2

In node, I can run npm audit and it will show me known vulnerabilities for the versions my dependencies are using.

That's cool and all, but I'd like to be able to do the following, on some website or program or anything else:

Enter an npm package/python module/other software... and say I've gone from version X to version Y. And then get an output saying:

  • CVEs fixed by upgrading
  • CVEs introduced by upgrading
  • CVEs that remain unfixed for this version

Along with the dates at which the CVE was discovered/fixed and maybe other useful info.

Is that a thing that exists somewhere? Or could I throw together a script and query cve.mitre or some other website? Are there services that provide this?

1

1 Answer 1

1

Your requirements are very specific and I doubt that exactly such a service exists. The cve-search project provides tools that could be utilized to process CVE data locally, which could be used to get close to your goal. The advantage of this is that it is not limited to npm packages or Python modules, but anything in the Common Platform Enumeration (CPE) Dictionary.

You would like to know which vulnerabilities you can fix by updating, e.g., pypdf from 1.27.8 to 3.8.1.

  1. CPE guesser could be used to figure out the correct CPE naming for pypdf.

    $ curl -s -X POST https://cpe-guesser.cve-search.org/search \
    > -d "{\"query\": [\"pypdf\"]}" | jq .
    [
      [
        103575,
        "cpe:2.3:a:pypdf_project:pypdf"
      ]
    ]
    
  2. Putting the version number to the CPE string is pretty straightforward.

    Version CPE
    1.27.8 cpe:2.3:a:pypdf_project:pypdf:1.27.8:*:*:*:*:*:*:*
    2.12.1 cpe:2.3:a:pypdf2_project:pypdf2:2.12.1:*:*:*:*:*:*:* cpe:2.3:a:pypdf_project:pypdf:2.12.1:*:*:*:*:*:*:*
    3.8.1 cpe:2.3:a:pypdf_project:pypdf:3.8.1:*:*:*:*:*:*:*
    • A caveat with this example is that pypdf 2.x & 3.0.y have two CPE names, as versions from 2.0.0 to 3.0.1 were released under a different project. You can compare them with the other versions using pypdf_project:pypdf but not using pypdf2_project:pypdf2.
  3. cve-search could be used to link the CPE string to the CVEs related to it.

    This example refers to the the public CVE services of circl.lu (The Computer Incident Response Center Luxembourg), but the cve-search or its rewrite vulnerability-lookup could be installed to your own environment, too.

    $ APIURL="https://cvepremium.circl.lu/api/cvefor"
    $ curl -s "{$APIURL}/cpe:2.3:a:pypdf_project:pypdf:1.27.8:*:*:*:*:*:*:*" \
    > | jq '.[] | {id: .id, cvss3: .cvss3}'
    {
      "id": "CVE-2023-36464",
      "cvss3": 5.5
    }
    {
      "id": "CVE-2023-36810",
      "cvss3": 6.5
    }
    $ curl -s "{$APIURL}/cpe:2.3:a:pypdf_project:pypdf:3.8.1:*:*:*:*:*:*:*" \
    > | jq '.[] | {id: .id, cvss3: .cvss3}'
    {
      "id": "CVE-2023-36464",
      "cvss3": 5.5
    }
    

    The "other useful info" can be added by modifying the jq command; CVSS 3 as an example.

  4. By comparing the results you can see that the update would fix CVE-2023-36810 but not CVE-2023-36464, which was fixed in 3.9.0.

The phases 1-4 could be combined into a script that best suits your requirements.

2
  • 1
    AFFILIATION DISCLOSURE: I have contributed to both of these tools, but it is a free, open source project. Aug 13, 2023 at 10:55
  • Thanks for this example. I'm surprised this doesn't exist, it sounds like exactly something you'd want to know, especially if you have a product you release to the public. I would imagine thousands of companies had already had a need for what I described.
    – KoenDG
    Aug 16, 2023 at 23:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .