[email]
-smtpAddr = "smtp.gmail.com"
-smtpPort = "587"
-user = "username"
-password = "password"
-from = "from@address.com"
-to = ["to@address.com"]
-cc = ["cc@address.com"]
-subjectPrefix = "[vuls]"
+smtpAddr = "smtp.gmail.com"
+smtpPort = "587"
+tlsMode = "STARTTLS"
+tlsInsecureSkipVerify = false
+user = "username"
+password = "password"
+from = "from@address.com"
+to = ["to@address.com"]
+cc = ["cc@address.com"]
+subjectPrefix = "[vuls]"
[email]
-smtpAddr = "smtp.gmail.com"
-smtpPort = "465"
-user = "username"
-password = "password"
-from = "from@address.com"
-to = ["to@address.com"]
-cc = ["cc@address.com"]
-subjectPrefix = "[vuls]"
+smtpAddr = "smtp.gmail.com"
+smtpPort = "465"
+tlsMode = "SMTPS"
+tlsInsecureSkipVerify = false
+user = "username"
+password = "password"
+from = "from@address.com"
+to = ["to@address.com"]
+cc = ["cc@address.com"]
+subjectPrefix = "[vuls]"
If you can't send vuls report via Email, please check your Gmail account setting.
diff --git a/docs/en/supported-os.html b/docs/en/supported-os.html index fe902a59..7866e7d9 100644 --- a/docs/en/supported-os.html +++ b/docs/en/supported-os.html @@ -1,4 +1,4 @@ -システム管理者にとって、脆弱性調査やソフトウェアの更新を日々行うことは重荷である。 本番環境のサービス停止を避けるため、システム管理者がパッケージマネージャの自動更新を使うことを選ばずに手動で更新するケースも多い。 だが、手動更新での運用には以下の問題がある。
-Vulsは上に挙げた手動運用での課題を解決するツールであり、以下の特徴がある。
-
Vuls can detect vulnerabilities in network devices and commercial middleware by defining CPE in config.toml. The OS package scan is done by actually SSH into the server and issuing the command. However, the CPE scan is detected by comparing the versions of the NVD and JVN databases. It does not issue commands on the device and does not access the device via a network.
-
Tutorial: usage-scan-non-os-packages Tutorial: Vulsctl/cpe scan
-
| Distribution | スキャン速度 | root権限 | OVAL | インターネットアクセス |
|---|---|---|---|---|
| Alpine | 速い | 不要 | 対応 | 必要 |
| CentOS | 速い | 必要 | 対応 | 必要 |
| AlmaLinux | 速い | 必要 | 対応 | 必要 |
| Rocky Linux | 速い | 必要 | 対応 | 必要 |
| RHEL | 速い | 必要 | 対応 | 必要 |
| Fedora | 速い | 必要 | 対応 | 必要 |
| Oracle | Fast | Need | Supported | 必要 |
| Ubuntu | Fast | Need | Supported | 必要 |
| Debian | Fast | Need | Supported | 必要 |
| Raspbian | 1st time: Slow, From 2nd time: Fast | Need | Partially Supported | 必要 |
| FreeBSD | Fast | No | No | Need |
| Amazon | Fast | Need | Supported | Need |
| openSUSE | Fast | No | Supported | Need |
| openSUSE Leap | Fast | No | Supported | Need |
| SUSE Enterprise | Fast | No | Supported | Need |
| Windows | Fast | Partially | No | Partially |
| MacOS | Fast | No | No | No |
Raspbian has been modified from its previous Changelog only scan to scan using Debian OVAL and Debian Security Tracker, Changelog. The difference between Fast-Root scan and Deep scan is that the packages that use change logs are limited (because Debian OVAL and Debian Security Tracker cannot detect packages that only exist on the Raspberry Pi). In summary, the behavior of each scan mode in Raspbian is shown in the table below.
-| Scan Mode | fast | fast-root | deep |
|---|---|---|---|
| v0.11 | (deep scan) | (deep scan) | changelog |
| v0.12 |
|
-|
-|
-For more information, see This Pull Request (https://github.com/future-architect/vuls/pull/1019).
-Scan with -offline option, vuls scans with no internet access.
-| Distribution | Scan Speed | Need Root Privilege | OVAL | Need Internet Access |
|---|---|---|---|---|
| Alpine | Fast | No | Supported | No |
| CentOS | Fast | Need | Supported | No |
| AlmaLinux | Fast | Need | Supported | No |
| Rocky Linux | Fast | Need | Supported | No |
| RHEL | Fast | Need | Supported | No |
| Fedora | Fast | Need | Supported | No |
| Oracle | Fast | Need | Supported | No |
| Ubuntu | Fast | Need | Supported | No |
| Debian | Fast | Need | Supported | No |
| Amazon | Fast | Need | Supported | No |
| openSUSE | Fast | No | Supported | No |
| openSUSE Leap | Fast | No | Supported | No |
| SUSE Enterprise | Fast | No | Supported | No |
| Windows | Fast | Partially | No | No |
| MacOS | Fast | No | No | No |
Offline scan mode is not supported FreeBSD, Raspbian.
-In Fast-Root Scan and Deep Scan, Raspbian scans a combination of Debian OVAL and Debian Security Tracker, Changelog, so Offline Scan mode cannot be provided completely. If you execute Offline Scan, you can get the result of Debian OVAL and Debian Security Tracker only (same result as Fast Scan).
-For details, see
-It is possible to know processes affecting software update in advance using yum-ps on RedHat, CentOS, AlmaLinux, Rocky Linux,OracleLinux and Amazon Linux
-Detect processes which updated before but not restarting yet using checkrestart of debian-goodies on Debian and Ubuntu
-Fast Scanモードは、対象サーバにroot権限を必要とせず、依存関係もなく、負荷もほとんどかけずにスキャンします。
-
| Distribution | スキャン スピード | スキャン対象サーバ上のroot権限の要否 | OVAL | スキャン対象サーバのインターネットアクセス要否 |
|---|---|---|---|---|
| Alpine | 速い | 不要 | サポート済 | 必要 |
| CentOS | 速い | 不要 | サポート済 | 必要 |
| AlmaLinux | 速い | 不要 | サポート済 | 必要 |
| Rocky Linux | 速い | 不要 | サポート済 | 必要 |
| RHEL | 速い | 不要 | サポート済 | 必要 |
| Fedora | 速い | 不要 | サポート済 | 必要 |
| Oracle | 速い | 不要 | Supported | 必要 |
| Ubuntu | 速い | 不要 | Supported | 必要 |
| Debian | 速い | 不要 | Supported | Need |
| Raspbian | Fast | No | Partially Supported | Need |
| FreeBSD | Fast | No | No | Need |
| Amazon | Fast | No | Supported | Need |
| openSUSE | Fast | No | Supported | No |
| openSUSE Leap | Fast | No | Supported | No |
| SUSE Enterprise | Fast | No | Supported | No |
| Windows | 速い | Partially | 不要 | Partially |
| MacOS | 速い | 不要 | 不要 | No |
Scan with -offline option, vuls scans with no internet access.
-| Distribution | スキャン速度 | root権限 | OVAL | インターネットアクセス |
|---|---|---|---|---|
| Alpine | Fast | No | サポート済 | No |
| CentOS | Fast | 不要 | サポート済 | No |
| AlmaLinux | 速い | 不要 | サポート済 | 不要 |
| Rocky Linux | 速い | 不要 | サポート済 | 不要 |
| RHEL | 速い | 不要 | サポート済 | 不要 |
| Fedora | 速い | 不要 | サポート済 | 不要 |
| Oracle | 速い | 不要 | Supported | 不要 |
| Ubuntu | 速い | 不要 | Supported | 不要 |
| Debian | Fast | No | Supported | No |
| Raspbian | Fast | No | Partially Supported | No |
| Amazon | Fast | No | Supported | No |
| openSUSE | Fast | No | Supported | No |
| openSUSE Leap | Fast | No | Supported | No |
| SUSE Enterprise | Fast | No | Supported | No |
| Windows | Fast | Partially | Supported | No |
| MacOS | Fast | No | No | No |
The offline scan mode is not supported for FreeBSD.
-For details, see
-もし中央のサーバから各サーバにSSH接続できない環境の場合はローカルスキャンモードでスキャン可能。 Vulsをスキャン対象サーバにデプロイする。 Vulsはローカルホストにコマンドを発行する(SSH経由ではない)。 スキャン結果のJSONを別サーバに集約する。 スキャン結果の詳細化のためにはCVEデータベースへのアクセスが必要なので、事前にgo-cve-dictionaryをserver modeで起動しておく。 その集約サーバ上で、あなたはWebUIやTUIを用いて各スキャン対象サーバのスキャン結果を参照することが可能。
-
スキャン対象サーバにSSH接続可能な1台にのみVulsをセットアップする。
-
Generate a template of the config.toml settings file
$ vuls discover 127.0.0.1/32
-# Create config.toml using below and then ./vuls -config=/path/to/config.toml
-
-
-# https://vuls.io/docs/en/config.toml.html#database-section
-[cveDict]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/cve.sqlite3"
-#url = ""
-
-[ovalDict]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/oval.sqlite3"
-#url = ""
-
-[gost]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/gost.sqlite3"
-#url = ""
-
-[exploit]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/go-exploitdb.sqlite3"
-#url = ""
-
-[metasploit]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/go-msfdb.sqlite3"
-#url = ""
-
-[kevuln]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/go-kev.sqlite3"
-#url = ""
-
-[cti]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/go-cti.sqlite3"
-#url = ""
-
-# https://vuls.io/docs/en/config.toml.html#slack-section
-#[slack]
-#hookURL = "https://hooks.slack.com/services/abc123/defghijklmnopqrstuvwxyz"
-##legacyToken = "xoxp-11111111111-222222222222-3333333333"
-#channel = "#channel-name"
-##channel = "${servername}"
-#iconEmoji = ":ghost:"
-#authUser = "username"
-#notifyUsers = ["@username"]
-
-# https://vuls.io/docs/en/config.toml.html#email-section
-#[email]
-#smtpAddr = "smtp.example.com"
-#smtpPort = "587"
-#user = "username"
-#password = "password"
-#from = "from@example.com"
-#to = ["to@example.com"]
-#cc = ["cc@example.com"]
-#subjectPrefix = "[vuls]"
-
-# https://vuls.io/docs/en/config.toml.html#http-section
-#[http]
-#url = "http://localhost:11234"
-
-# https://vuls.io/docs/en/config.toml.html#syslog-section
-#[syslog]
-#protocol = "tcp"
-#host = "localhost"
-#port = "514"
-#tag = "vuls"
-#facility = "local0"
-#severity = "alert"
-#verbose = false
-
-# https://vuls.io/docs/en/usage-report.html#example-put-results-in-s3-bucket
-#[aws]
-#profile = "default"
-#region = "ap-northeast-1"
-#s3Bucket = "vuls"
-#s3ResultsDir = "/path/to/result"
-#s3ServerSideEncryption = "AES256"
-
-# https://vuls.io/docs/en/usage-report.html#example-put-results-in-azure-blob-storage<Paste>
-#[azure]
-#accountName = "default"
-#accountKey = "xxxxxxxxxxxxxx"
-#containerName = "vuls"
-
-# https://vuls.io/docs/en/config.toml.html#chatwork-section
-#[chatwork]
-#room = "xxxxxxxxxxx"
-#apiToken = "xxxxxxxxxxxxxxxxxx"
-
-# https://vuls.io/docs/en/config.toml.html#telegram-section
-#[telegram]
-#chatID = "xxxxxxxxxxx"
-#token = "xxxxxxxxxxxxxxxxxx"
-
-#[wpscan]
-#token = "xxxxxxxxxxx"
-#detectInactive = false
-
-# https://vuls.io/docs/en/config.toml.html#default-section
-[default]
-#port = "22"
-#user = "username"
-#keyPath = "/home/username/.ssh/id_rsa"
-#scanMode = ["fast", "fast-root", "deep", "offline"]
-#scanModules = ["ospkg", "wordpress", "lockfile", "port"]
-#lockfiles = ["/path/to/package-lock.json"]
-#cpeNames = [
-# "cpe:/a:rubyonrails:ruby_on_rails:4.2.1",
-#]
-#owaspDCXMLPath = "/tmp/dependency-check-report.xml"
-#ignoreCves = ["CVE-2014-6271"]
-#ignorePkgsRegexp = ["^kernel", "^python"]
-#containersOnly = false
-#containerType = "docker" #or "lxd" or "lxc" default: docker
-#containersIncluded = ["${running}"]
-#containersExcluded = ["container_name_a"]
-
-# https://vuls.io/docs/en/config.toml.html#servers-section
-[servers]
-
-[servers.127-0-0-1]
-host = "127.0.0.1"
-#port = "22"
-#user = "root"
-#sshConfigPath = "/home/username/.ssh/config"
-#keyPath = "/home/username/.ssh/id_rsa"
-#scanMode = ["fast", "fast-root", "deep", "offline"]
-#scanModules = ["ospkg", "wordpress", "lockfile", "port"]
-#type = "pseudo"
-#memo = "DB Server"
-#findLock = true
-#findLockDirs = ["/path/to/dir"]
-#lockfiles = ["/path/to/package-lock.json"]
-#cpeNames = [ "cpe:/a:rubyonrails:ruby_on_rails:4.2.1" ]
-#owaspDCXMLPath = "/path/to/dependency-check-report.xml"
-#ignoreCves = ["CVE-2014-0160"]
-#ignorePkgsRegexp = ["^kernel", "^python"]
-#containersOnly = false
-#containerType = "docker" #or "lxd" or "lxc" default: docker
-#containersIncluded = ["${running}"]
-#containersExcluded = ["container_name_a"]
-
-#[servers.127-0-0-1.containers.container_name_a]
-#cpeNames = [ "cpe:/a:rubyonrails:ruby_on_rails:4.2.1" ]
-#owaspDCXMLPath = "/path/to/dependency-check-report.xml"
-#ignoreCves = ["CVE-2014-0160"]
-#ignorePkgsRegexp = ["^kernel", "^python"]
-
-#[servers.127-0-0-1.githubs."owner/repo"]
-#token = "yourToken"
-#IgnoreGithubDismissed = true
-
-
-#[servers.127-0-0-1.wordpress]
-#cmdPath = "/usr/local/bin/wp"
-#osUser = "wordpress"
-#docRoot = "/path/to/DocumentRoot/"
-
-#[servers.127-0-0-1.portscan]
-#scannerBinPath = "/usr/bin/nmap"
-#hasPrivileged = true
-#scanTechniques = ["sS"]
-#sourcePort = "65535"
-
-#[servers.127-0-0-1.windows]
-#serverSelection = 3
-#cabPath = "/path/to/wsusscn2.cab"
-
-#[servers.127-0-0-1.optional]
-#key = "value1"
-[cveDict]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/cve.sqlite3"
-#url = ""
-
-[ovalDict]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/oval.sqlite3"
-#url = ""
-
-[gost]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/gost.sqlite3"
-#url = ""
-
-[exploit]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/go-exploitdb.sqlite3"
-#url = ""
-
-[metasploit]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/go-msfdb.sqlite3"
-#url = ""
-
-[kevuln]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/go-kev.sqlite3"
-#url = ""
-
-[cti]
-#type = ["sqlite3", "mysql", "postgres", "redis", "http" ]
-#sqlite3Path = "/path/to/go-cti.sqlite3"
-#url = ""
-These can also be specified by an environment variable. Refer to the source code for the environment variable names.
- -[slack]
-hookURL = "https://hooks.slack.com/services/abc123/defghijklmnopqrstuvwxyz"
-#legacyToken = "xoxp-11111111111-222222222222-3333333333"
-channel = "#channel-name"
-#channel = "${servername}"
-iconEmoji = ":ghost:"
-authUser = "username"
-notifyUsers = ["@username"]
-hookURL or legacyToken.
-If there are a lot of vulnerabilities, it is better to use legacyToken since the Slack notification will be flooded.
hookURL : Incoming web-hook's URL (hookURL is ignored when legacyToken is set.)
-
legacyToken : slack legacy token
-
channel : channel name.
If you set ${servername} to channel, the report will be sent to each channel.
-In the following example, the report will be sent to the #server1 and #server2.
-Be sure to create these channels before scanning.
[slack]
-channel = "${servername}"
-...snip...
-
-[servers]
-
-[servers.server1]
-host = "172.31.4.82"
-...snip...
-
-[servers.server2]
-host = "172.31.4.83"
-...snip...
-["@foo", "@bar"] to notifyUsers, @foo @bar will be included in text.[http]
-url = "http://localhost:11234"
-[email]
-smtpAddr = "smtp.gmail.com"
-smtpPort = "587"
-user = "username"
-password = "password"
-from = "from@address.com"
-to = ["to@address.com"]
-cc = ["cc@address.com"]
-subjectPrefix = "[vuls]"
-[email]
-smtpAddr = "smtp.gmail.com"
-smtpPort = "465"
-user = "username"
-password = "password"
-from = "from@address.com"
-to = ["to@address.com"]
-cc = ["cc@address.com"]
-subjectPrefix = "[vuls]"
-If you can't send vuls report via Email, please check your Gmail account setting.
-[syslog]
-protocol = "tcp"
-host = "localhost"
-port = "514"
-tag = "vuls"
-facility = "local0"
-severity = "alert"
-verbose = false
-tcp or udp or emptyauth)info)[default]
-#port = "22"
-#user = "username"
-#keyPath = "/home/username/.ssh/id_rsa"
-#lockfiles = ["/path/to/package-lock.json"]
-#cpeNames = [
-# "cpe:/a:rubyonrails:ruby_on_rails:4.2.1",
-#]
-#ignoreCves = ["CVE-2016-6313"]
-#ignorePkgsRegexp = ["^kernel", "^python"]
-#optional = [
-# ["key", "value"],
-#]
-Items of the default section will be used if not specified.
-[servers]
-
-[servers.172-31-4-82]
-host = "172.31.4.82"
-#ignoreIPAddresses = ["127.0.0.2"]
-#jumpServer = ["test@test.com:22", "test@test1.com:2222"]
-#port = "22"
-#user = "root"
-#sshConfigPath = "/home/username/.ssh/config"
-#keyPath = "/home/username/.ssh/id_rsa"
-#type = "pseudo"
-#findLock = true
-#lockfiles = ["/path/to/package-lock.json"]
-#cpeNames = [
-# "cpe:/a:rubyonrails:ruby_on_rails:4.2.1",
-#]
-#ignoreCves = ["CVE-2016-6314"]
-#ignorePkgsRegexp = ["^kernel", "^python"]
-#optional = [
-# ["key", "value"],
-#]
-#[servers.172-31-4-82.containers]
-#type = "lxd" # or "docker" or "lxc"
-#includes = ["${running}"]
-#excludes = ["container_name", "container_id"]
-You can overwrite the default value specified in default section.
-Multiple SSH authentication methods are supported.
-If you need password authentication, see the tips of How to scan with SSH key with passphrase
- -[chatwork]
-room = "xxxxxxxxxxx"
-apiToken = "xxxxxxxxxxxxxxx"
-[googlechat]
-webHookURL = "https://chat.googleapis.com/v1/spaces/xxxxxxxxxx/messages?key=yyyyyyyyyy&token=zzzzzzzzzz%3D"
-skipIfNoCve = false
-serverNameRegexp = "(^(\\[Reboot Required\\] )?(?:(spam|ham)).*|.*(?:egg)$)"
-[Reboot Required] is magic words for vuls inside. Please ignore 😀Posting to a user: here is how to find user's chatID
-[telegram]
-chatID = "xxxxxxxxxxx"
-token = "xxxxxxxxxxxxxxx"
-Posting to a channel:
-[telegram]
-chatID = "@xxxxxxxxxx"
-token = "xxxxxxxxxxxxxxx"
-The following example should work on Fedora based Linux distributions, which include: CentOS, RedHat, Amazon Linux etc (tested on CentOS and Red Hat 7).
-Vulsctl was created to ease setup. Each shell script is a wrapper around Docker commands.
-$ sudo systemctl start docker
-$ git clone https://github.com/vulsio/vulsctl.git
-$ cd vulsctl
-This will take some time ...
-$ cd docker
-$ ./update-all.sh
-Prepare the config.toml in the vulsctl install directory similar to the configuration below.
-[servers]
-[servers.hostos]
-host = "52.10.10.10"
-port = "22"
-user = "centos"
-# if ssh config file exists in .ssh, path to ssh config file in docker
-sshConfigPath = "/root/.ssh/config"
-# keypath in the Vuls docker container
-keyPath = "/root/.ssh/id_rsa"
-When config exists in .ssh, vuls refers to /root/.ssh/config in the docker container when connecting to SSH. However, an error occurs because the local user does not match the user in Docker. To deal with this, specify /root/.ssh/config in sshConfigPath.
The scan.sh will mount $HOME/.ssh from the host operating system into the Docker container, however you will need to SSH into the target server beforehand which will add your fingerprint to $HOME/.ssh/known_hosts.
-` 
$ ssh centos@52.100.100.100 -i ~/.ssh/id_rsa.pem
-$ ./scan.sh
-$ ./report.sh
-$ ./tui.sh
-For details, see
- -$ ./vulsrepo.sh
-$ docker ps
-CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
-39c8830dbeac ishidaco/vulsrepo "vulsrepo-server" 3 seconds ago Up 1 second 0.0.0.0:5111->5111/tcp focused_wu
-Vulsrepo is running on http://host-ip:5111.
It's easier to use vulsctl than to use docker directly.
-This tutorial will let you scan the vulnerabilities on the remote host via SSH with Docker-Vuls.
-Before doing this tutorial, you have to setup vuls with Docker.
-This can be done in the following steps.
-$ cd /path/to/working/dir
-$ mkdir go-cve-dictionary-log goval-dictionary-log gost-log go-exploitdb-log go-msfdb-log
-vulsio/go-cve-dictionary:README
-$ docker run --rm -it \
- -v $PWD:/go-cve-dictionary \
- -v $PWD/go-cve-dictionary-log:/var/log/go-cve-dictionary \
- vuls/go-cve-dictionary fetch nvd
-To fetch JVN(Japanese), See README
-$ docker run --rm -it \
- -v $PWD:/goval-dictionary \
- -v $PWD/goval-dictionary-log:/var/log/goval-dictionary \
- vuls/goval-dictionary fetch redhat 5 6 7 8 9
-To fetch other OVAL, See README
-$ docker run --rm -i \
- -v $PWD:/gost \
- -v $PWD/gost-log:/var/log/gost \
- vuls/gost fetch redhat
-To fetch Debian security tracker, See Gost README
-$ docker run --rm -i \
- -v $PWD:/go-exploitdb \
- -v $PWD/go-exploitdb-log:/var/log/go-exploitdb \
- vuls/go-exploitdb fetch exploitdb
-$ docker run --rm -i \
- -v $PWD:/go-exploitdb \
- -v $PWD/go-exploitdb-log:/var/log/go-exploitdb \
- vuls/go-exploitdb fetch awesomepoc
-$ docker run --rm -i \
- -v $PWD:/go-exploitdb \
- -v $PWD/go-exploitdb-log:/var/log/go-exploitdb \
- vuls/go-exploitdb fetch githubrepos
-$ docker run --rm -i \
- -v $PWD:/go-exploitdb \
- -v $PWD/go-exploitdb-log:/var/log/go-exploitdb \
- vuls/go-exploitdb fetch inthewild
-$ docker run --rm -i \
- -v $PWD:/go-msfdb \
- -v $PWD/go-msfdb-log:/var/log/go-msfdb \
- vuls/go-msfdb fetch msfdb
-$ docker run --rm -i \
- -v $PWD:/go-kev \
- -v $PWD/go-kev-log:/var/log/go-kev \
- vuls/go-kev fetch kevuln
-$ docker run --rm -i \
- -v $PWD:/go-cti \
- -v $PWD/go-cti-log:/var/log/go-cti \
- vuls/go-cti fetch threat
-Create config.toml referring to this.
-[servers]
-
-[servers.c74]
-host = "54.249.93.16"
-port = "22"
-user = "vuls-user"
-# if ssh config file exists in .ssh, path to ssh config file in docker
-sshConfigPath = "/root/.ssh/config"
-# path to ssh private key in docker
-keyPath = "/root/.ssh/id_rsa"
-$ docker run --rm -it\
- -v ~/.ssh:/root/.ssh:ro \
- -v $PWD:/vuls \
- -v $PWD/vuls-log:/var/log/vuls \
- vuls/vuls configtest \
- -config=./config.toml # path to config.toml in docker
-$ docker run --rm -it \
- -v ~/.ssh:/root/.ssh:ro \
- -v $PWD:/vuls \
- -v $PWD/vuls-log:/var/log/vuls \
- -v /etc/localtime:/etc/localtime:ro \
- -e "TZ=Asia/Tokyo" \
- vuls/vuls scan \
- -config=./config.toml # path to config.toml in docker
-If Docker Host is Debian or Ubuntu
-$ docker run --rm -it \
- -v ~/.ssh:/root/.ssh:ro \
- -v $PWD:/vuls \
- -v $PWD/vuls-log:/var/log/vuls \
- -v /etc/localtime:/etc/localtime:ro \
- -v /etc/timezone:/etc/timezone:ro \
- vuls/vuls scan \
- -config=./config.toml # path to config.toml in docker
-config.toml
-[cveDict]
-type = "sqlite3"
-SQLite3Path = "/path/to/cve.sqlite3"
-
-[ovalDict]
-type = "sqlite3"
-SQLite3Path = "/path/to/oval.sqlite3"
-
-[gost]
-type = "sqlite3"
-SQLite3Path = "/path/to/gost.sqlite3"
-
-[exploit]
-type = "sqlite3"
-SQLite3Path = "/path/to/go-exploitdb.sqlite3"
-
-[metasploit]
-type = "sqlite3"
-SQLite3Path = "/path/to/db/go-msfdb.sqlite3"
-
-[kevuln]
-type = "sqlite3"
-SQLite3Path = "/path/to/db/go-kev.sqlite3"
-
-[cti]
-type = "sqlite3"
-SQLite3Path = "/path/to/db/go-cti.sqlite3"
-$ docker run --rm -it \
- -v ~/.ssh:/root/.ssh:ro \
- -v $PWD:/vuls \
- -v $PWD/vuls-log:/var/log/vuls \
- -v /etc/localtime:/etc/localtime:ro \
- vuls/vuls report \
- -format-list \
- -config=./config.toml # path to config.toml in docker
-Use TUI(Terminal-Based User Interface) to display the scan result.
-$ docker run --rm -it \
- -v ~/.ssh:/root/.ssh:ro \
- -v $PWD:/vuls \
- -v $PWD/vuls-log:/var/log/vuls \
- -v /etc/localtime:/etc/localtime:ro \
- vuls/vuls tui \
- -config=./config.toml # path to config.toml in docker
-
$docker run -dt \
- -v $PWD:/vuls \
- -p 5111:5111 \
- ishidaco/vulsrepo
-Run containers as below if you want to use go-cve-dictionary, goval-dictionary and gost as a server mode.
-$ docker run -dt \
- --name go-cve-dictionary \
- -v $PWD:/go-cve-dictionary \
- -v $PWD/go-cve-dictionary-log:/var/log/go-cve-dictionary \
- --expose 1323 \
- -p 1323:1323 \
- vuls/go-cve-dictionary server --bind=0.0.0.0
-$ docker run -dt \
- --name goval-dictionary \
- -v $PWD:/goval-dictionary \
- -v $PWD/goval-dictionary-log:/var/log/goval-dictionary \
- --expose 1324 \
- -p 1324:1324 \
- vuls/goval-dictionary server --bind=0.0.0.0
-$ docker run -dt \
- --name gost \
- -v $PWD:/gost \
- -v $PWD/gost-log:/var/log/gost \
- --expose 1325 \
- -p 1325:1325 \
- vuls/gost server --bind=0.0.0.0
-$ docker run -dt \
- --name go-exploitdb \
- -v $PWD:/go-exploitdb \
- -v $PWD/go-exploitdb-log:/var/log/go-exploitdb \
- --expose 1326 \
- -p 1326:1326 \
- vuls/go-exploitdb server --bind=0.0.0.0
-$ docker run -dt \
- --name go-msfdb \
- -v $PWD:/go-msfdb \
- -v $PWD/go-msfdb-log:/var/log/go-msfdb \
- --expose 1327 \
- -p 1327:1327 \
- vuls/go-msfdb server --bind=0.0.0.0
-$ docker run -dt \
- --name go-kev \
- -v $PWD:/go-kev \
- -v $PWD/go-kev-log:/var/log/go-kev \
- --expose 1328 \
- -p 1328:1328 \
- vuls/go-kev server --bind=0.0.0.0
-$ docker run -dt \
- --name go-cti \
- -v $PWD:/go-cti \
- -v $PWD/go-cti-log:/var/log/go-cti \
- --expose 1329 \
- -p 1329:1329 \
- vuls/go-cti server --bind=0.0.0.0
-[cveDict]
-type = "http"
-url = "http://hostname:1323"
-
-[ovalDict]
-type = "http"
-url = "http://hostname:1324"
-
-[gost]
-type = "http"
-url = "http://hostname:1325"
-
-[exploit]
-type = "http"
-url = "http://hostname:1326"
-
-[metasploit]
-type = "http"
-url = "http://hostname:1327"
-
-[kevuln]
-type = "http"
-url = "http://hostname:1328"
-$ docker run --rm -it \
- -v ~/.ssh:/root/.ssh:ro \
- -v $PWD:/vuls \
- -v $PWD/vuls-log:/var/log/vuls \
- vuls/vuls report \
- -config=./config.toml
-If you get below error message while fetching, define sql_mode.
Error 1292: Incorrect datetime value: '0000-00-00' for column 'issued' at row 1
-see the issue
-$ docker run --name mysql -p 3306:3306 -e MYSQL_ROOT_PASSWORD=chHUIDCUAUaidfhasuadasuda -d mysql:8 --sql-mode="" --default-authentication-plugin=mysql_native_password
-4e4440bbbcb556cf949c2ffcda15afe6ee7139752c08de8b1e4def47adde24ea
-
-$ docker exec -it mysql bash
-root@4e4440bbbcb5:/# mysql -uroot -h127.0.0.1 -pchHUIDCUAUaidfhasuadasuda
-mysql: [Warning] Using a password on the command line interface can be insecure.
-Welcome to the MySQL monitor. Commands end with ; or \g.
-Your MySQL connection id is 8
-Server version: 8.0.12 MySQL Community Server - GPL
-
-Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
-
-Oracle is a registered trademark of Oracle Corporation and/or its
-affiliates. Other names may be trademarks of their respective
-owners.
-
-Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
-
-mysql> select @@GLOBAL.sql_mode;
-+-------------------+
-| @@GLOBAL.sql_mode |
-+-------------------+
-| |
-+-------------------+
-1 row in set (0.00 sec)
-
-mysql> create database oval;
-Query OK, 1 row affected (0.08 sec)
-
-mysql> exit
-Bye
-root@4e4440bbbcb5:/# exit
-exit
-
-bash-3.2$ go build && ./goval-dictionary fetch ubuntu -dbtype mysql -dbpath "root:chHUIDCUAUaidfhasuadasuda@(127.0.0.1:3306)/oval?parseTime=true" 18
-INFO[08-21|21:41:58] Fetching... URL=https://people.canonical.com/~ubuntu-security/oval/com.ubuntu.bionic.cve.oval.xml
-
-
-INFO[08-21|21:47:56] Fetched... URL=https://people.canonical.com/~ubuntu-security/oval/com.ubuntu.bionic.cve.oval.xml
-INFO[08-21|21:47:56] Finished fetching OVAL definitions
-INFO[08-21|21:47:56] Fetched URL=https://people.canonical.com/~ubuntu-security/oval/com.ubuntu.bionic.cve.oval.xml OVAL definitions=6319
-INFO[08-21|21:47:56] Refreshing... Family=ubuntu Version=18
-
-
-bash-3.2$ go build && ./goval-dictionary fetch debian -dbtype mysql -dbpath "root:chHUIDCUAUaidfhasuadasuda@(127.0.0.1:3306)/oval?parseTime=true" 9
-INFO[08-21|21:49:43] Fetching... URL=https://www.debian.org/security/oval/oval-definitions-stretch.xml
-INFO[08-21|21:50:14] Fetched... URL=https://www.debian.org/security/oval/oval-definitions-stretch.xml
-INFO[08-21|21:50:14] Finished fetching OVAL definitions
-INFO[08-21|21:50:16] Fetched URL=https://www.debian.org/security/oval/oval-definitions-stretch.xml OVAL definitions=17946
-INFO[08-21|21:50:16] Refreshing... Family=debian Version=9
-このチュートリアルでは、Vulsを用いてローカルホストの脆弱性をスキャンする方法を学びます。 手順は以下の通りです。
-今回は説明のために、脆弱性を含む古いAMIを使う
EC2作成時に自動アップデートされるとVulsスキャン結果が0件になってしまうので、cloud-initに以下を指定してEC2を作成する。
-Q: どうやったら重大で重要なセキュリティアップデートが初回起動時に自動でインストールされてしまうのを防げますか？
-#cloud-config
-repo_upgrade: none
-There are several ways to set up Vuls.
-An easy one is vulsctl/install-host. It can be tedious, but you can also do set up manually instead of vulsctl.
-Create a config file(TOML format).
-$ cd $HOME
-$ cat config.toml
-[servers]
-
-[servers.localhost]
-host = "localhost"
-port = "local"
-$ vuls configtest
-$ vuls scan
-
-... snip ...
-
-One Line Summary
-================
-localhost centos7.3.1611 31 updatable packages
-
-View one-line summary
-$ vuls report -format-one-line-text
-
-One Line Summary
-================
-localhost Total: 109 (High:35 Medium:55 Low:16 ?:3) 31 updatable packages
-
-View short summary
-$ vuls report -format-list
-
-localhost (centos7.3.1611)
-==========================
-Total: 109 (High:35 Medium:55 Low:16 ?:3) 31 updatable packages
-
-CVE-2015-2806 10.0 HIGH (nvd)
- Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows
- remote attackers to have unspecified impact via unknown vectors.
- ---
- https://nvd.nist.gov/vuln/detail/CVE-2015-2806
- https://access.redhat.com/security/cve/CVE-2015-2806 (RHEL-CVE)
- 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C (nvd)
- 2.6/AV:N/AC:H/Au:N/C:N/I:N/A:P (redhat)
- https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2015-2806
- 3.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (redhat)
- https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2015-2806
- Confidence: 100 / OvalMatch
-
-... snip ...
-View full report.
-$ vuls report -format-full-text | less
-localhost (centos7.3.1611)
-==========================
-Total: 109 (High:35 Medium:55 Low:16 ?:3) 31 updatable packages
-
-CVE-2015-2806
-----------------
-Max Score 10.0 HIGH (nvd)
-nvd 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
-redhat 2.6/AV:N/AC:H/Au:N/C:N/I:N/A:P
-redhat 3.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
-CVSSv2 Calc https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2015-2806
-CVSSv3 Calc https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2015-2806
-Summary Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows
- remote attackers to have unspecified impact via unknown vectors.
-Source https://nvd.nist.gov/vuln/detail/CVE-2015-2806
-RHEL-CVE https://access.redhat.com/security/cve/CVE-2015-2806
-CWE-119 (nvd) https://cwe.mitre.org/data/definitions/119.html
-Package/CPE libtasn1-3.8-3.el7 -
-Confidence 100 / OvalMatch
-
-... snip ...
-View Japanese
-$ vuls report -format-list -lang ja | less
-localhost (centos7.3.1611)
-==========================
-Total: 109 (High:35 Medium:55 Low:16 ?:3) 31 updatable packages
-
-CVE-2017-12188 7.6 IMPORTANT (redhat)
- Linux Kernel におけるパストラバーサルの脆弱性
- Linux Kernel には、パストラバーサルの脆弱性が存在します。
- ---
- https://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-009311.html
- https://access.redhat.com/security/cve/CVE-2017-12188 (RHEL-CVE)
- 6.9/AV:L/AC:M/Au:N/C:C/I:C/A:C (nvd)
- 6.5/AV:A/AC:H/Au:S/C:C/I:C/A:C (redhat)
- 6.9/AV:L/AC:M/Au:N/C:C/I:C/A:C (jvn)
- https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2017-12188
- 7.6/CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H (redhat)
- https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2017-12188
- Confidence: 100 / OvalMatch
-
-... snip ...
-Vuls has Terminal-Based User Interface to display the scan result.
-$ vuls tui
-
Check it out the Online Demo.
-Installation refer to VulsRepo
-Vuls is an agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices.
-This tutorial explains how to perform a vulnerability scan using Vulsctl, an easy setup tool for Vuls.
-Vuls provides a Docker image on DockerHub. This tutorial is a tutorial on scanning with the official Vuls image; the official Docker Hub repository is here.
-Prepare one Linux machine for the Vuls setup. Any major Linux will work.
-The following spec is recommended.
-In this tutorial, we will use CentOS 7 as an example.
-Install git by connecting to it via SSH.
-$ sudo yum install git
-Next, install Docker and configure it so that you can run the docker command without root privileges.
-Clone vulsio/vulsctl, which is full of useful scripts. You can clone it anywhere, but this time you will clone it to $HOME/vulsctl
$ cd
-$ git clone https://github.com/vulsio/vulsctl.git
-Cloning into 'vuls-vulsctl'...
-remote: Enumerating objects: 14, done.
-remote: Counting objects: 100% (14/14), done.
-remote: Compressing objects: 100% (12/12), done.
-remote: Total 14 (delta 4), reused 12 (delta 2), pack-reused 0
-Unpacking objects: 100% (14/14), done.
-If you have previously set up vulsctl, update it to the latest version.
-$ cd vulsctl
-$ git pull
-The rest of the operations are done in the vulsctl/docker.
-$ cd docker
-$ pwd
-/home/vuls/vulsctl/docker
-To scan from the Vuls Docker container via SSH to the host OS, you need to configure SSH.
-Vuls remote scan mode only supports SSH public key authentication. Create a key pair and SSH to the server to be scanned beforehand. To register the fingerprint of the server to be scanned in $HOME/.ssh/known_hosts. This time, create a key with no password. Make sure you can SSH without a password prompt. If you see the password prompt, you can't scan, so you need to review your SSH settings and configure your SSH to use public key authentication with no password. If you need to use a key with password, see the tips of Scan in Docker container
$ ssh-keygen -q -f ~/.ssh/id_rsa -N ""
-$ cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
-$ chmod 600 ~/.ssh/*
-$ ssh vuls@192.168.56.3
-$ exit
-Next, you need to prepare a configuration file.
-Vuls uses the TOML configuration file, config.toml, to configure the server to be scanned, and so on. A template for remote scanning can be found in here. You can define multiple servers to scan in config.toml. In this case, only one server is defined. In config.toml, you can set up the information needed to SSH to the server you want to scan.
For details of config.toml, please refer to Manual.
-$ pwd
-/home/vuls/vulsctl/docker
-$ cat config.toml
-[servers]
-[servers.host]
-host = "192.168.56.3"
-port = "22"
-user = "vuls"
-keyPath = "/root/.ssh/id_rsa"
-Note that this tutorial is a Docker-based setup, so be careful with the keyPath in config.toml. The keyPath is not the path in Host OS, but the path in the Docker container. In vulsctl/scan.sh, we have mounted it as -v $HOME/.ssh:/root/.ssh:ro, so the The path in the container, /root/.ssh/ir_rsa.
Now, let's run the scan using the configuration file we prepared earlier.
-vulsctl/scan.sh is a script to scan based on the information set in config.toml. The scan results will be stored in JSON format under $PWD/results and will be used when reporting. You can specify the server to be scanned by the command line arguments. Since host is specified as command-line args, the server [servers.host] defined in config.toml will be scanned.
Vuls uses the SSH information defined in config.toml to SSH to the server to be scanned and issue commands on it. There are several scanning modes, but in this case, the default fast scan mode will be used as we haven't specified anything in config.toml.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./scan.sh host
-[Sep 12 07:08:38] INFO [localhost] Validating config...
-[Sep 12 07:08:38] INFO [localhost] Detecting Server/Container OS...
-[Sep 12 07:08:38] INFO [localhost] Detecting OS of servers...
-[Sep 12 07:08:39] INFO [localhost] (1/1) Detected: hostos: centos 7.6.1810
-[Sep 12 07:08:39] INFO [localhost] Detecting OS of static containers...
-[Sep 12 07:08:39] INFO [localhost] Detecting OS of containers...
-[Sep 12 07:08:39] INFO [localhost] Checking Scan Modes...
-[Sep 12 07:08:39] INFO [localhost] Checking dependencies...
-[Sep 12 07:08:39] INFO [hostos] Dependencies ... Pass
-[Sep 12 07:08:39] INFO [localhost] Checking sudo settings...
-[Sep 12 07:08:39] INFO [hostos] Sudo... Pass
-[Sep 12 07:08:39] INFO [localhost] It can be scanned with fast scan mode even if warn or err messages are displayed due to lack of dependent packages or sudo settings in fast-root or deep scan mode
-[Sep 12 07:08:39] INFO [localhost] Scannable servers are below...
-host
-[Sep 12 07:08:39] INFO [localhost] Start scanning
-[Sep 12 07:08:39] INFO [localhost] config: /vuls/config.toml
-[Sep 12 07:08:39] INFO [localhost] Validating config...
-[Sep 12 07:08:39] INFO [localhost] Detecting Server/Container OS...
