulnerability Exploitability eXchange) data to identify false positives, severity mismatches, and CVSS score discrepancies.

Features

• Multi-Scanner Support: Parses exports from RHACS, Nessus, Qualys, Prisma Cloud, Trivy, Clair, Anchore, and Snyk
• Red Hat VEX Integration: Compares findings against official Red Hat VEX data
• False Positive Detection: Identifies CVEs that don't actually affect Red Hat software
• Severity & CVSS Analysis: Highlights discrepancies between scanner and Red Hat ratings
• OpenShift Analysis: Identifies OCP versions and shows upgrade recommendations
• Product Lifecycle: Detects outdated or end-of-life Red Hat products
• Validation Score: Provides an overall quality score for scanner reports
• Dual Interface: CLI tool and web application
• Container Ready: Deployable to Podman/Docker/OpenShift

Quick Start

Installation

Install rh-cve-checker from PyPI:

pip install rh-cve-checker

Or with uv as a standalone tool (no virtual environment needed):

uv tool install rh-cve-checker

Upgrade later with uv tool upgrade rh-cve-checker; remove with uv tool uninstall rh-cve-checker.

See Installation for development installs, Git-based installs, and optional dependencies.

Development install

For contributors, clone the repository and install in editable mode:

git clone https://github.com/vdanen/rh-cve-checker.git
cd rh-cve-checker
uv sync --all-extras

Or with pip in a virtual environment:

python3 -m venv .venv
source .venv/bin/activate  # Windows: .venv\Scripts\activate
pip install -e ".[dev]"

Basic Usage

# Analyze a scanner report
rh-cve-checker analyze scan_results.csv

# With lifecycle detection
rh-cve-checker analyze scan_results.csv --check-lifecycle

# Start web interface
rh-cve-checker serve

Then open http://localhost:32000 to upload and analyze reports interactively.

Example Output

╭─────────────────────────────────────╮
│ Red Hat CVE Checker Analysis Report │
╰─────────────────────────────────────╯

Validation Score: 95.5/100 - Excellent

                Analysis Summary                
┏━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━┳━━━━━━━━━━━━┓
┃ Metric                  ┃ Count ┃ Percentage ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━╇━━━━━━━━━━━━┩
│ Total Findings          │  5200 │       100% │
│ True Positives          │  5182 │      99.7% │
│ False Positives         │     0 │       0.0% │
│ Likely False Positives  │     9 │       0.2% │
└─────────────────────────┴───────┴────────────┘

Documentation

Supported Scanners

License

Apache License 2.0

Related Links

• Red Hat Security Data
• Red Hat VEX Files
• Red Hat Security Advisories
• CSAF Specification