Red Hat CVE Checker
A tool to analyze vulnerability scanner reports against Red Hat's VEX (Vulnerability Exploitability eXchange) data to identify false positives, severity mismatches, and CVSS score discrepancies.
Features
- Multi-Scanner Support: Parses exports from RHACS, Nessus, Qualys, Prisma Cloud, Trivy, Clair, Anchore, and Snyk
- Red Hat VEX Integration: Compares findings against official Red Hat VEX data
- False Positive Detection: Identifies CVEs that don't actually affect Red Hat software
- Severity & CVSS Analysis: Highlights discrepancies between scanner and Red Hat ratings
- OpenShift Analysis: Identifies OCP versions and shows upgrade recommendations
- Product Lifecycle: Detects outdated or end-of-life Red Hat products
- Validation Score: Provides an overall quality score for scanner reports
- Dual Interface: CLI tool and web application
- Container Ready: Deployable to Podman/Docker/OpenShift
Quick Start
Installation
Install rh-cve-checker from PyPI:
pip install rh-cve-checker
Or with uv as a standalone tool (no virtual environment needed):
uv tool install rh-cve-checker
Upgrade later with uv tool upgrade rh-cve-checker; remove with uv tool uninstall rh-cve-checker.
See Installation for development installs, Git-based installs, and optional dependencies.
Development install
For contributors, clone the repository and install in editable mode:
git clone https://github.com/vdanen/rh-cve-checker.git
cd rh-cve-checker
uv sync --all-extras
Or with pip in a virtual environment:
python3 -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -e ".[dev]"
Basic Usage
# Analyze a scanner report
rh-cve-checker analyze scan_results.csv
# With lifecycle detection
rh-cve-checker analyze scan_results.csv --check-lifecycle
# Start web interface
rh-cve-checker serve
Then open http://localhost:32000 to upload and analyze reports interactively.
Example Output
╭─────────────────────────────────────╮
│ Red Hat CVE Checker Analysis Report │
╰─────────────────────────────────────╯
Validation Score: 95.5/100 - Excellent
Analysis Summary
┏━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━┳━━━━━━━━━━━━┓
┃ Metric ┃ Count ┃ Percentage ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━╇━━━━━━━━━━━━┩
│ Total Findings │ 5200 │ 100% │
│ True Positives │ 5182 │ 99.7% │
│ False Positives │ 0 │ 0.0% │
│ Likely False Positives │ 9 │ 0.2% │
└─────────────────────────┴───────┴────────────┘
Documentation
| Document | Description |
|---|---|
| Installation | Detailed installation instructions |
| Usage Guide | CLI commands and web interface |
| Deployment | Container and OpenShift deployment |
| OpenShift Analysis | OCP version detection and analysis |
| Lifecycle Detection | Product lifecycle and AI detection |
| Validation Score | How the scoring system works |
| Configuration | Environment variables and settings |
| Development | Contributing and project structure |
Supported Scanners
| Scanner | Format | Auto-Detection |
|---|---|---|
| Red Hat ACS (RHACS) | CSV | ✅ |
| Tenable/Nessus | CSV | ✅ |
| Qualys | CSV | ✅ |
| Prisma Cloud | CSV, JSON | ✅ |
| Trivy | CSV, JSON | ✅ |
| Clair | CSV, JSON | ✅ |
| Anchore | CSV, JSON | ✅ |
| Snyk | CSV, JSON | ✅ |
License
Apache License 2.0
Related Links
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file rh_cve_checker-0.2.1.tar.gz.
File metadata
- Download URL: rh_cve_checker-0.2.1.tar.gz
- Upload date:
- Size: 184.5 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/6.1.0 CPython/3.13.13
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
dda96a26d4468ddf275cbbe8ec997dada6dd616a8d0335797ac7b7941aa89cc8
|
|
| MD5 |
d3c80be3bcf0e07988aadedfe99144da
|
|
| BLAKE2b-256 |
9ff7e16c9f878ec138862254836b26a956f48a4a392cc57fd2bb290f566b6fbc
|
Provenance
The following attestation bundles were made for rh_cve_checker-0.2.1.tar.gz:
Publisher:
release.yml on vdanen/rh-cve-checker
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
rh_cve_checker-0.2.1.tar.gz -
Subject digest:
dda96a26d4468ddf275cbbe8ec997dada6dd616a8d0335797ac7b7941aa89cc8 - Sigstore transparency entry: 2567612944
- Sigstore integration time:
-
Permalink:
vdanen/rh-cve-checker@14f07fef143117f45dd042431fe1f8650be74d89 -
Branch / Tag:
refs/tags/v0.2.1 - Owner: https://github.com/vdanen
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@14f07fef143117f45dd042431fe1f8650be74d89 -
Trigger Event:
push
-
Statement type:
File details
Details for the file rh_cve_checker-0.2.1-py3-none-any.whl.
File metadata
- Download URL: rh_cve_checker-0.2.1-py3-none-any.whl
- Upload date:
- Size: 196.1 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/6.1.0 CPython/3.13.13
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
3a42139fe5df0c26a82a89548ba73548b1ba7f7e4851a1904e7c7f8cf22775d9
|
|
| MD5 |
106809c1fcfa22ccdfe9cb5876e4a0b6
|
|
| BLAKE2b-256 |
067fed61f16d6feae024689200c98b259379bd7966013681d8d03d8569808366
|
Provenance
The following attestation bundles were made for rh_cve_checker-0.2.1-py3-none-any.whl:
Publisher:
release.yml on vdanen/rh-cve-checker
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
rh_cve_checker-0.2.1-py3-none-any.whl -
Subject digest:
3a42139fe5df0c26a82a89548ba73548b1ba7f7e4851a1904e7c7f8cf22775d9 - Sigstore transparency entry: 2567613229
- Sigstore integration time:
-
Permalink:
vdanen/rh-cve-checker@14f07fef143117f45dd042431fe1f8650be74d89 -
Branch / Tag:
refs/tags/v0.2.1 - Owner: https://github.com/vdanen
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@14f07fef143117f45dd042431fe1f8650be74d89 -
Trigger Event:
push
-
Statement type:
