Repository navigation
feat: match the package inventory against public CVE feeds - #29
Merged
Merged
Conversation
vuln.cve-watch closes the gap the two CVE-specific detectors leave: a CVE published tonight is checked on the next refresh without a Stackdog release. Every package on the host and in running containers is matched against OSV, and results are cross-referenced with CISA's KEV catalog. Feed work, all verified against the live APIs while building: - OSV matches Debian and Ubuntu versions server-side (the full deb version, epoch included); Alpine versions must be sent without the -rN package revision, which is what their data carries. querybatch does one request per refresh instead of one per package. - CISA's canonical KEV URL rejects datacenter clients (403), so the cisagov/kev-data mirror is tried first. KEV entries are Critical; everything else carries the advisory's own severity label. - Answers are cached in SQLite for 24h (surviving restarts), and a match is alerted once per owner, package and CVE. The blocking HTTP runs on a blocking thread via a process-wide monitor: reqwest::blocking panics when its runtime is dropped inside an async context, which is how the sniff loop calls this. KEV is fetched only when something matched. Findings are alert-only (vuln.cve-watch joins the never-ban list): a version names no attacker. Alerts say to check the vendor's advisory — distributions backport fixes, and config-dependent CVEs do not survive being flattened into a version range. 50 findings per pass, KEV first. Tests: 477+8+155 pass (7 new: apk revision stripping, os-release to ecosystem mapping, CVE-alias preference, KEV severity, batch alignment, inventory under a root, reported-never-again), plus an opt-in live test against the real OSV API. clippy -D warnings and fmt clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
vuln.cve-watchanswers "what does this exact package version have known CVEs" for every package on the host and in running containers — so a CVE published tonight is checked on the next refresh without a Stackdog release.-rNpackage revision must be stripped (9.7_p1-r6->9.7_p1) — that is what their data carries.querybatchdoes one request per refresh, not one per package. CISA's canonical KEV URL rejects datacenter clients (403), so thecisagov/kev-datamirror is tried first; KEV matches are Critical, everything else carries the advisory's severity label.reqwest::blockingpanics when its runtime is dropped inside an async context — how the sniff loop calls this). KEV is fetched only when something matched.STACKDOG_CVE_WATCH_ENABLED, default on.