https://github.com/vbrik/distro-package-cve-query
Command-line CVE checker for RHEL, AlmaLinux, and Rocky Linux packages: query by installed package version or CVE ID using Red Hat's official OVAL security feeds.
https://github.com/vbrik/distro-package-cve-query
almalinux cli cve linux oval patch-management python redhat rhel rockylinux security security-tools sysadmin vulnerability-scanner
Last synced: 3 days ago
JSON representation
Command-line CVE checker for RHEL, AlmaLinux, and Rocky Linux packages: query by installed package version or CVE ID using Red Hat's official OVAL security feeds.
- Host: GitHub
- URL: https://github.com/vbrik/distro-package-cve-query
- Owner: vbrik
- License: mit
- Created: 2026-07-21T20:17:42.000Z (7 days ago)
- Default Branch: master
- Last Pushed: 2026-07-21T22:47:16.000Z (7 days ago)
- Last Synced: 2026-07-21T23:12:10.428Z (7 days ago)
- Topics: almalinux, cli, cve, linux, oval, patch-management, python, redhat, rhel, rockylinux, security, security-tools, sysadmin, vulnerability-scanner
- Language: Python
- Homepage:
- Size: 58.6 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# distro-package-cve-query
A command-line CVE checker for RHEL and its 1:1 rebuilds (AlmaLinux, Rocky
Linux). Answers two questions:
- **Is this package vulnerable?** — given an installed package version
(any package, not just the kernel), list which CVEs affect it, which
are already fixed in a later release, and which are still unpatched.
- **Which package version fixes this CVE?** — given a CVE ID, find which
packages and versions fix it, per RHEL major version, plus severity,
CVSS3 score, and advisory IDs.
Uses official OVAL security feeds. AlmaLinux and Rocky Linux are 1:1
rebuilds of RHEL that keep the same package version/release strings (e.g.
`.el9` tags, sometimes with an `.alma`/`.rocky` rebuild suffix), so a
rebuild's packages can be checked against RHEL's own vulnerability data.
RHEL major versions 8, 9, and 10 are supported:
- **RHEL 8 and 9** use Red Hat's own OVAL feed (`security.access.redhat.com`),
which includes CVEs that have no fix yet, with their current state (e.g.
"Affected", "Will not fix", "Out of support scope").
- **RHEL 10** uses AlmaLinux's own OVAL feed (`security.almalinux.org`)
instead, since Red Hat no longer publishes OVAL data for RHEL 10 onward
(they've moved to CSAF/VEX, a format this tool doesn't consume). AlmaLinux
regenerates its feed from the same Red Hat advisories, but it only covers
already-fixed CVEs — it has no equivalent unpatched-CVE tracking, so that
part of the output is unavailable for RHEL 10 (the tool notes this
explicitly wherever it applies).
CVSS3 scores/vectors are shown from Red Hat's own assessment by default,
since vendors commonly re-score a CVE against how it behaves in their
shipped build (e.g. judging an attack path harder to reach in practice than
the original CNA did). The tool cross-checks each score against the CVE's
authoritative record on [cve.org](https://cve.org) and marks it with `*`
when the two disagree; pass `--cve-org` to show cve.org's score/vector
instead of Red Hat's (with the same `*` marking in reverse). AlmaLinux's
feed (used for RHEL 10) carries the vector but not the numeric score, so
by default the CVSS3 column reads `N/A**` for RHEL 10 (a note explains the
marker) — pass `--cve-org` to get a score there.
The script has two modes, selected automatically based on the query:
- **Package mode** — pass a package version string to list CVEs affecting
that package, split into:
- CVEs already fixed in a later release, with the minimum fix version,
module stream (if applicable), advisory ID, and issue/disclosure dates
- CVEs with no fix released yet, with their current state (e.g.
"Affected", "Will not fix", "Out of support scope")
- CVEs whose fix is already incorporated in the given version
Accepts `rpm -qa` / `dnf` style names for any package (e.g.
`nginx-1.20.1-28.el9_8.2.alma.1.x86_64`) and, for kernels only, the bare
`uname -r` / `vmlinuz-*` forms as a convenience.
Each CVE's CVSS3 vector is broken out into one column per component
(Attack Vector, Attack Complexity, Privileges Required, ...), and, on a
terminal, the more dangerous values (e.g. Network attack vector, no
privileges required) are colored to stand out. Pass `--no-color` for
plain black-and-white output; color is already off automatically when
output isn't a terminal (e.g. redirected to a file or piped).
- **CVE mode** — pass a CVE ID (e.g. `CVE-2024-26828`) to see which
packages fix it, the fix versions, and the advisories, for each queried
RHEL major version. For readability, sub-packages are folded into their
parent package (e.g. `kernel (+98 sub-packages)` instead of listing
`kernel-devel`, `kernel-modules-core`, ...), and packages shipped as
module streams are shown once with their stream labels; pass
`--all-packages` to list every affected package individually.
OVAL data and cve.org lookups are cached locally (default 1 hour, see
`--cache-timeout`) since the uncompressed RHEL 8/9 OVAL feeds are 300+ MB
and take a while to download and parse.
## Usage
```
distro-package-cve-query.py nginx-1.20.1-28.el9_8.2.alma.1.x86_64
distro-package-cve-query.py nginx-2:1.20.1-28.el9_8.4.alma.1 # epoch form, as printed by dnf
distro-package-cve-query.py openssl-1.1.1k-17.el8_6 --min-severity moderate
distro-package-cve-query.py perl-5.40.2-512.1.el10_0.x86_64 # AlmaLinux 10
distro-package-cve-query.py 5.14.0-687.5.1.el9_8.x86_64 # kernel, from `uname -r`
distro-package-cve-query.py vmlinuz-5.14.0-687.5.1.el9_8.x86_64 # kernel, from /boot
distro-package-cve-query.py CVE-2025-1974
distro-package-cve-query.py CVE-2025-1974 --rhel 9
```
Run `distro-package-cve-query.py --help` for the full list of options.
## Requirements
Python 3 with only the standard library; `lxml` is used automatically if
installed (faster XML parsing) but is not required.
## License
MIT — see [LICENSE](LICENSE).