-[Sep 12 07:08:39] INFO [localhost] Detecting OS of servers...
-[Sep 12 07:08:40] INFO [localhost] (1/1) Detected: host: centos 7.6.1810
-[Sep 12 07:08:40] INFO [localhost] Detecting OS of static containers...
-[Sep 12 07:08:40] INFO [localhost] Detecting OS of containers...
-[Sep 12 07:08:40] INFO [localhost] Checking Scan Modes...
-[Sep 12 07:08:40] INFO [localhost] Detecting Platforms...
-[Sep 12 07:08:40] INFO [localhost] (1/1) host is running on aws
-[Sep 12 07:08:40] INFO [localhost] Detecting IPS identifiers...
-[Sep 12 07:08:40] INFO [localhost] (1/1) host has 0 IPS integration
-[Sep 12 07:08:40] INFO [localhost] Scanning vulnerabilities...
-[Sep 12 07:08:40] INFO [localhost] Scanning vulnerable OS packages...
-[Sep 12 07:08:40] INFO [host] Scanning in fast mode
-
-
-One Line Summary
-================
-host centos7.6.1810 359 installed, 63 updatable
-Next, fetch the vulnerability DB in the OVAL format provided by Linux distributors.
-As we have scanned CentOS this time, we will fetch it with --redhat; for other distributions such as Ubuntu, you can fetch it with the corresponding option. For more information about options, please refer to the following page.
--For reference: If you target a Debian based distribution, OVAL will be skipped when generating a report.
-
You can use the command$ ./gost.sh --debianinstead to have a working DB for the report.sh script.
$ pwd
-/home/vuls/vulsctl/docker
-$ ./oval.sh --redhat
-INFO[09-12|06:28:12] Fetching... URL=https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL6.xml.bz2
-INFO[09-12|06:28:12] Fetching... URL=https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2
-INFO[09-12|06:28:12] Fetching... URL=https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2
-INFO[09-12|06:28:13] Fetched... URL=https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2
-INFO[09-12|06:28:13] Fetched... URL=https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL6.xml.bz2
-INFO[09-12|06:28:13] Fetched... URL=https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2
-INFO[09-12|06:28:13] Finished fetching OVAL definitions
-INFO[09-12|06:28:13] Fetched URL=https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2 OVAL definitions=60
-INFO[09-12|06:28:13] Refreshing... Family=redhat Version=8
-INFO[09-12|06:28:14] Fetched URL=https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL6.xml.bz2 OVAL definitions=1130
-INFO[09-12|06:28:14] Refreshing... Family=redhat Version=6
-INFO[09-12|06:28:16] Fetched URL=https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 OVAL definitions=887
-INFO[09-12|06:28:16] Refreshing... Family=redhat Version=7
-$ ls oval.sqlite3
-oval.sqlite3
-$ ls -alh oval.sqlite3
--rw-r--r--. 1 root root 11M Sep 12 06:28 oval.sqlite3
-Now that the vulnerability DB is ready. Run the report.
-Use vulsctl/report.sh to display the results. Identify potential CVE-IDs in the server to be scanned using the information in the JSON created by scan.sh and the OVAL provided by Red Hat, which we fetched earlier. See documentation for details.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./report.sh
-[Sep 12 07:12:10] INFO [localhost] Validating config...
-[Sep 12 07:12:10] INFO [localhost] Loaded: /vuls/results/2019-09-12T07:08:40Z
-[Sep 12 07:12:10] INFO [localhost] Validating db config...
-INFO[0000] -cvedb-type: sqlite3, -cvedb-url: , -cvedb-path: /vuls/cve.sqlite3
-INFO[0000] -ovaldb-type: sqlite3, -ovaldb-url: , -ovaldb-path: /vuls/oval.sqlite3
-INFO[0000] -gostdb-type: sqlite3, -gostdb-url: , -gostdb-path: /vuls/gost.sqlite3
-INFO[0000] -exploitdb-type: sqlite3, -exploitdb-url: , -exploitdb-path: /vuls/go-exploitdb.sqlite3
-[Sep 12 07:12:10] WARN [localhost] --cvedb-path=/vuls/cve.sqlite3 file not found. [CPE-scan](https://vuls.io/docs/en/usage-scan-non-os-packages.html#cpe-scan) needs cve-dictionary. if you specify cpe in config.toml, fetch cve-dictionary before reporting. For details, see `https://github.com/vulsio/go-cve-dictionary#deploy-go-cve-dictionary`
-[Sep 12 07:12:10] WARN [localhost] --gostdb-path=/vuls/gost.sqlite3 file not found. Vuls can detect `patch-not-released-CVE-ID` using gost if the scan target server is Debian, RHEL or CentOS, For details, see `https://github.com/vulsio/gost#fetch- f`
-[Sep 12 07:12:10] WARN [localhost] --exploitdb-path=/vuls/go-exploitdb.sqlite3 file not found. Fetch go-exploit-db before reporting if you want to display exploit codes of detected CVE-IDs. For details, see `https://github.com/vulsio/go-exploitdb`
-[Sep 12 07:12:10] INFO [localhost] host: 0 CVEs are detected with Library
-[Sep 12 07:12:10] INFO [localhost] OVAL is fresh: redhat 7.6.1810
-[Sep 12 07:12:12] INFO [localhost] host: 111 CVEs are detected with OVAL
-[Sep 12 07:12:12] INFO [localhost] host: 0 CVEs are detected with CPE
-[Sep 12 07:12:12] INFO [localhost] host: 0 CVEs are detected with GitHub Security Alerts
-[Sep 12 07:12:12] INFO [localhost] host: 0 unfixed CVEs are detected with gost
-[Sep 12 07:12:12] INFO [localhost] Fill CVE detailed information with CVE-DB
-[Sep 12 07:12:12] INFO [localhost] Fill exploit information with Exploit-DB
-[Sep 12 07:12:12] INFO [localhost] host: 0 exploits are detected
-host (centos7.6.1810)
-=======================
-Total: 111 (High:57 Medium:39 Low:15 ?:0), 35/111 Fixed, 359 installed, 63 updatable, 0 exploits, en: 0, ja: 0 alerts
-
-+------------------+------+--------+-----+------+---------+---------------------------------------------------+
-| CVE-ID | CVSS | ATTACK | POC | CERT | FIXED | NVD |
-+------------------+------+--------+-----+------+---------+---------------------------------------------------+
-| CVE-2019-10160 | 9.8 | AV:N | | | fixed | https://nvd.nist.gov/vuln/detail/CVE-2019-10160 |
-| CVE-2019-9636 | 9.8 | AV:N | | | fixed | https://nvd.nist.gov/vuln/detail/CVE-2019-9636 |
-| CVE-2016-10745 | 9.0 | AV:N | | | fixed | https://nvd.nist.gov/vuln/detail/CVE-2016-10745 |
-| CVE-2019-11085 | 8.8 | AV:L | | | fixed | https://nvd.nist.gov/vuln/detail/CVE-2019-11085 |
-| CVE-2018-5743 | 8.6 | AV:N | | | fixed | https://nvd.nist.gov/vuln/detail/CVE-2018-5743 |
-| CVE-2018-1000876 | 7.8 | AV:L | | | unfixed | https://nvd.nist.gov/vuln/detail/CVE-2018-1000876 |
-| CVE-2018-18281 | 7.8 | AV:L | | | unfixed | https://nvd.nist.gov/vuln/detail/CVE-2018-18281 |
-| CVE-2019-11811 | 7.8 | AV:L | | | fixed | https://nvd.nist.gov/vuln/detail/CVE-2019-11811 |
-| CVE-2019-6974 | 7.8 | AV:L | | | fixed | https://nvd.nist.gov/vuln/detail/CVE-2019-6974 |
-| CVE-2018-14618 | 7.5 | AV:N | | | fixed | https://nvd.nist.gov/vuln/detail/CVE-2018-14618 |
-| CVE-2018-16871 | 7.5 | AV:N | | | fixed | https://nvd.nist.gov/vuln/detail/CVE-2018-16871 |
-| CVE-2019-11477 | 7.5 | AV:N | | | fixed | https://nvd.nist.gov/vuln/detail/CVE-2019-11477 |
-| CVE-2019-3855 | 7.5 | AV:N | | | fixed | https://nvd.nist.gov/vuln/detail/CVE-2019-3855 |
-...snip
-Vuls has a terminal-based viewer that allows you to view the results in the terminal. Let's try it out here.
-Use vulsctl/tui.sh to view the results in the console. Tab to move the pane, arrow or jk to move it, and Ctrl-C to exit.
-See documentation for details.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./tui.sh --cvss-over=7
-
Vuls can easily scan for vulnerabilities on any SSH-enabled remote Linux/FreeBSD.
-Prepare a Ubuntu server and set up an SSH public key authentication and run SSH once before the scan.
-Next, add the SSH information of the Ubuntu server to the configuration file for the scan.
-$ pwd
-/home/vuls/vulsctl/docker
-$ cat config.toml
-[servers]
-[servers.ubuntu]
-host = "192.168.56.4"
-port = "22"
-user = "vuls"
-keyPath = "/root/.ssh/id_rsa"
-Perform a scan.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./scan.sh ubuntu
-The report requires an additional Vulnerability DB for Ubuntu (OVAL).
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./oval.sh --ubuntu
-$ ./report.sh
-$ ./tui.sh
-If you scan other Linux distributions, please prepare a corresponding OVAL in advance as well. Please refer to the documentation for details.
- -There are a number of vulnerabilities for which CVE-IDs have been issued, but no update package is available(henceforth referred to as not-fixed-yet vulnerability), and Vuls can also detect not-fixed-yet vulnerability.
To detect these vulnerabilities, you need an additional vulnerability database. Use the following command to obtain the vulnerability DB using vulsio/gost.
-gost only supports Red Hat, CentOS, and Debian. For other OS, fetching gost's DB does not affect the detection accuracy. However, it is recommended to fetch gost to add CVSS and Summary information, because Red Hat CVE information is rich and useful.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./gost.sh --redhat
-Using default tag: latest
-latest: Pulling from vuls/gost
-5d20c808ce19: Already exists
-c0f752a1fc26: Pull complete
-919f8990415c: Pull complete
-Digest: sha256:679a4306d67e0b0992fd43b46c4a2fe4d27a51a1e2d9394e19471c5df02c399c
-Status: Downloaded newer image for vuls/gost:latest
-docker.io/vuls/gost:latest
-INFO[09-12|15:00:33] Initialize Database
-2019-09-12T15:00:33.903Z DEBUG db path: db/trivy.db
-2019-09-12T15:00:33.929Z DEBUG remove an existed directory
-INFO[09-12|15:02:13] Opening DB. db=sqlite3
-INFO[09-12|15:02:13] Migrating DB. db=sqlite3
-INFO[09-12|15:02:13] Insert RedHat into DB db=sqlite3
- 0 / 20000 [------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 0.00%INFO[09-12|15:02:13] Insert 20000 CVEs
- 20000 / 20000 [===============================================================================================================================================================] 100.00% 2m2s
-In my environment, it took about 10 minutes.
-The number of vulnerability detections has increased. Vulnerabilities that not-fixed-yet vulnerability is shown as "Unfixed".
Reports can show whether Exploit for detected CVE-IDs is in Metasploit Framework. A CVE with an attack module is considered to be easily attackable by the tool, so the risk is higher than a CVE without an attack module.
-Fetch go-msfdb.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./msfdb.sh
-Using default tag: latest
-latest: Pulling from vuls/go-msfdb
-cbdbe7a5bc2a: Pull complete
-936c30013c05: Pull complete
-dabcf4a113d0: Pull complete
-Digest: sha256:124027eec3f5157447102dafaaae638037d3587936ed5f68055c822e8acc8f02
-Status: Downloaded newer image for vuls/go-msfdb:latest
-docker.io/vuls/go-msfdb:latest
-INFO[08-29|08:03:48] Opening DB db=sqlite3
-INFO[08-29|08:03:48] Init DB db=sqlite3
-INFO[08-29|08:03:48] Migrating DB db=sqlite3
-INFO[08-29|08:03:48] Fetching vulsio/msfdb-list
-INFO[08-29|08:03:48] git clone repo=/root/.cache/go-msfdb/msfdb-list
-Cloning into '/root/.cache/go-msfdb/msfdb-list'...
-remote: Enumerating objects: 1835, done.
-remote: Counting objects: 100% (1835/1835), done.
-remote: Compressing objects: 100% (1834/1834), done.
-remote: Total 1835 (delta 26), reused 128 (delta 0), pack-reused 0
-Receiving objects: 100% (1835/1835), 945.52 KiB | 1.17 MiB/s, done.
-Resolving deltas: 100% (26/26), done.
-INFO[08-29|08:03:51] Updated files count=1978
-INFO[08-29|08:03:51] Metasploit-Framework modules count=2216
-INFO[08-29|08:03:51] Insert info into go-msfdb. db=sqlite3
-INFO[08-29|08:03:51] Inserting Modules having CVEs...
-2216 / 2216 [-----------------------------------------------------------------------------------------------------------------------------] 100.00% 1979 p/s
-INFO[08-29|08:03:53] CveID Metasploit Count count=2216
-It took about 5 seconds in my environment.
-Scan again, and the report will show you the information for the Metasploit module.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./scan.sh
-$ ./tui.sh
-
The Exploit Database has collected over 43,000 PoCs.
-Vuls can show if a PoC exists for each CVE-ID detected by Vuls, which means that vulnerabilities with a PoC are riskier than those without. However, it is unclear whether the PoC detected is a works fine or not, so it needs to be verified by the user.
