Skip to content

Releases: intel/cve-bin-tool

CVE Binary Tool 3.2.1

18 May 22:26
@terriko terriko
v3.2.1
92d27dc
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Binary Tool 3.2.1

Due to a change in the data used for the curl data source, we're issuing a slightly out of band point release for users unable to use 3.2.

There are a number of checker updates to address false positives, new checkers, and other bug fixes and features as described below.

One commonly requested feature has made it into this release: generation of SBOMs. Please try it out and let us know where it can be improved!

Thanks especially to the many new contributors in this release (you can see the list at the bottom)

  • Many of you joined us via the Google Summer of Code 2023 selection process: I wish we'd had mentors and slots available to have more of you as paid contributors this year!
  • Some of you also joined us via the Intel Open Source Hackathon: thank you so much for taking the time to work with us and it's been a delight to work with so many experienced coders during the event.
  • And some of you just stopped by on your own with great ideas and fixes. Thank you!

What's Changed

Read more

Contributors

raboof, jarebear6expepjozn6rakjq5iczi3irqwphcvb, and 28 other contributors
Loading

CVE Bin Tool pre-release 3.2.1rc0

11 May 23:54
@terriko terriko
v3.2.1rc0
e19ee4b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Bin Tool pre-release 3.2.1rc0 Pre-release
Pre-release

Due to a change in the data used for the curl data source, we're issuing a slightly out of band point release for users unable to use 3.2.

There are a number of checker updates to address false positives, new checkers, and other bug fixes and features as described below.

One commonly requested feature has made it into this release: generation of SBOMs. Please try it out and let us know where it can be improved!

What's Changed

Read more

Contributors

raboof, jarebear6expepjozn6rakjq5iczi3irqwphcvb, and 28 other contributors
Loading

CVE Binary Tool 3.2

19 Dec 18:46
@terriko terriko
v3.2
639fd49
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Binary Tool 3.2

New features from our GSoC 2022 participants:

  • @yashugarg added a large number of tests and work on fuzzing our interfaces
  • @rhythmrx9 aded new data sources (we now support advisories from Gitlab, OSV and Redhat as well as NVD)
  • @XDRAGON2002 for the new parsers that allow us to scan things like Ruby Gemfiles, Rust cargo files, and more.

Other interesting features in this release:

  • @ffontaine has added a large number of new checkers, pushing us well over 200 binary checkers.
  • @anthonyharrison has added initial support for NVD API 2.0. Note that at the time this was added the 2.0 version didn't work with their API keys, so the code behaves accordingly.

Thanks also to @BreadGenie for code review and mentoring support as well as a number of contributions listed below. A special shout out to @b31ngd3v and @metabiswadeep whose first contributions are in this release but they've been the first of many, as well as the many other folk who got their first commits in via Hacktoberfest or GSoC or goodfirstissue.dev or however you found us. Thanks to everyone for being part of this release!

Full change list

Read more

Contributors

wyattearp, raboof, and 55 other contributors
Loading

CVE Bin Tool pre-release 3.2rc0

14 Dec 06:04
@terriko terriko
v3.2rc0
2fe8ffc
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Bin Tool pre-release 3.2rc0 Pre-release
Pre-release

Preview release for 3.2.

We're currently seeing an issue in our testing system where Windows systems are taking a long time to upgrade the database to store additional data source information. Windows users are particularly encouraged to try this pre-release to see if you have any issues!

When updating your database, make sure your NVD_API_KEY is set and you may have better results using -u now to get a fresh database.

What's Changed

Read more

Contributors

wyattearp, raboof, and 55 other contributors
Loading

CVE Binary Tool 3.1.2

08 Dec 23:09
@terriko terriko
v3.1.2
859bac6
Compare
Choose a tag to compare
CVE Binary Tool 3.1.2

Minor update to force a downgrade of packaging to allow use of LegacyVersion (fixes #2428)

This is intended to be a temporary fix while we finish up the 3.2 release, but I believe we will be able to backport the removal for LegacyVersion without much trouble, so there may be one more release for the 3.1 tree if it looks like 3.2 is going to take more than a week.

