{"id":51874064,"url":"https://github.com/vbrik/distro-package-cve-query","last_synced_at":"2026-07-25T04:30:30.100Z","repository":{"id":372538045,"uuid":"1308090395","full_name":"vbrik/distro-package-cve-query","owner":"vbrik","description":"Command-line CVE checker for RHEL, AlmaLinux, and Rocky Linux packages: query by installed package version or CVE ID using Red Hat's official OVAL security feeds.","archived":false,"fork":false,"pushed_at":"2026-07-21T22:47:16.000Z","size":60,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-07-21T23:12:10.428Z","etag":null,"topics":["almalinux","cli","cve","linux","oval","patch-management","python","redhat","rhel","rockylinux","security","security-tools","sysadmin","vulnerability-scanner"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vbrik.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-21T20:17:42.000Z","updated_at":"2026-07-21T22:47:20.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/vbrik/distro-package-cve-query","commit_stats":null,"previous_names":["vbrik/distro-package-cve-query"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/vbrik/distro-package-cve-query","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vbrik%2Fdistro-package-cve-query","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vbrik%2Fdistro-package-cve-query/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vbrik%2Fdistro-package-cve-query/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vbrik%2Fdistro-package-cve-query/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vbrik","download_url":"https://codeload.github.com/vbrik/distro-package-cve-query/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vbrik%2Fdistro-package-cve-query/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35866686,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-25T02:00:06.922Z","response_time":64,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["almalinux","cli","cve","linux","oval","patch-management","python","redhat","rhel","rockylinux","security","security-tools","sysadmin","vulnerability-scanner"],"created_at":"2026-07-25T04:30:29.667Z","updated_at":"2026-07-25T04:30:30.086Z","avatar_url":"https://github.com/vbrik.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# distro-package-cve-query\n\nA command-line CVE checker for RHEL and its 1:1 rebuilds (AlmaLinux, Rocky\nLinux). Answers two questions:\n\n- **Is this package vulnerable?** — given an installed package version\n  (any package, not just the kernel), list which CVEs affect it, which\n  are already fixed in a later release, and which are still unpatched.\n- **Which package version fixes this CVE?** — given a CVE ID, find which\n  packages and versions fix it, per RHEL major version, plus severity,\n  CVSS3 score, and advisory IDs.\n\nUses official OVAL security feeds. AlmaLinux and Rocky Linux are 1:1\nrebuilds of RHEL that keep the same package version/release strings (e.g.\n`.el9` tags, sometimes with an `.alma`/`.rocky` rebuild suffix), so a\nrebuild's packages can be checked against RHEL's own vulnerability data.\nRHEL major versions 8, 9, and 10 are supported:\n\n- **RHEL 8 and 9** use Red Hat's own OVAL feed (`security.access.redhat.com`),\n  which includes CVEs that have no fix yet, with their current state (e.g.\n  \"Affected\", \"Will not fix\", \"Out of support scope\").\n- **RHEL 10** uses AlmaLinux's own OVAL feed (`security.almalinux.org`)\n  instead, since Red Hat no longer publishes OVAL data for RHEL 10 onward\n  (they've moved to CSAF/VEX, a format this tool doesn't consume). AlmaLinux\n  regenerates its feed from the same Red Hat advisories, but it only covers\n  already-fixed CVEs — it has no equivalent unpatched-CVE tracking, so that\n  part of the output is unavailable for RHEL 10 (the tool notes this\n  explicitly wherever it applies).\n\nCVSS3 scores/vectors are shown from Red Hat's own assessment by default,\nsince vendors commonly re-score a CVE against how it behaves in their\nshipped build (e.g. judging an attack path harder to reach in practice than\nthe original CNA did). The tool cross-checks each score against the CVE's\nauthoritative record on [cve.org](https://cve.org) and marks it with `*`\nwhen the two disagree; pass `--cve-org` to show cve.org's score/vector\ninstead of Red Hat's (with the same `*` marking in reverse). AlmaLinux's\nfeed (used for RHEL 10) carries the vector but not the numeric score, so\nby default the CVSS3 column reads `N/A**` for RHEL 10 (a note explains the\nmarker) — pass `--cve-org` to get a score there.\n\nThe script has two modes, selected automatically based on the query:\n\n- **Package mode** — pass a package version string to list CVEs affecting\n  that package, split into:\n  - CVEs already fixed in a later release, with the minimum fix version,\n    module stream (if applicable), advisory ID, and issue/disclosure dates\n  - CVEs with no fix released yet, with their current state (e.g.\n    \"Affected\", \"Will not fix\", \"Out of support scope\")\n  - CVEs whose fix is already incorporated in the given version\n\n  Accepts `rpm -qa` / `dnf` style names for any package (e.g.\n  `nginx-1.20.1-28.el9_8.2.alma.1.x86_64`) and, for kernels only, the bare\n  `uname -r` / `vmlinuz-*` forms as a convenience.\n\n  Each CVE's CVSS3 vector is broken out into one column per component\n  (Attack Vector, Attack Complexity, Privileges Required, ...), and, on a\n  terminal, the more dangerous values (e.g. Network attack vector, no\n  privileges required) are colored to stand out. Pass `--no-color` for\n  plain black-and-white output; color is already off automatically when\n  output isn't a terminal (e.g. redirected to a file or piped).\n\n- **CVE mode** — pass a CVE ID (e.g. `CVE-2024-26828`) to see which\n  packages fix it, the fix versions, and the advisories, for each queried\n  RHEL major version. For readability, sub-packages are folded into their\n  parent package (e.g. `kernel (+98 sub-packages)` instead of listing\n  `kernel-devel`, `kernel-modules-core`, ...), and packages shipped as\n  module streams are shown once with their stream labels; pass\n  `--all-packages` to list every affected package individually.\n\nOVAL data and cve.org lookups are cached locally (default 1 hour, see\n`--cache-timeout`) since the uncompressed RHEL 8/9 OVAL feeds are 300+ MB\nand take a while to download and parse.\n\n## Usage\n\n```\ndistro-package-cve-query.py nginx-1.20.1-28.el9_8.2.alma.1.x86_64\ndistro-package-cve-query.py nginx-2:1.20.1-28.el9_8.4.alma.1        # epoch form, as printed by dnf\ndistro-package-cve-query.py openssl-1.1.1k-17.el8_6 --min-severity moderate\ndistro-package-cve-query.py perl-5.40.2-512.1.el10_0.x86_64        # AlmaLinux 10\ndistro-package-cve-query.py 5.14.0-687.5.1.el9_8.x86_64            # kernel, from `uname -r`\ndistro-package-cve-query.py vmlinuz-5.14.0-687.5.1.el9_8.x86_64    # kernel, from /boot\ndistro-package-cve-query.py CVE-2025-1974\ndistro-package-cve-query.py CVE-2025-1974 --rhel 9\n```\n\nRun `distro-package-cve-query.py --help` for the full list of options.\n\n## Requirements\n\nPython 3 with only the standard library; `lxml` is used automatically if\ninstalled (faster XML parsing) but is not required.\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvbrik%2Fdistro-package-cve-query","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvbrik%2Fdistro-package-cve-query","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvbrik%2Fdistro-package-cve-query/lists"}