-Fetch go-exploitdb.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./exploitdb.sh
-Using default tag: latest
-latest: Pulling from vuls/go-exploitdb
-36ccefbf3d8a: Already exists
-84ce22b2ba2c: Pull complete
-b1b2d52f4b6e: Pull complete
-4f4fb700ef54: Pull complete
-Digest: sha256:90c7d3a7c5fc6636a024c1eb33bb23f856e1d170d6c4f6ed11e6d619f1ea6f7e
-Status: Downloaded newer image for vuls/go-exploitdb:latest
-docker.io/vuls/go-exploitdb:latest
-go-exploitdb
-INFO[03-24|23:31:07] Fetching Offensive Security Exploit
-INFO[03-24|23:31:07] Fetching URL=https://cve.mitre.org/data/downloads/allitems-cvrf.xml
-INFO[03-24|23:32:07] Fetching URL=https://raw.githubusercontent.com/offensive-security/exploitdb/master/files_shellcodes.csv
-INFO[03-24|23:32:07] Fetching URL=https://raw.githubusercontent.com/offensive-security/exploitdb/master/files_exploits.csv
-INFO[03-24|23:32:08] Fetching URL=https://raw.githubusercontent.com/offensive-security/exploitdb-papers/master/files_papers.csv
-INFO[03-24|23:32:08] Offensive Security Exploit count=49153
-INFO[03-24|23:32:08] Insert Exploit into go-exploitdb. db=sqlite3
-INFO[03-24|23:32:08] Inserting 49153 Exploits
-INFO[03-24|23:32:08] Inserting new Exploits
-49153 / 49153 [---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 41581 p/s
-INFO[03-24|23:32:10] No CveID Exploit Count count=36406
-INFO[03-24|23:32:10] CveID Exploit Count count=12747
-INFO[03-24|23:32:10] Fetching Awesome Poc Exploit
-INFO[03-24|23:32:11] Awesome Poc Exploit count=823
-INFO[03-24|23:32:11] Insert Exploit into go-exploitdb. db=sqlite3
-INFO[03-24|23:32:11] Inserting 823 Exploits
-INFO[03-24|23:32:11] Inserting new Exploits
-823 / 823 [-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s
-INFO[03-24|23:32:11] No CveID Exploit Count count=0
-INFO[03-24|23:32:11] CveID Exploit Count count=823
-INFO[03-24|23:32:11] Fetching GitHub Repos Exploit
-WARN[03-24|23:32:11] Recommend installing git (if not, DB update is very slow)
-INFO[03-24|23:32:37] GitHub Repos Exploit count=2808
-INFO[03-24|23:32:37] Insert Exploit into go-exploitdb. db=sqlite3
-INFO[03-24|23:32:37] Inserting 2808 Exploits
-INFO[03-24|23:32:37] Inserting new Exploits
-2808 / 2808 [---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s
-INFO[03-24|23:32:37] No CveID Exploit Count count=0
-INFO[03-24|23:32:37] CveID Exploit Count count=2808
-INFO[03-24|23:32:38] Fetching inTheWild Poc Exploit
-INFO[03-24|23:32:48] inTheWild Poc Exploit count=71653
-INFO[03-24|23:32:48] Insert Exploit into go-exploitdb. db=sqlite3
-INFO[03-24|23:32:48] Inserting 71653 Exploits
-INFO[03-24|23:32:48] Inserting new Exploits
-71653 / 71653 [---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 52870 p/s
-INFO[03-24|23:32:49] No CveID Exploit Count count=0
-INFO[03-24|23:32:49] CveID Exploit Count count=71653
-Scan again and view the report to see the PoC information in the Exploit Database.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./scan.sh
-$ ./tui.sh
-
The CISA Known Exploited Vulnerabilities Catalog has a list of CVE-IDs that have actually been exploited in attacks.
-Vuls can show whether a detected CVE-ID is a CVE-ID in the CISA Known Exploited Vulnerabilities Catalog.
-Fetch go-kev.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./kev.sh
-Using default tag: latest
-latest: Pulling from vuls/go-kev
-97518928ae5f: Pull complete
-62b85d17d49f: Pull complete
-dc5e1f7a485e: Pull complete
-Digest: sha256:f0f0fc109d6de6b160b82c72ba6a70df65ff5ca28bf727be0d122b9d918508e5
-Status: Downloaded newer image for vuls/go-kev:latest
-docker.io/vuls/go-kev:latest
-go-kev
-INFO[04-15|17:13:38] Fetching Known Exploited Vulnerabilities
-INFO[04-15|17:13:38] Fetching URL=https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
-INFO[04-15|17:13:39] Insert Known Exploited Vulnerabilities into go-kev. db=sqlite3
-INFO[04-15|17:13:39] Inserting Known Exploited Vulnerabilities...
-644 / 644 [-------------------------------------------------------------------------------] 100.00% ? p/s
-INFO[04-15|17:13:39] CveID Count count=644
-Scan again and view the report to see the CISA Known Exploited Vulnerabilities Alert.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./scan.sh
-$ ./tui.sh
-
The Cyber Threat Intelligence(MITRE ATT&CK and CAPEC) has information on attack techniques, etc.
-Vuls displays the Cyber Threat Intelligence associated with the detected CVE-ID.
-Fetch go-cti.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./cti.sh
-Using default tag: latest
-latest: Pulling from vuls/go-cti
-97518928ae5f: Pull complete
-62b85d17d49f: Pull complete
-dc5e1f7a485e: Pull complete
-Digest: sha256:f0f0fc109d6de6b160b82c72ba6a70df65ff5ca28bf727be0d122b9d918508e5
-Status: Downloaded newer image for vuls/go-cti:latest
-docker.io/vuls/go-cti:latest
-go-cti
-INFO[04-20|03:27:56] Fetching Cyber Threat Intelligence and CVE-ID to CTI-ID Mappings
-INFO[04-20|03:27:56] Fetching MITRE ATT&CK...
-INFO[04-20|03:27:57] Fetching CAPEC...
-INFO[04-20|03:27:57] Fetching CWE...
-INFO[04-20|03:28:01] Fetching NVD CVE... year=recent
-INFO[04-20|03:28:03] Fetching NVD CVE... year=modified
-INFO[04-20|03:28:05] Fetching NVD CVE... year=2002
-INFO[04-20|03:28:07] Fetching NVD CVE... year=2003
-INFO[04-20|03:28:09] Fetching NVD CVE... year=2004
-INFO[04-20|03:28:12] Fetching NVD CVE... year=2005
-INFO[04-20|03:28:14] Fetching NVD CVE... year=2006
-INFO[04-20|03:28:17] Fetching NVD CVE... year=2007
-INFO[04-20|03:28:19] Fetching NVD CVE... year=2008
-INFO[04-20|03:28:23] Fetching NVD CVE... year=2009
-INFO[04-20|03:28:25] Fetching NVD CVE... year=2010
-INFO[04-20|03:28:28] Fetching NVD CVE... year=2011
-INFO[04-20|03:28:31] Fetching NVD CVE... year=2012
-INFO[04-20|03:28:33] Fetching NVD CVE... year=2013
-INFO[04-20|03:28:36] Fetching NVD CVE... year=2014
-INFO[04-20|03:28:39] Fetching NVD CVE... year=2015
-INFO[04-20|03:28:42] Fetching NVD CVE... year=2016
-INFO[04-20|03:28:45] Fetching NVD CVE... year=2017
-INFO[04-20|03:28:48] Fetching NVD CVE... year=2018
-INFO[04-20|03:28:52] Fetching NVD CVE... year=2019
-INFO[04-20|03:28:56] Fetching NVD CVE... year=2020
-INFO[04-20|03:29:00] Fetching NVD CVE... year=2021
-INFO[04-20|03:29:05] Fetching NVD CVE... year=2022
-INFO[04-20|03:29:07] Fetched Cyber Threat Intelligence and CVE-ID to CTI-ID Mappings techniques=1112 mappings=98011 attackers=672
-INFO[04-20|03:29:07] Insert Cyber Threat Intelligences and CVE-ID to CTI-ID Mappings into go-cti. db=sqlite3
-INFO[04-20|03:29:07] Inserting Cyber Threat Intelligences...
-INFO[04-20|03:29:07] Inserting Techniques...
-1112 / 1112 [------------------------------------------------] 100.00% 2475 p/s
-INFO[04-20|03:29:08] Inserting CVE-ID to CTI-ID CveToTechniques...
-98011 / 98011 [----------------------------------------------] 100.00% 7459 p/s
-INFO[04-20|03:29:21] Inserting Attackers...
-672 / 672 [-----------------------------------------------------] 100.00% ? p/s
-Scan again and view the report to see the Cyber Threat Intelligence.
-$ pwd
-/home/vuls/vulsctl/docker
-$ ./scan.sh
-$ ./tui.sh
-
It is possible to obtain JPCERT/CC and US-CERT alerts and display whether the detected vulnerability corresponds to the alert information.
-vulsio/go-cve-dictionary fetch.
It is possible to obtain CISA Known Exploited Vulnerabilities alerts and display whether the detected vulnerability corresponds to the alert information.
- -It is possible to obtain Cyber Threat Information(MITRE ATT&CK and CAPEC) and display whether the detected vulnerability corresponds to the Cyber Threat Information.
-vulsio/go-cti fetch.
The fast-root scan mode issues commands that require root privileges. This allows you to display process information, and network port listen information, and other information useful in making triage decisions.
-[vuls@host vulsctl]$ sudo su -
-[sudo] vuls password:
-[root@host ~]# mkdir .ssh
-[root@host ~]# chmod 700 .ssh
-[root@host ~]# cat /home/vuls/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
-[root@host ~]# chmod 600 /root/.ssh/*
-[root@host ~]# exit
-Check if you can connect to SSH as a root user without a password.
-[vuls@host vulsctl]$ ssh root@192.168.56.3
-Last login: Mon Jan 27 13:15:06 2020
-[root@host ~]# exit
-The root user can connect to SSH without a password.
-Next, add the following to config.toml. The following is added to config.toml: scanMode = ["fast-root"] to specify the fast-root mode.
[servers]
-[servers.hostroot]
-host = "192.168.56.3"
-port = "22"
-user = "root"
-keyPath = "/root/.ssh/id_rsa"
-scanMode = ["fast-root"]
-Scan and report.
-$ ./scan.sh hostroot
-$ ./report.sh
-$ ./tui.sh
-The TUI now displays process, and network port listen information. You can now see if a process is running from a vulnerable package, including CVE, and if the process is listening to a network port. You can now make a decision to investigate if a process that is vulnerable to a network-based attack is listening to the network.
-
In fast-root scan mode, additional OS packages may need to be installed in advance. Also, if you use sudo instead of root user, you need to set up /etc/sudoers on the server to be scanned. Please refer to documentation for details.
-There is also an offline mode that allows you to scan even if the server you want to scan cannot connect to the Internet. Configure toml as follows.
-[servers]
-[servers.hostroot]
-host = "192.168.56.3"
-port = "22"
-user = "root"
-keyPath = "/root/.ssh/id_rsa"
-scanMode = ["fast", "offline"]
-Vuls supports scanning for application dependency libraries.
-There are several ways to do this, and it's better to try them out as they may not be suitable for your needs.
- -See Document for details.
-The next section explains how to scan with a lock file.
-It is possible to parse the lock files of package managers for programming languages such as Gem and pip and detect potential vulnerabilities in the dependent libraries defined in them. (Vuls uses aquasecurity/trivy internally.)
- -The following lock files are supported for now.
-So let's try scanning old Redmine Gemfile.lock on GitHub.
-First, we'll use wget to get the old Gemfile.lock on the scan target server.
-$ # Execute on the scan target server
-$ pwd
-/home/vuls/vulsctl/docker
-$ wget https://raw.githubusercontent.com/41studio/redmine/master/Gemfile.lock
-Specify the path of the lockfiles in config.toml.
-[servers]
-[servers.host]
-host = "192.168.56.3"
-port = "22"
-user = "vuls"
-keyPath = "/root/.ssh/id_rsa"
-lockfiles = [ "/home/vuls/vulsctl/docker/Gemfile.lock" ]
-Scan and report.
-$ ./scan.sh hostroot
-$ ./report.sh
-$ ./tui.sh
-
Vuls can detect vulnerabilities in network devices and commercial middleware by defining CPE in config.toml. The OS package scan is done by actually SSH into the server and issuing the command. However, the CPE scan is detected by comparing the versions of the NVD and JVN databases. It does not issue commands on the device and does not access the device via a network.
-Here's a sample config.toml: type="pseudo". If type="pseudo" is specified, you can change the mode to not connect to SSH.
[servers.forti]
-type = "pseudo"
-cpeNames = [
- "cpe:/o:fortinet:fortios:4.3.0",
-]
-Vuls need the NVD and JVN data sources for CPE scan, so use cve.sh to get them if they are not already fetched.
$ ./scan.sh forti
-$ ./cve.sh
-$ ./report.sh
-$ ./tui.sh
-
See documentation for more information.
-Options|Description| |:-|:-| | -debug | Debug flags. The flag to identify the command being issued.| | -cvss-over | Filter by CVSS score| | -ignore-unfixed | Hide not-fixed-yet vulnerabilities | | -diff | Difference from last time only (new detection only)|
Fetch all Vulnerability DB using update-all.sh. This will take some time ...
-This will take over an hour in my environment.
