{"id":24341821,"url":"https://github.com/vulsio/gost","last_synced_at":"2026-05-11T04:17:01.350Z","repository":{"id":37961628,"uuid":"100123890","full_name":"vulsio/gost","owner":"vulsio","description":"Build a local copy of Security Tracker. Notify via E-mail/Slack if there is an update.","archived":false,"fork":false,"pushed_at":"2025-04-12T02:55:16.000Z","size":1920,"stargazers_count":144,"open_issues_count":2,"forks_count":43,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-04-12T03:34:37.749Z","etag":null,"topics":["freebsd","go","golang","linux","security","vulnerability-databases"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vulsio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2017-08-12T16:19:41.000Z","updated_at":"2025-04-12T02:55:19.000Z","dependencies_parsed_at":"2023-02-18T03:31:21.712Z","dependency_job_id":"865fce3c-4e05-4d60-90c8-8822ffc1a6fc","html_url":"https://github.com/vulsio/gost","commit_stats":null,"previous_names":[],"tags_count":22,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vulsio%2Fgost","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vulsio%2Fgost/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vulsio%2Fgost/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vulsio%2Fgost/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vulsio","download_url":"https://codeload.github.com/vulsio/gost/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248616298,"owners_count":21134053,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["freebsd","go","golang","linux","security","vulnerability-databases"],"created_at":"2025-01-18T08:01:15.802Z","updated_at":"2026-05-11T04:17:01.323Z","avatar_url":"https://github.com/vulsio.png","language":"Go","funding_links":[],"categories":["LLM分析过程","Go"],"sub_categories":[],"readme":"# gost (go-security-tracker)\n[![MIT License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](https://github.com/vulsio/gost/blob/master/LICENSE)\n\n`gost` builds a local copy of Security Tracker(Redhat/Debian/Ubuntu/Microsoft).   \nAfter you register CVEs to watch list, `gost` notify via E-mail/Slack if there is an update.\nThe pronunciation of `gost` is the same as the English word \"ghost\".\n\n\u003cimg src=\"doc/gost01.gif\" width=\"700\"\u003e\n\n# Abstract\n`gost` is written in Go, and therefore you can just grab the binary releases and drop it in your $PATH.\n\n`gost` builds a local copy of Security Tracker ([Redhat](https://access.redhat.com/security/security-updates/) or [Debian](https://security-tracker.debian.org/tracker/) or [Ubuntu](https://people.canonical.com/~ubuntu-security/cve/) or [Microsoft](https://portal.msrc.microsoft.com/en-us/security-guidance)). \n\nA system administrator always monitor `Security Tracker`. It can be a burden. For example, after the vulnerability is found, we have to wait until the patch comes out. I hope anyone notifies me if there is an update. \n\n# Main features\n`gost` has the following features.\n- Build a local copy of Security Tracker\n- A server mode for easy querying\n- Register CVEs to watch list\n- Notify if there is an update (E-Mail or Slack)\n- Monitoring metric can be specified (e.g. CVSS Score, Severity, etc.)\n\n# Usage\n\n```\n$ gost help\nSecurity Tracker\n\nUsage:\n  gost [command]\n\nAvailable Commands:\n  completion  generate the autocompletion script for the specified shell\n  fetch       Fetch the data of the security tracker\n  help        Help about any command\n  notify      Notifiy update about the specified CVE\n  register    Register CVEs to monitor\n  server      Start security tracker HTTP server\n  version     Show version\n\nFlags:\n      --config string       config file (default is $HOME/.gost.yaml)\n      --dbpath string       /path/to/sqlite3 or SQL connection string (default \"$PWD/gost.sqlite3\")\n      --dbtype string       Database type to store data in (sqlite3, mysql, postgres or redis supported) (default \"sqlite3\")\n      --debug               debug mode\n      --debug-sql           SQL debug mode\n  -h, --help                help for gost\n      --http-proxy string   http://proxy-url:port (default: empty)\n      --log-dir string      /path/to/log (default \"/var/log/gost\")\n      --log-json            output log as JSON\n      --log-to-file         output log to file\n      --to-email            Send notification via Email\n      --to-slack            Send notification via Slack\n\nUse \"gost [command] --help\" for more information about a command.