Full Changelog: v3.1.1...v3.1.2

Loading

CVE Binary Tool 3.1.1

21 Jun 23:21
@terriko terriko
v3.1.1
abffa0d
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Binary Tool 3.1.1

Minor typo necessitated a version bump + new release.

What's Changed

Full Changelog: v3.1...v3.1.1

Contributors

terriko
Loading

CVE Binary Tool 3.1

19 Apr 23:05
@terriko terriko
v3.1
1231185
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Binary Tool 3.1

CVE Binary Tool 3.1

This release is dedicated to the person who sent me cookies after I was griping about differences in Python 3.7 error handling on Twitter. They were delicious, thank you! Thanks also to the many new contributors who have joined us as part of Google Summer of Code 2022. You can see many new folk had their first commits in this release!

New Features

  • CVE Binary Tool 3.1 adds support for NVD API keys. An NVD API key allows registered users to make a greater number of requests to the API. At this time, the NVD API documentation says, "The public rate limit (without an API key) is 10 requests in a rolling 60 second window; the rate limit with an API key is 100 requests in a rolling 60 second window."
    • cve-bin-tool updates once per day by default to limit connections to NVD, but users in shared environments or running more frequent updates have occasionally seen 403 errors due to exceeded rate limits. Using an API key should alleviate those issues going forwards.
  • New support for scanning Java and JavaScript packages has been added. (Yes, this will now detect log4j packages.) The language-specific packages we support now are Java, JavaScript and Python.
  • A new offline flag (--offline) has been added to disable all network requests for use in isolated environments. A guide for using --offline mode can be found here.
  • New support VEX (Vulnerabity Expolitabity Exchange) files. Files could be generated following a scan and then used as a supported triage file.
  • Extractor support has been extended to include WAR, EAR, pkg and zst files.
  • New checkers: Libsrtp, libseccomp, libebml, libsolv

Changed Features

  • Some users had expressed concern that they would prefer not to install the Reportlab dependency on their systems due to security concerns if the library is mis-used, so we no longer install it by default.
    • Users intending to use PDF export can use pip install cve-bin-tool[PDF] to add reportlab to their install. or pip install reportlab if they decide they want it later.
    • Similarly, users can pip uninstall reportlab at any time and cve-bin-tool will continue to function although without the ability to export PDF files. Users can generate their own using pdf reports using print-to-pdf on an HTML report if needed.
  • Python 3.6 support and testing has been dropped as Python 3.6 has reached end of life. (This may affect some users on CentOS.)

New Contributors

Full Change List

Read more

Contributors

terriko, anthonyharrison, and 13 other contributors
Loading

CVE Binary Tool 3.1rc3

13 Apr 20:03
@terriko terriko
v3.1rc3
4758941
Compare
Choose a tag to compare
CVE Binary Tool 3.1rc3 Pre-release
Pre-release

Full Changelog: v3.1rc2...v3.1rc3

Loading

CVE Binary Tool 3.1rc2

13 Apr 19:27
@terriko terriko
v3.1rc2
830ae7a
Compare
Choose a tag to compare
CVE Binary Tool 3.1rc2 Pre-release
Pre-release

Potentially the final release candidate for CVE Binary Tool 3.1. (Note the change in naming scheme to match the pip upload)

What's Changed

  • fix: add None checks to run_java_checker by @terriko in #1630
  • docs: add link to offline guide, rearrange order by @terriko in #1633
  • test: add test for null byte in filename by @terriko in #1635

Full Changelog: v3.1.pre1...v3.1rc2

Contributors

terriko
Loading

CVE Binary Tool 3.1.pre1

31 Mar 17:57
@terriko terriko
v3.1.pre1
af159c8
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
CVE Binary Tool 3.1.pre1 Pre-release
Pre-release

Second pre-release. This one has all features expected for release and will undergo some additional validation before final release.

What's Changed

New Contributors

Full Changelog: v3.1.pre0...v3.1.pre1

Contributors

terriko, anthonyharrison, and 7 other contributors
Loading