-$ ./update-all.sh
-report:
- report
- [-lang=en|ja]
- [-config=/path/to/config.toml]
- [-results-dir=/path/to/results]
- [-log-to-file]
- [-log-dir=/path/to/log]
- [-refresh-cve]
- [-cvss-over=7]
- [-confidence-over=80]
- [-diff]
- [-diff-minus]
- [-diff-plus]
- [-ignore-unscored-cves]
- [-ignore-unfixed]
- [-to-email]
- [-to-http]
- [-to-slack]
- [-to-chatwork]
- [-to-googlechat]
- [-to-telegram]
- [-to-localfile]
- [-to-s3]
- [-to-azure-blob]
- [-format-json]
- [-format-one-email]
- [-format-one-line-text]
- [-format-list]
- [-format-full-text]
- [-format-csv]
- [-format-cyclonedx-json]
- [-format-cyclonedx-xml]
- [-gzip]
- [-http-proxy=http://192.168.0.1:8080]
- [-debug]
- [-debug-sql]
- [-quiet]
- [-no-progress]
- [-pipe]
- [-http="http://vuls-report-server"]
- [-trivy-cachedb-dir=/path/to/dir]
- [-trivy-java-db-repository="OCI-repository-for-trivy-java-db"]
- [-trivy-skip-java-db-update]
-
- [RFC3339 datetime format under results dir]
- -confidence-over int
- -confidence-over=40 means reporting Confidence Score 40 and over (default: 80) (default 80)
- -config string
- /path/to/toml (default "$HOME/config.toml")
- -cvss-over float
- -cvss-over=6.5 means reporting CVSS Score 6.5 and over (default: 0 (means report all))
- -debug
- debug mode
- -debug-sql
- SQL debug mode
- -diff
- Plus & Minus Difference between previous result and current result
- -diff-minus
- Minus Difference between previous result and current result
- -diff-plus
- Plus Difference between previous result and current result
- -format-csv
- CSV format
- -format-cyclonedx-json
- CycloneDX JSON format
- -format-cyclonedx-xml
- CycloneDX XML format
- -format-full-text
- Detail report in plain text
- -format-json
- JSON format
- -format-list
- Display as list format
- -format-one-email
- Send all the host report via only one EMail (Specify with -to-email)
- -format-one-line-text
- One line summary in plain text
- -gzip
- gzip compression
- -http-proxy string
- http://proxy-url:port (default: empty)
- -ignore-unfixed
- Don't report the unfixed CVEs
- -ignore-unscored-cves
- Don't report the unscored CVEs
- -lang string
- [en|ja] (default "en")
- -log-dir string
- /path/to/log (default "/var/log/vuls")
- -log-to-file
- Output log to file
- -no-progress
- Suppress progress bar
- -pipe
- Use args passed via PIPE
- -quiet
- Quiet mode. No output on stdout
- -refresh-cve
- Refresh CVE information in JSON file under results dir
- -results-dir string
- /path/to/results (default "$HOME/results")
- -to-azure-blob
- Write report to Azure Storage blob (container/yyyyMMdd_HHmm/servername.json/txt)
- -to-chatwork
- Send report via chatwork
- -to-email
- Send report via Email
- -to-googlechat
- Send report via Google Chat
- -to-http
- Send report via HTTP POST
- -to-localfile
- Write report to localfile
- -to-s3
- Write report to S3 (bucket/yyyyMMdd_HHmm/servername.json/txt)
- -to-slack
- Send report via Slack
- -to-syslog
- Send report via Syslog
- -to-telegram
- Send report via Telegram
- -trivy-cachedb-dir string
- /path/to/dir (default "$HOME/.cache/trivy")
- -trivy-java-db-repository string
- Trivy Java DB Repository (default "ghcr.io/aquasecurity/trivy-java-db")
- -trivy-skip-java-db-update
- Skip Trivy Java DB Update
-
-Vuls detects CVEs, gets the information of CVEs and filters.
-Detector
-Fill the information
-
Vuls has three format options.
-
$ vuls report
-
-localhost (ubuntu20.04)
-=======================
-Total: 285 (Critical:33 High:92 Medium:133 Low:18 ?:9)
-2/285 Fixed, 105 poc, 0 exploits, cisa: 1, uscert: 0, jpcert: 0 alerts
-1932 installed
-
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-ID | CVSS | ATTACK | POC | ALERT | FIXED | PACKAGES |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2016-1585 | 9.8 | AV:N | | | unfixed | apparmor |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2017-7810 | 9.8 | AV:N | | | unfixed | libmozjs-52-0 |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2017-7826 | 9.8 | AV:N | | | unfixed | libmozjs-52-0 |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2017-7827 | 9.8 | AV:N | | | unfixed | libmozjs-52-0 |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2018-16301 | 9.8 | AV:L | | | unfixed | tcpdump |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2018-5089 | 9.8 | AV:N | | | unfixed | libmozjs-52-0 |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2018-5090 | 9.8 | AV:N | | | unfixed | libmozjs-52-0 |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2018-5126 | 9.8 | AV:N | | | unfixed | libmozjs-52-0 |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2018-5145 | 9.8 | AV:N | | | unfixed | libmozjs-52-0 |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2018-5150 | 9.8 | AV:N | | | unfixed | libmozjs-52-0 |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2018-5151 | 9.8 | AV:N | | | unfixed | libmozjs-52-0 |
-+------------------|------|--------|-----|-----------|---------|----------------------------------------+
-| CVE-2019-18276 | 9.8 | AV:L | POC | | unfixed | bash |
-... snip ...
-$ vuls report -format-one-line-text
-
-One Line Summary
-================
-c74 Total: 294 (High:65 Medium:198 Low:24 ?:7) 93/294 Fixed 708 installed, 285 updatable
-deb8 Total: 490 (High:62 Medium:158 Low:22 ?:248) 11/490 Fixed 512 installed
-
$ vuls report -format-full-text
-
-c74 (centos7.4.1708)
-====================
-Total: 23 (High:22 Medium:1 Low:0), 9/23 Fixed, 708 installed, 285 updatable
-
-+---------------|----------------------------------------------------------------------------------+
-| CVE-2017-9233 | |
-+---------------|----------------------------------------------------------------------------------+
-| Max Score | 7.5 HIGH (nvd) |
-| nvd | 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H HIGH |
-| redhat_api | 6.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H MODERATE |
-| nvd | 5.0/AV:N/AC:L/Au:N/C:N/I:N/A:P MEDIUM |
-| Summary | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML |
-| | Parser Library) allows attackers to put the parser in an infinite loop using a |
-| | malformed external entity definition from an external DTD. |
-| Mitigation | Do not parse untrusted arbitrary XML data using the expat |
-| | package. |
-| CWE | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') (redhat_api) |
-| CWE | [OWASP Top4] CWE-611: Improper Restriction of XML External Entity Reference |
-| | ('XXE') (nvd) |
-| Affected PKG | expat-2.1.0-10.el7_3 -> Will not fix |
-| Confidence | 100 / RedHatAPIMatch |
-| Source | https://nvd.nist.gov/vuln/detail/CVE-2017-9233 |
-| CVSSv2 Calc | https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2017-9233 |
-| CVSSv3 Calc | https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2017-9233 |
-| RHEL-CVE | https://access.redhat.com/security/cve/CVE-2017-9233 |
-| CWE | https://cwe.mitre.org/data/definitions/CWE-835.html |
-| CWE | https://cwe.mitre.org/data/definitions/CWE-611.html |
-| OWASP Top10 | https://github.com/OWASP/Top10/blob/master/2017/en/0xa4-xxe.md |
-+---------------|----------------------------------------------------------------------------------+
-
-... snip ...
-c74 (centos7.4.1708)
-====================
-Total: 23 (High:22 Medium:1 Low:0), 9/23 Fixed, 708 installed, 285 updatable
-c74 means that it is a scan report of servers.c74 defined in config.toml.(centos7.4.1708) means that the version of the OS is CentOS 7.4.Total: 23 (High:22 Medium:1 Low:0) means that a total of 23 vulnerabilities exist, and the distribution of CVSS Severity is displayed.9/23 Fixedmeans` that a total of 23 vulnerabilities exist, and 9 is fixed, 14 is not fixed yet.285 updatable packages means that there are 285 update-able packages on the target server.+---------------|----------------------------------------------------------------------------------+
-| CVE-2017-9233 | |
-+---------------|----------------------------------------------------------------------------------+
-| Max Score | 7.5 HIGH (nvd) |
-| nvd | 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H HIGH |
-| redhat_api | 6.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H MODERATE |
-| nvd | 5.0/AV:N/AC:L/Au:N/C:N/I:N/A:P MEDIUM |
-| Summary | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML |
-| | Parser Library) allows attackers to put the parser in an infinite loop using a |
-| | malformed external entity definition from an external DTD. |
-| Mitigation | Do not parse untrusted arbitrary XML data using the expat |
-| | package. |
-| CWE | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') (redhat_api) |
-| CWE | [OWASP Top4] CWE-611: Improper Restriction of XML External Entity Reference |
-| | ('XXE') (nvd) |
-| Affected PKG | expat-2.1.0-10.el7_3 -> Will not fix |
-| Confidence | 100 / RedHatAPIMatch |
-| Source | https://nvd.nist.gov/vuln/detail/CVE-2017-9233 |
-| CVSSv2 Calc | https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2017-9233 |
-| CVSSv3 Calc | https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2017-9233 |
-| RHEL-CVE | https://access.redhat.com/security/cve/CVE-2017-9233 |
-| CWE | https://cwe.mitre.org/data/definitions/CWE-835.html |
-| CWE | https://cwe.mitre.org/data/definitions/CWE-611.html |
-| OWASP Top10 | https://github.com/OWASP/Top10/blob/master/2017/en/0xa4-xxe.md |
-+---------------|----------------------------------------------------------------------------------+
-Max Score means Max CVSS Score.
nvd shows CVSS Vector of NVD
redhat shows CVSS Vector of Red Hat OVAL
jvn shows CVSS Vector of JVN
CWE means CWE - Common Weakness Enumeration of the CVE.
[OWASP Top10] means the CWE is included in OWASP TOP 10
Affected PKG shows the package version information including this vulnerability.
Confidence means the reliability of detection.
100 is highly reliableItem list of Confidence
| Detection Method | Confidence | type | Description |
|---|---|---|---|
| OvalMatch | 100 | CentOS, AlmaLinux, Rocky Linux, RHEL, Fedora, Oracle, Ubuntu, Debian, SUSE | OVAL |
| RedHatAPIMatch | 100 | CentOS, AlmaLinux, Rocky Linux, RHEL | Red Hat API |
| UbuntuAPIMatch | 100 | Ubuntu | Ubuntu API |
| DebianSecurityTrackerMatch | 100 | Debian | Debian Security Tracker |
| TrivyMatch | 100 | Container image and Lockfile | trivy |
| PkgAuditMatch | 100 | FreeBSD | pkg audit |
| WPScanMatch | 100 | WordPress | wpscan.com |
| GitHubMatch | 100 | library | Detected by GitHub Security Alerts |
| NvdExactVersionMatch | 100 | CPE scan | Range match in semantic versioning format or an exact match. |
| NvdRoughVersionMatch | 80 | CPE scan | Rough version match for non-semantic versioning as defined in NVD. |
| NvdVendorProductMatch | 10 | CPE scan | If the version is not defined for the CPE specified in config.toml. There is a possibility of false positives. |
| JvnVendorProductMatch | 10 | CPE scan | Detected by Jvn. Affected Version in JVN is not a parsable format, so it is matched by Part, Vendor and Product. There is a possibility of false positives. |
| ChangelogExactMatch | 95 | CentOS, Ubuntu, Debian, Raspbian | Exact version match between changelog and package version. |
| ChangelogRoughMatch | 50 | Ubuntu, Debian, Raspbian | Rough version match between changelog and package version. |
# Show scan history
-$ vuls history
-
-# Generate reports for all scan history
-$ for REPORT_DATE in $(vuls history | awk '{ print $1 }') ; do echo "$REPORT_DATE" | vuls report -format-one-line-text -pipe ; done
-
-# Generate reports for a specific date
-vuls history | grep "DATE" | vuls report -format-one-line-text -pipe
-The -diff-plus option detects new or updated vulnerabilities compared to the previous json.The one with _diff.json is output. The -diff-minus option detects vulnerabilities that have already been patched compared to the previous json.The one with _diff.json is output. -diff option turns on both options -diff-plus and -diff-minus
-# After vuls scan, get minus difference.
-$ vuls report -diff-minus -to-localfile -format-json
-config.toml
-[cveDict]
-type = "sqlite3"
-SQLite3Path = "/path/to/cve.sqlite3"
-
-[ovalDict]
-type = "sqlite3"
-SQLite3Path = "/path/to/oval.sqlite3"
-
-[gost]
-type = "sqlite3"
-SQLite3Path = "/path/to/gost.sqlite3"
-
-[exploit]
-type = "sqlite3"
-SQLite3Path = "/path/to/go-exploitdb.sqlite3"
-
-[metasploit]
-type = "sqlite3"
-SQLite3Path = "/path/to/go-msfdb.sqlite3"
-
-[kevuln]
-type = "sqlite3"
-SQLite3Path = "/path/to/go-kev.sqlite3"
-
-[cti]
-type = "sqlite3"
-SQLite3Path = "/path/to/go-cti.sqlite3"
-Define HTTP section in config.toml
-$ vuls report \
- -to-http \
- -format-json
-Sample PHP code on the endpoint side:
<?php
-$tmp_file = __DIR__ . '/vuls-'. uniqid() . '.json';
-file_put_contents($tmp_file, file_get_contents("php://input"));
-if (file_exists($tmp_file)) {
- $raw_json_data = file_get_contents($tmp_file);
- $json_data = json_decode($raw_json_data);
- $scanned_hostname = $json_data->{'serverName'};
- $new_file = __DIR__ . '/' . strtolower($scanned_hostname) . '.json';
- rename($tmp_file, $new_file);
-}
-?>
-Source: vuls.php
--The following code will simply create a
-JSONfile named with the hostname extracted that wayhostname.json. It will be created in the same location of thevuls.phpfile.
Define EMail section in config.toml
-$ vuls report \
- -to-email \
- -cvss-over=7
-With this sample command, it will ..
-Define ChatWork section in config.toml
-$ vuls report \
- -to-chatwork \
- -cvss-over=7
-With this sample command, it will ..
-Define Slack section in config.toml
-$ vuls report \
- -to-slack \
- -cvss-over=7
-With this sample command, it will ..
-Define Telegram section in config.toml
-$ vuls report \
- -to-telegram \
- -cvss-over=7
-With this sample command, it will ..
-To put results in S3 bucket, configure following settings in AWS before reporting.