\n```\n\n# Fetch RedHat\n\n## Fetch vulnerability infomation updated after 2016-01-01\n\n```\n$ gost fetch redhat \n\nINFO[07-27|11:13:27] Initialize Database\nINFO[07-27|11:13:27] Opening DB.                              db=sqlite3\nINFO[07-27|11:13:27] Migrating DB.                            db=sqlite3\nINFO[07-27|11:13:27] Fetch the list of CVEs\nINFO[07-27|13:59:33] Fetched 6136 CVEs\n 6136 / 6136 [=================] 100.00% 8m25s\nINFO[07-27|14:08:00] Insert RedHat into DB                    db=sqlite3\n 0 / 6136 [--------------------]   0.00%INFO[07-27|14:08:00] Insert 6136 CVEs\n 6136 / 6136 [=================] 100.00% 17s\n```\n\n# Fetch Debian\n\n## Fetch vulnerability infomation \n\n```\n$ gost fetch debian \n\nINFO[07-27|15:30:49] Initialize Database\nINFO[07-27|15:30:49] Opening DB.                              db=sqlite3\nINFO[07-27|15:30:49] Migrating DB.                            db=sqlite3\nINFO[07-27|15:30:49] Fetched all CVEs from Debian\nINFO[07-27|15:31:09] Insert Debian CVEs into DB               db=sqlite3\n 21428 / 21428 [================] 100.00% 5s\n```\n\n# Fetch Ubuntu\n\n## Fetch vulnerability infomation \n\n```\n$ gost fetch ubuntu \n\nINFO[05-23|06:28:18] Initialize Database \nINFO[05-23|06:28:18] Fetched                                  CVEs=36737\nINFO[05-23|06:28:18] Insert Ubuntu into DB                    db=sqlite3\n 36737 / 36737 [============================================================================] 100.00% 55s\n```\n\n# Fetch Microsoft\n\n## Fetch vulnerability infomation \n\n```\n$ gost fetch microsoft\n\nINFO[02-24|02:13:41] Initialize Database \nINFO[02-24|02:13:41] Fetched all CVEs from Microsoft \nINFO[02-24|02:13:43] Insert Microsoft CVEs into DB            db=sqlite3\nINFO[02-24|02:13:43] Inserting cves                           cves=11609\n11609 / 11609 [----------------] 100.00% 3281 p/s\nINFO[02-24|02:13:47] Insert KB Relation                       relations=6016\n6016 / 6016 [----------------] 100.00% 5462 p/s\n\n```\n\n# Server mode\n\n```\n$ gost server\n[Aug 15 21:38:44]  INFO Opening DB (sqlite3)\n[Aug 15 21:38:44]  INFO Migrating DB (sqlite3)\n[Aug 15 21:38:44]  INFO Starting HTTP Server...\n[Aug 15 21:38:44]  INFO Listening on 127.0.0.1:1325\n\n$ curl http://127.0.0.1:1325/redhat/cves/CVE-2017-1000117 | jq .                                                                                                                     [~]\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100  1755  100  1755    0     0   243k      0 --:--:-- --:--:-- --:--:--  285k\n{\n  \"ID\": 12,\n  \"ThreatSeverity\": \"Important\",\n  \"PublicDate\": \"2017-08-10T00:00:00Z\",\n  \"Bugzilla\": {\n    \"RedhatCVEID\": 12,\n    \"description\": \"CVE-2017-1000117 git: Command injection via malicious ssh URLs\",\n    \"id\": \"1480386\",\n    \"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1480386\"\n  },\n  \"Cvss\": {\n    \"RedhatCVEID\": 0,\n    \"cvss_base_score\": \"\",\n    \"cvss_scoring_vector\": \"\",\n    \"status\": \"\"\n  },\n  \"Cvss3\": {\n    \"RedhatCVEID\": 12,\n    \"cvss3_base_score\": \"6.3\",\n    \"cvss3_scoring_vector\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L\",\n    \"status\": \"draft\"\n  },\n  \"Iava\": \"\",\n  \"Cwe\": \"\",\n  \"Statement\": \"\",\n  \"Acknowledgement\": \"\",\n  \"Mitigation\": \"\",\n  \"AffectedRelease\": [],\n  \"PackageState\": [\n    {\n      \"RedhatCVEID\": 12,\n      \"product_name\": \"Red Hat Software Collections