{"id":21934838,"url":"https://github.com/cddmp/cvecheck","last_synced_at":"2025-04-19T22:44:39.988Z","repository":{"id":129333830,"uuid":"473535831","full_name":"cddmp/cvecheck","owner":"cddmp","description":"A simple command line tool to query the National Vulnerability Database (NVD) with template (Jinja2) and color support.","archived":false,"fork":false,"pushed_at":"2025-03-20T12:10:33.000Z","size":116,"stargazers_count":5,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-19T22:44:16.154Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cddmp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-03-24T09:22:22.000Z","updated_at":"2025-03-20T12:10:37.000Z","dependencies_parsed_at":null,"dependency_job_id":"fd16778e-e979-4ccf-9c00-d0954d0693a3","html_url":"https://github.com/cddmp/cvecheck","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cddmp%2Fcvecheck","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cddmp%2Fcvecheck/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cddmp%2Fcvecheck/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cddmp%2Fcvecheck/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cddmp","download_url":"https://codeload.github.com/cddmp/cvecheck/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249822507,"owners_count":21329977,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-29T00:17:25.376Z","updated_at":"2025-04-19T22:44:39.970Z","avatar_url":"https://github.com/cddmp.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003ch1 align=\"center\"\u003ecvecheck\u003c/h1\u003e\n\u003cp align=\"center\"\u003e\n\u003cstrong\u003eA simple tool to query the National Vulnerability Database (NVD) with colors support\u003c/strong\u003e\n\u003c/p\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"https://img.shields.io/badge/python-%3E=_3.8-blue\"/\u003e\n\u003cimg src=\"https://img.shields.io/badge/License-GPLv3-green.svg\"/\u003e\n\u003c/p\u003e\n\nOften during penetration tests, outdated software components are found and it is necessary to look up whether any Common Vulnerabilities and Exposures (CVE) exists to examine and document them. This simple tool is meant to make this process faster.\n\nIt allows to query the National Vulnerability Database (NVD) by keyword, CVE ID, Common Platform Enumeration (CPE) string or \"simplified\" CPE (see further down). The tool detects the correct mode automatically.\nThe output is generated via Jinja2 templates. This allows to create your own output templates in order to get custom output formatting (see examples folder). In addition, the terminal output is colored (can be disabled via [NO_COLOR](https://no-color.org/) environment variable).\n\nCurrently it outputs CVEs in three groups:\n- CVEs which are still under analysis (no CVSS vector assigned)\n- CVEs with both a CVSS v3.1/v3.0 and a CVSS v2 vector\n- CVEs with a CVSS v2 vector only\n\nBy default, the last two groups are sorted by score in descending order.\n\n## Installation\n```pip install -r requirements.txt```\n\n## Run\n\n### CVE search\nThe tool automatically searches for a specific CVE if the given keyword starts with 'CVE-' (case agnostic).\n\n```./cvecheck.py 'CVE-2014-0160'```\n\n### CPE based search\nThe tool automatically does a CPE based search if the keyword starts with 'cpe:' (case agnostic). A CPE strings has the following format:\n\n``cpe:\u003ccpe_version\u003e:\u003cpart\u003e:\u003cvendor\u003e:\u003cproduct\u003e:\u003cversion\u003e:\u003cupdate\u003e:\u003cedition\u003e:\u003clanguage\u003e:\u003csw_edition\u003e:\u003ctarget_sw\u003e:\u003ctarget_hw\u003e:\u003cother\u003e``\n\nThe latest ``cpe_version`` is '2.3'. ``part`` can have the following values:\n- ``a`` for applications\n- ``h`` for hardware\n- ``o`` for operating system\n\nBelow is an example where the ``vendor`` and ``product`` are set to 'openssl' with ``version`` '1.0.2f'.\n\n```./cvecheck.py 'cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*'```\n\nIf the CPE is not unique and would therefore match different CPEs in the NVD database, a list of possible CPEs will be shown, where one needs to be selected. If a wildcard is being used and only one CPE would match, then this CPE is automatically selected for the search and the tool will continue without showing any prompt.\n\n### 'Simplified' CPE search\nThe CPE strings are very long and hard to remember. Therefore it supports, what I call, 'simplified' CPE strings. These strings have the following format:\n\n``scpe:\u003cvendor\u003e:\u003cproduct\u003e:\u003cversion\u003e``\n\nAs with the normal CPE, stars can be used as wild cards. Below is an example where ``vendor`` is set to '*', ``product`` is set to 'openssl' and ``version`` is '1.0.2f'.\n\nApart from that, the same applies as with the CPE search described above.\n\n```./cvecheck.py 'scpe:*:openssl:1.0.2f''```\n\n### Keyword based search\nIf the keyword does not start with 'CVE-', 'cpe:' or 'scpe:', the keyword based search will be used.\n\n```./cvecheck.py 'openssl 1.0.2f'```\n\n## Filter\nVarious filters are supported. Results can be filtered by metrics, vector or score. \n\n### Metrics filter\nThe metrics filter is passed directly to the API. All the filtering happens therefore at the API backend. The following example filters for all CVEs with attack vector 'Network'.\n\n```./cvecheck.py 'scpe:openssl:openssl:1.0.2f' --filter-v3metrics 'AV:N'```\n\n### Score filter\nThe tool allows to filter by score, which is not supported by the NVD API. Therefore, the filter is applied locally once the CVEs have been fetched from the API. The filter allows to either filter by range or by a single value:\n\n```./cvecheck.py 'scpe:openssl:openssl:1.0.2f' --filter-v3score '7.5'```\n\n```./cvecheck.py 'scpe:openssl:openssl:1.0.2f' --filter-v3score '4.0-6.9'```\n\n### Severity filter\nThe NVD API only allows to filter by one severity (e.g., 'MEDIUM'). The tool allows to filter by several severity values. If only one severity is being passed the filtering will happen at the API. In all other cases (multiple severity values being passed), the filtering will happen locally:\n\n```./cvecheck.py 'scpe:openssl:openssl:1.0.2f' --filter-v3severity high,critical```\n\n### Template based output\nSometimes one needs a more verbose output like the CVE ID, the base scores as well as the description. Sometimes, e.g, for a table in a report, one only needs a list of CVEs without any description but with most recent CVSS base scores. For this, template support was added. Some examples are in the example directory. The templates can be simply passed with the ``--template`` parameter. By default the default.jinja2 template will be used (again see examples directory).\n\n### API key\nThe NVD API supports keys which can be passed with the ``--api-key`` parameter. A key can be obtained for free from here: https://nvd.nist.gov/developers/request-an-api-key\n\n#### Important notes\nIt should be noted, that it might take some minutes for the key to become active, once it was obtained via the link above. If the key is not activated, the API currently returns an HTTP 404. The tool will print that out. Try again after some minutes. Once the key works, it will work all the time.\n\nThe NVD API by default delays any request for 6 seconds, if no API key is used. When an API key is used, the delay will be lowered to 0.6 seconds. The tool reflects that with the ``--delay`` parameter.\nStill, it should be noted that NIST published best practices for the API. These best practices state that users should \"sleep\" their scripts for 6 seconds between requests (see https://nvd.nist.gov/developers/start-here). Therefore, if the script is run in parallel or in a loop it should be ensured that this timing is kept.\n\n## Credits\nThe tool uses vehemont's nvdlib (https://github.com/Vehemont/nvdlib), a python wrapper for the NVD CVE/CPE API.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcddmp%2Fcvecheck","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcddmp%2Fcvecheck","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcddmp%2Fcvecheck/lists"}