-Example of IAM policy:
-{
- "Version": "2012-10-17",
- "Statement": [
- {
- "Effect": "Allow",
- "Action": [
- "s3:ListAllMyBuckets"
- ],
- "Resource": "arn:aws:s3:::*"
- },
- {
- "Effect": "Allow",
- "Action": [
- "s3:PutObject"
- ],
- "Resource": "arn:aws:s3:::vuls/*"
- }
- ]
-}
-config.toml
-[aws]
-profile = "default"
-region = "ap-northeast-1"
-s3Bucket = "vuls"
-s3ServerSideEncryption = "AES256"
-reporting
-$ vuls report \
- -to-s3 \
- -format-json
-With this sample command, it will ..
-Put scan result(JSON) in S3 bucket
-To put results in Azure Blob Storage, configure following settings in Azure before reporting.
-config.toml
-[azure]
-accountName = "default"
-accountKey = "xxxxxxxxxxxxxx"
-containerName "vuls"
-$ vuls report -to-azure-blob
-...
-With this sample command, it will ..
-Put scan result(JSON) in Azure Blob Storage.
-account and access key can be defined in environment variables.
-$ export AZURE_STORAGE_ACCOUNT=test
-$ export AZURE_STORAGE_ACCESS_KEY=access-key-string
-$ vuls report -to-azure-blob
-vuls report doesn’t support Google Cloud Strorage option If you want to put scan result(JSON) in Google Cloud Storage, please use gsutil
$ gsutil cp ./results/yyyyMMdd_HHmm/servername.json gs://my-awesome-bucket
-see Quickstart: Using the gsutil tool
-Define ignoreCves in config if you don't want to report(Slack, EMail, Text...) specific CVE IDs.
-[default]
-ignoreCves = ["CVE-2016-6313"]
-
-[servers.bsd]
-host = "192.168.11.11"
-user = "kanbe"
-ignoreCves = ["CVE-2016-6314"]
-[default]
-ignoreCves = ["CVE-2016-6313"]
-
-[servers.cent7]
-host = "192.168.11.11"
-user = "kanbe"
-
-[servers.cent7.containers.romantic_goldberg]
-ignoreCves = ["CVE-2016-6314"]
-Define ignorePkgsRegexp in config if you don't want to report(Slack, EMail, Text...) match against the specific regexp google/re2.
-[servers.c74]
-host = "192.168.11.11"
-user = "kanbe"
-ignorePkgsRegexp = ["^kernel", "^python"]
-
-[servers.c74.containers.romantic_goldberg]
-ignorePkgsRegexp = ["^vim"]
-Optional key-value can be outputted to JSON. The key-value in the default section will be overwritten by servers section's key-value. For instance, you can use this field for Azure ResourceGroup name, Azure VM Name and so on.
-[default]
-[default.optional]
-key1 = "default_value"
-key3 = val3
-
-
-[servers.bsd]
-host = "192.168.11.11"
-user = "kanbe"
-[servers.bsd.optional]
-key1 = "val1"
-key2 = "val2"
-[
- {
- "ServerName": "bsd",
- "Family": "FreeBSD",
- "Release": "10.3-RELEASE",
- .... snip ...
- "Optional": {
- "key1": "val1" ,
- "key2": "val2" ,
- "key3": "val3"
- }
- }
-]
-config.toml
-[cveDict]
-type = "mysql"
-url = "user:pass@tcp(localhost:3306)/dbname?parseTime=true"
-
-[ovalDict]
-type = "mysql"
-url = "user:pass@tcp(localhost:3306)/dbname?parseTime=true"
-
-[gost]
-type = "mysql"
-url = "user:pass@tcp(localhost:3306)/dbname?parseTime=true"
-
-[exploit]
-type = "mysql"
-url = "user:pass@tcp(localhost:3306)/dbname?parseTime=true"
-
-[metasploit]
-type = "mysql"
-url = "user:pass@tcp(localhost:3306)/dbname?parseTime=true"
-$ vuls report
-...
-If you get below error message while fetching, define sql_mode.
Error 1292: Incorrect datetime value: '0000-00-00' for column 'issued' at row 1
-For details, see TODO
-config.toml
-[cveDict]
-type = "postgres"
-url = "host=myhost user=user dbname=dbname sslmode=disable password=password"
-
-[ovalDict]
-type = "postgres"
-url = "host=myhost user=user dbname=dbname sslmode=disable password=password"
-
-[gost]
-type = "postgres"
-url = "host=myhost user=user dbname=dbname sslmode=disable password=password"
-
-[exploit]
-type = "postgres"
-url = "host=myhost user=user dbname=dbname sslmode=disable password=password"
-
-[metasploit]
-type = "postgres"
-url = "host=myhost user=user dbname=dbname sslmode=disable password=password"
-$ vuls report
-...
-config.toml
-[cveDict]
-type = "redis"
-url = "redis://localhost/1"
-
-[ovalDict]
-type = "redis"
-url = "redis://localhost/1"
-
-[gost]
-type = "redis"
-url = "redis://localhost/1"
-
-[exploit]
-type = "redis"
-url = "redis://localhost/1"
-
-[metasploit]
-type = "redis"
-url = "redis://localhost/1"
-$ vuls report
-...
-config.toml
-[cveDict]
-type = "http"
-url = "http://localhost:1323"
-
-[ovalDict]
-type = "http"
-url = "http://localhost:1324"
-
-[gost]
-type = "http"
-url = "http://localhost:1325"
-
-[exploit]
-type = "http"
-url = "http://localhost:1326"
-
-[metasploit]
-type = "http"
-url = "http://localhost:1327"
-$ vuls report
-...
-non-OS-packagesの脆弱性をスキャンするために、以下のオプションが用意されています。
Vuls over v0.8.0 can scan libraries using aquasecurity/trivy on the local/remote file system.
-A sample of config.toml is blow.
-specify the path of lockfiles, Vuls can detect vulns of libs without defining CPEs.
[servers]
-
-[servers.ubuntu]
-host = "xxx.xxx.xxx"
-port = "22"
-user = "tamachi"
-keyPath = "/Users/amachi/.ssh/id_dsa"
-lockfiles = [
- "/home/tamachi/lockfiles/package-lock.json",
- "/home/tamachi/lockfiles/yarn.lock",
- "/home/tamachi/lockfiles/struts.jar",
-]
-If findLock=true and findLockDirs are specified, libraries on the local file system can be automatically detected by the find command.
NOTE: When findLock = true, the target lockfile depends on the scan mode and scan user privilege. When scan mode is fast, it depends on the privilege of the scan user. If the scan user does not have the root privilege, lockfiles that require the root privilege will not be detected. When scan mode is fast-root, lockfiles are detected with root privileges.
[servers]
-
-[servers.ubuntu]
-host = "xxx.xxx.xxx"
-port = "22"
-user = "tamachi"
-keyPath = "/Users/amachi/.ssh/id_dsa"
-findLock = true # auto detect lockfile
-findLockDirs = [
- "/path/to/prject/lib",
- "/path/to/prject2/lib",
-]
-GitHub tracks reported vulnerabilities in certain dependencies and provides security alerts to affected repositories. GitHub Security Alerts. It becomes possible to import vulnerabilities detected by GitHub via GitHub's API.
-First, enable GitHub security alerts on your repo. see
-Second, Issue a token. see
-3rd, config.toml
-To ignore vulnerabilities dismissed on GitHub, set IgnoreGithubDismissed to true at githubs section.
-[servers.ghsa]
-type = "pseudo"
-
-[servers.ghsa.githubs."owner/repo"]
-token = "xxxxYourTokenxxx"
-IgnoreGithubDismissed = true
-Vuls scan detect vulnerabilities in non-OS packages, such as something you compiled by yourself, language libraries and frameworks that have been registered in the CPE.
-The CPE scan uses the NVD information to search for the specified CPE. It is necessary to set up go-cve-dictionary and fetch NVD data source in advance. To setup go-cve-dictionary, see here
-see also Architecture/CPE Scan
-NVD: Search Common Platform Enumerations (CPE) You need Check CPE Naming Format: 2.2
-go-cpe-dictionary is a good choice for geeks. 
You can search a CPE name by the application name incrementally.
-To detect the vulnerability of Ruby on Rails v4.2.1 and PostgreSQL9.6.2, cpeNames needs to be set in the servers section.
-[servers]
-
-[servers.172-31-4-82]
-host = "172.31.4.82"
-user = "ec2-user"
-keyPath = "/home/username/.ssh/id_rsa"
-cpeNames = [
- "cpe:/a:rubyonrails:ruby_on_rails:4.2.1",
- "cpe:2.3:a:postgresql:postgresql:9.6.2:*:*:*:*:*:*:*",
-]
-To detect the vulnerability of Ruby on Rails v4.2.1 on specific container, cpeNames needs to be set in the servers>containers section. The following is an example of running Ruby on Rails v4.2.1 and PostgreSQL9.6.2 on dockerA.
-[servers]
-
-[servers.172-31-4-82]
-host = "172.31.4.82"
-user = "ec2-user"
-keyPath = "/home/username/.ssh/id_rsa"
-containerType = "docker"
-containersIncluded = ["${running}"]
-
-[servers.172-31-4-82.containers.dockerA]
-cpeNames = [
- "cpe:/a:rubyonrails:ruby_on_rails:4.2.1",
- "cpe:2.3:a:postgresql:postgresql:9.6.2:*:*:*:*:*:*:*",
-]
-
-Specify this when you want to detect vulnerability by specifying cpename without SSH connection. The pseudo type does not do anything when scanning. Search for NVD at report time and detect vulnerability of software specified as cpenamae.
-[servers]
-
-[servers.forti]
-type = "pseudo"
-cpeNames = [
- "cpe:/o:fortinet:fortios:4.3.0",
-]
-JVN can be used to detect vulnerabilities in Japanese software that are not defined in the NVD.
---confidence-over=0.The Affected version is not defined in a parsable format in JVN. Therefore, all vulnerabilities with matching Part, Vendor, and Product are detected. Note that there are false positives.
-OWASP Dependency check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities.
-Benefit of integrating Vuls And OWASP Dependency Check is below.
-How to integrate Vuls with OWASP Dependency Check
-Execute OWASP Dependency Check with --format=XML option.
Define the xml file path of dependency check in config.toml.
-```bash
-[servers]
-
-[servers.172-31-4-82]
-host = "172.31.4.82"
-user = "ec2-user"
-keyPath = "/home/username/.ssh/id_rsa"
-owaspDCXMLPath = "/tmp/dependency-check-report.xml"
-```
-The following is an example of how to specify a XML of OWASP DC to the specific container.
-[servers]
-
-[servers.172-31-4-82]
-host = "172.31.4.82"
-user = "ec2-user"
-keyPath = "/home/username/.ssh/id_rsa"
-containerType = "docker"
-containersIncluded = ["${running}"]
-
-[servers.172-31-4-82.containers.dockerA]
-owaspDCXMLPath = "/tmp/dependency-check-report.xml"
-
-非商用で使う場合は、WordPressとの連携を無料で使用できます。 But for commercial use, You have to send a E-Mail to the WPScan Team. For Details, see the NOTE:
-あなたのソフトウェアが非商用かどうかわからない時や、商用で使用したいときのお問い合わせ
-First, you need to register a user and get the API token from your profile page on wpscan.com. And then, check whether the wp command is installed on the scan target server. 以下はサンプルの設定です。
- [wpscan]
- token = "Token"
- detectInactive = false
-
- [servers.kusanagi]
- user = "root"
- host = "10.10.10.10"
- port = "22"
-
- [servers.kusanagi.wordpress]
- cmdPath = "/usr/local/bin/wp"
- osUser = "wordpress"
- docRoot = "/home/kusanagi/wp/DocumentRoot/"
- noSudo = false
-wp on the wordpress serverwp on the wordpress serverwp command with sudo privilegesWordPressをスキャンするには、以下のように実行してください。
-$ vuls scan kusanagi
-Vuls collects WordPress Core version, plugins and themes via wp-cli.
$ vuls report
-Vuls detects vulnerabilities via accessing WPScan.com via HTTP.
-
# for server administrator
-[servers.wordpress]
-host = "wordpress"
-
-# for WordPress site FOO
-[servers.foo]
-host = "wordpress"
-scanModules = ["wordpress"]
-[servers.foo.wordpress]
-docRoot = "/home/foo/wordpress/"
-
-# for WordPress site BAR
-[servers.bar]
-host = "wordpress"
-scanModules = ["wordpress"]
-[servers.bar.wordpress]
-docRoot = "/home/bar/wordpress/"
-Set noSudo = true to execute the command without sudo.
-If scan user and wordpress osUser are different, it is necessary to be able to switch from scan user to wordpress osUser without a password, since the command is executed by switching to wordpress osUser.
-See PR #1523 if you want to know the actual command to be executed.
For example, the following config requires that the switch from user to wordpress (user $ su - wordpress) can be executed without a password.
[servers.wordpress]
-user = "user"
-
-[servers.wordpress.wordpress]
-cmdPath = "/usr/local/bin/wp"
-osUser = "wordpress"
-docRoot = "/var/www/html"
-noSudo = true
-$ vuls tui -h
-tui:
- tui
- [-refresh-cve]
- [-config=/path/to/config.toml]
- [-cvss-over=7]
- [-cvss-over=7]
- [-diff]
- [-ignore-unscored-cves]
- [-ignore-unfixed]
- [-results-dir=/path/to/results]
- [-log-dir=/path/to/log]
- [-debug]
- [-debug-sql]
- [-quiet]
- [-no-progress]
- [-pipe]
- [-trivy-cachedb-dir=/path/to/dir]
-
- -config string
- /path/to/toml (default "/Users/kanbe/go/src/github.com/future-architect/vuls/config.toml")
- -confidence-over int
- -confidence-over=40 means reporting Confidence Score 40 and over (default: 80) (default 80)
- -cvss-over float
- -cvss-over=6.5 means reporting CVSS Score 6.5 and over (default: 0 (means report all))
- -debug
- debug mode
- -debug-sql
- debug SQL
- -diff
- Difference between previous result and current result
- -ignore-unfixed
- Don't report the unfixed CVEs
- -ignore-unscored-cves
- Don't report the unscored CVEs
- -log-dir string
- /path/to/log (default "/var/log/vuls")
- -no-progress
- Suppress progress bar
- -pipe
- Use stdin via PIPE
- -quiet
- Quiet mode. No output on stdout
- -refresh-cve
- Refresh CVE information in JSON file under results dir
- -results-dir string
- /path/to/results (default "/Users/kanbe/go/src/github.com/future-architect/vuls/results")
- -trivy-cachedb-dir string
- /path/to/dir (default "/Users/kanbe/Library/Caches/trivy")
-
-
キー操作は以下の通り。
-| キー | |
|---|---|
| TAB | カーソルのペイン間の移動 |
| 上下矢印キー | カーソルの上下 |
| Ctrl+j, Ctrl+k | カーソルの上下 |
| Ctrl+u, Ctrl+d | ページの上下 |
For details, see source code
-$ vuls history
-2016-12-30T10:34:38+09:00 1 servers: u16
-2016-12-28T19:15:19+09:00 1 servers: ama
-2016-12-28T19:10:03+09:00 1 servers: cent6
-$ vuls tui 2016-12-30T10:34:38+09:00
-$ vuls history | peco | vuls tui -pipe
-
注意 usiusi360/vulsrepo はもうメンテナンスされていません。
-メンテンスリポジトリを使用する必要があります。: ishiDACo/vulsrepo
VulsRepo is awesome OSS Web UI for Vuls. With VulsRepo you can analyze the scan results like Excel pivot table.