for Red Hat Enterprise Linux\",\n      \"fix_state\": \"Affected\",\n      \"package_name\": \"rh-git29-git\",\n      \"cpe\": \"cpe:/a:redhat:rhel_software_collections:2\"\n    },\n    {\n      \"RedhatCVEID\": 12,\n      \"product_name\": \"Red Hat Enterprise Linux 6\",\n      \"fix_state\": \"Affected\",\n      \"package_name\": \"git\",\n      \"cpe\": \"cpe:/o:redhat:enterprise_linux:6\"\n    },\n    {\n      \"RedhatCVEID\": 12,\n      \"product_name\": \"Red Hat Enterprise Linux 7\",\n      \"fix_state\": \"Affected\",\n      \"package_name\": \"git\",\n      \"cpe\": \"cpe:/o:redhat:enterprise_linux:7\"\n    }\n  ],\n  \"Name\": \"CVE-2017-1000117\",\n  \"DocumentDistribution\": \"Copyright © 2016 Red Hat, Inc. All rights reserved.\",\n  \"Details\": [\n    {\n      \"RedhatCVEID\": 12,\n      \"Detail\": \"Details pending\"\n    },\n    {\n      \"RedhatCVEID\": 12,\n      \"Detail\": \"A shell command injection flaw related to the handling of \\\"ssh\\\" URLs has been discovered in Git. An attacker could use this flaw to execute shell commands with the privileges of the user running the Git client, for example, when performing a \\\"clone\\\" action on a malicious repository or a legitimate repository containing a malicious commit.\"\n    }\n  ],\n  \"References\": [\n    {\n      \"RedhatCVEID\": 12,\n      \"Reference\": \"https://lkml.org/lkml/2017/8/10/757\\nhttp://blog.recurity-labs.com/2017-08-10/scm-vulns\"\n    }\n  ]\n}\n```\n\n# Installation\n\nYou need to install selector command (fzf or peco).\n\n```\n$ go get github.com/vulsio/gost\n```\n\n# Docker Setup, Fetch, Run as Serer and Curl\n\n## Fetch Debian, Ubuntu, and RedHat then start as a server mode\n\n```\n$ docker run --rm -i \\ \n\t -v $PWD:/gost \\\n\t -v $PWD:/var/log/gost \\\n\t vuls/gost fetch debian\n   $ docker run --rm -i \\ \n\t -v $PWD:/gost \\\n\t -v $PWD:/var/log/gost \\\n\t vuls/gost fetch ubuntu\n$ docker run --rm -i \\\n\t-v $PWD:/gost \\\n\t-v $PWD:/var/log/gost \\\n\tvuls/gost fetch redhat \n$ ls \naccess.log      gost.log        gost.sqlite3\n\n$ docker run --rm -i \\\n        -v $PWD:/gost \\\n        -v $PWD:/var/log/gost \\\n        -p 1325:1325 \\\n        vuls/gost server --bind=0.0.0.0\n```\n\n## HTTP Get to the server on Docker\n\n```\n$ curl http://127.0.0.1:1325/debian/9/pkgs/expat/unfixed-cves | jq \".\"                                                                                         Fri Jul 27 16:03:15 2018\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100   970  100   970    0     0  60308      0 --:--:-- --:--:-- --:--:-- 60625\n{\n  \"CVE-2013-0340\": {\n    \"ID\": 8452,\n    \"CveID\": \"CVE-2013-0340\",\n    \"Scope\": \"remote\",\n    \"Description\": \"expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.\",\n    \"Package\": [\n      {\n        \"ID\": 9829,\n        \"DebianCVEID\": 8452,\n        \"PackageName\": \"expat\",\n        \"Release\": [\n          {\n            \"ID\": 32048,\n            \"DebianPackageID\": 9829,\n            \"ProductName\": \"stretch\",\n            \"Status\": \"open\",\n            \"FixedVersion\": \"\",\n            \"Urgency\": \"unimportant\",\n            \"Version\": \"2.2.0-2+deb9u1\"\n          }\n        ]\n      }\n    ]\n  }\n}\n```\n\n# Contribute\n\n1. fork a repository: github.com/vulsio/gost to github.com/you/repo\n2. get original code: `go get github.com/vulsio/gost`\n3. work on original code\n4. add remote to your repo: git remote add myfork https://github.com/you/repo.git\n5. push your changes: git push myfork\n6. create a new Pull Request\n\n- see [GitHub and Go: forking, pull requests, and go-getting](http://blog.campoy.cat/2014/03/github-and-go-forking-pull-requests-and.html)\n\n----\n\n# License\nMIT\n\n# Author\nTeppei Fukuda\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvulsio%2Fgost","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvulsio%2Fgost","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvulsio%2Fgost/lists"}