-
A home folder of vuls is explained as /opt/vuls.
-<br />$ cd /opt/vuls
-$ vuls scan
-$ vuls report -format-json
-
-Output to a JSON files (/opt/vuls/results)
-From now on, executed by a user running the vuls scan.
-$ cd $HOME
-$ git clone https://github.com/ishiDACo/vulsrepo.git
-Set Path according to your own environment.
-$ cd $HOME/vulsrepo/server
-$ cp vulsrepo-config.toml.sample vulsrepo-config.toml
-$ vi vulsrepo-config.toml
-[Server]
-rootPath = "/home/vuls-user/vulsrepo"
-resultsPath = "/opt/vuls/results"
-serverPort = "5111"
-
-$ pwd
-$HOME/vulsrepo/server
-
-$ ./vulsrepo-server
-2017/08/28 11:04:00 main.go:90: INFO: RootPath Load: /root/work/vulsrepo
-2017/08/28 11:04:00 main.go:97: INFO: ResultsPath Load: /opt/vuls/results
-2017/08/28 11:04:00 main.go:66: Start: Listening port: 5111
-
-$ sudo cp $HOME/vulsrepo/server/scripts/vulsrepo.init /etc/init.d/vulsrepo
-$ sudo chmod 755 /etc/init.d/vulsrepo
-$ sudo vi /etc/systemd/system/init.d/vulsrepo
-$ sudo chkconfig vulsrepo on
-$ sudo /etc/init.d/vulsrepo start
-$ sudo cp $HOME/vulsrepo/server/scripts/vulsrepo.service /lib/systemd/system/vulsrepo.service
-$ sudo vi /lib/systemd/system/vulsrepo.service
-$ sudo systemctl enable vulsrepo
-$ sudo systemctl list-unit-files --type=service | grep vulsrepo
-vulsrepo.service enabled
-$ sudo systemctl start vulsrepo
-DigestAuth implementation has a lot of problems. It requires multiple authentications on Chrome, Chromium and Firefox. If authentication is required, it's easier to isolate it by using nginx and vulsrepo-server with a proxy.
-$ ./vulsrepo-server -h
-Usage of ./vulsrepo-server:
- -c string
- AuthFile Path (default "/home/vuls-user/.htdigest")
- -m make AuthFile
- -r string
- realm (default "vulsrepo_local")
- -u string
- login user (default "vuls")
-
-ex)
-$ ./vulsrepo-server -m
-Password: ****
-AuthFile Path : /home/vuls-user/.htdigest
-realm : vulsrepo_local
-login user : vuls
-2017/08/28 19:11:59 main.go:96: Create Success
-$ vi vulsrepo-config.toml
-[Auth]
-authFilePath = "/home/vuls-user/.htdigest"
-realm = "vulsrepo_local"
-
-$ openssl genrsa -out key.pem 2048
-$ openssl req -new -x509 -sha256 -key key.pem -out cert.pem -days 3650
-$ vi vulsrepo-config.toml
-[Server]
-
-serverSSL = "yes"
-serverCert = "cert.pem"
-serverKey = "key.pem"
-$ mkdir -p $GOPATH/src/github.com/ishiDACo/
-$ cd $GOPATH/src/github.com/ishiDACo/
-$ git clone https://github.com/ishiDACo/vulsrepo.git
-$ cd vulsrepo/server
-$ go get -u github.com/golang/dep/...
-$ dep ensure
-$ go build -o vulsrepo-server
-Please access the following URL in your browser. If you have JavaScript disabled in your browser, please enable it.
-http://<server-address>:5111
-In the initial state, the data of the most recent day of the scan is selected for display. You can narrow down the target range by date. Select a range from the drop-down list.
-
You can specify any range with Custom Range.
You can narrow down the target by server name. You can select more than one.
-
You can also filter targets by server name and then select and deselect them.
-
If you want to make a detailed selection, please select the data you want to display in the file selection tree. You can select multiple files. Click Select All to select them all together, or Select None to clear them.
Click the Submit button after selecting them.
When the data is loaded, the pivot table is shown as follows.
/opt/vuls/results is the correct one to refer to as the output of Vuls.*.json ファイルを別のディレクトリに移動するか、VulsRepoを表示する前に削除してください。results directory./ to the resultsPath value. For example, resultsPath = "/opt/vuls/results/" is wrong and resultsPath = "/opt/vuls/results" is the correct setting.If you try to load a large amount of data, it may fail. Please use the following methods.
-Summary, Cvss Metrics or Affected Processes to OFF in the Setting may solve this problem (see Display setting - Show / Hide the Item).The number of vulnerabilities found by date/time and server/container scanned is shown as a heat map by severity.
-The healty indicates that no vulnerabilities were found.
When you change a filter in the pull-down menu, you can apply a pre-defined filter to display a pivot table.
There are five available.
-A bar chart stacking the total number of vulnerabilities detected per server and container.
-The most recent data is selected for a side-by-side comparison of the status of each server and container.
-
This bar graph shows the total number of vulnerability detections for each CVSS base score.
-It is recommended that the most recent data be selected for display.
-
A heat map of the packages where the vulnerability was found, the severity, the corresponding CVE IDs, a summary of the vulnerability, and the total number of detections by server and container.
-It is suitable for comparing the status of each server and container side by side by selecting the most recent data.
-
Good for checking whether each CVE ID vulnerability is resolved or newly detected.
-Suitable for comparing a single server or container over time.
-
This is a good time to check if a fixed version is provided in the package that contains each CVE ID vulnerability.
-You can choose the most recent single server or container to check.
-
You can change the display items by dragging and dropping them.
-
You can save the filtered items and reorder them. Press the Save button to open the Save Filter Panel.
Save new filter and enter the name of the filter you want.Update filter and select the filter you want to overwrite from the pull-down menu.OK button to save, or the Cancel, x or ESC key to cancel.You can't overwrite Preset filters.
-
Press the Delete button to delete the current filter.
The Are you sure to delete? confirmation dialog is displayed. Press the OK button to delete the filter, or the Cancel button to cancel.
You can't delete Preset filters.
-
Pressing the Clear button clears the filter and returns the pivot table display to Unfiltered initial state.
Press the Open print preview button to open print preview window.
You can print by pressing the Print button.
| 項目 | 説明 |
|---|---|
| ScanTime | スキャンした日時 |
| ServerName | スキャン対象サーバー名 |
| Container | スキャン対象コンテナ名 |
| CVSS Score | CVSS Base score of vulnerability, with a maximum of 10.0. |
| CVSS Severity | Vulnerability severity. Red is more severe. |
| CVSS Score Type | The source of CVSS Score, CVSS Severity and CVSS Vector. For example, see CVSS Score Type |
| Platform | 稼働しているプラットフォーム |
| Family | OS |
| Release | OS リリースバージョン |
| Errors | Vuls Error Messages |
| Warnings | Vuls warning messages, which include OS EOL information in Vuls v0.15.x and later. |
| Diff | (Only when Vuls v0.15.8 or later is used to output diff information) + New vulnerabilities found compared to previous scan - Vulnerabilities that are no longer present (or have been addressed) since the last scan |
| CveID | The CVE ID assigned to the vulnerability. Click to view Detail panel. |
| Packages | The name of the package containing the vulnerability |
| FixedIn | The version of the package that fixed the vulnerability |
| FixState | Status of packages against vulnerabilities |
| NotFixedYet | Whether a version of the package that fixes the vulnerability is available. |
| PackageVer | Installed package version |
| NewPackageVer | Latest Package Version |
| Repository | Package provider's repositories |
| CweID | Its CVE's CWE - Common Weakness Enumeration. Click on MITRE or JVN to view the appropriate CWE description page in a new window. |
| VulnType | (WordPress only) Vulnerability type provided by WPScan. |
| Status | (WordPress theme and plugin only) Whether a WordPress theme or plugin is active or inactive. |
| Update | (WordPress theme and plugin only) Availability of updates for WordPress themes and plugins. |
| Title | Vulnerability title |
| Summary | Vulnerability Overview |
| PortScannable | Whether the port can be scanned or not. Click to view Package panel. |
| Process | The process ID: process name of the process affected by the vulnerability. Click to view Package panel. |
| Path | The path of the lock file that led to the vulnerability scan of the library. |
| Mitigation | Whether or not information on mitigation measures is available. |
| CVSSv3(*) | CVSS 3.0 Vector |
| CVSS(*) | CVSS 2 Vector |
| AdvisoryID | (Amazon Linux, RedHat, Oracle Linux only) Advisory IDs for supported distributions. Click to open the advisory page in a new window. |
| CERT | Whether there is a USCERT Alert or JPCERT Alert. Click to view the relevant information in a new window. |
| PoC | Whether the exploit code exists. If so, the number of them. |
| Changelog | Whether or not there is a Changelog. Click to view Package panel. |
| DetectionMethod | Vulnerability Detection Methodology |
| ConfidenceScore | Reliability of detection. 100 means high reliability. |
| Published | Date the information was released. |
| Last Modified | Date the information was last updated. |
Here are some examples.
-| Value | Source |
|---|---|
nvdV3 | NVD CVSS v3 |
nvd | NVD CVSS v2 |
jvnV3 | JVN CVSS v3 |
jvn | JVN CVSS v2 |
redhat_apiV3 | RedHat CVSS v3 |
oracleAdvisory | Oracle Linux Errata repository |
Unknown | Unknown |
Press the ▼ part of the item.
Select the items to be displayed by checking or unchecking the checkboxes. Click Select All to select them all together, or Select None to clear them.
If you have a lot of candidates, you can refine your selection. The following example shows how to filter by python and select some packages.
Press the Apply button to apply it. Filtered items are shown in italics. To close it without applying it, press the Cancel button.
The leftmost row is the highest priority for sorting.
-| 項目 | Ascending/descending order |
|---|---|
| CVSS Score | descending order |
| CVSS Severity | Unknown, Critical, High, Important, Medium, Moderate, Low, Negligible, Unimportant, Pending, Not Vulnerable |
| CVSSv3(*) | descending order |
| CVSS(*) | descending order |
| CERT | descending order |
| PoC | descending order |
| Published | descending order |
| Last Modified | descending order |
| Other | ascending order |
The order of ascending and descending is fixed and cannot be switched.
-You can render TSV data by setting the renderer to TSV Export. The displayed data can be copied to the clipboard. You can also download the data as a TSV file by pressing the Download TSV button.
You can change the renderer, the unit of aggregation, and the sort order of rows and columns of aggregate values.
-See pivottable wiki and PivotTable.js Examples.
-
Press ☰ button at the top left of the screen to display the file selection tree. Press again to close the tree.
Press this button to select the data to be displayed.
-
Press the wrench button in the upper right corner of the screen to open the Display Settings Panel.
The settings are applied by pressing x or clicking outside the panel frame or pressing the ESC key to close the panel.
Set the items to be displayed in the Pivot table. Because the data of Summary, CVSS Metrics and Affected Processes(PortScannable, Process) is very large, an error may occur if the number of vulnerabilities is large. In this case, setting OFF may improve the situation.
If any of the following is applicable to the CweId of the pivot table, the CWE ID will be marked with a caution symbol by setting it to ON.
Set the data to be displayed with priority in the pivot table.The default is NVD data.
You can swap priorities by dragging and dropping blocks. You can also swap what you want to show and what you want to hide. In the following example, the priority of JVN and Ubuntu is raised so that Japanese and Ubuntu information is shown first. We also move amazon, oracle to the Hide side to hide information about Amazon Linux and Oracle Linux.
Filters and display settings are stored in the Local Storage of each browser, not on the server side. Therefore, if more than one person needs the same filter and display settings, you will need to share them with others.
-x` を押すか、パネル枠外をクリックしてパネルを閉じてください。
-
-Recipient's Operation
-
-- ブラウザでコピーした URL にアクセスしてください。
-- 必要に応じて URL をブックマークしてください。ブックマークから VulsRepo を開くことで次回以降も同じ設定で表示できます。
-- 表示対象データを選択すると、
ピボットテーブル は同様の設定で表示できます。
-- 必要に応じて、 フィルターの新規保存、上書き保存 してください。
-
-詳細パネル
-Detailed information is divided into Main tab and Package tab. The initial view is Main tab. Click on the tabs to switch the display to suit your needs.
-To close the panel, press x on the top right corner of the panel, or click outside the panel frame, or press ESC key.
-
-Main tab
-
-CVSS Detail section
-This section shows the basic score and severity, summary of the vulnerability, and the date the information was last updated, as provided by each organization and distributor.
-Clicking each type opens the page provided by the organization or distributor in a new window.
-See the tooltip of ? tooltips for basic score and severity categories.
-CVSS Vector radar chart
-It shows the value of each evaluation item calculated by NVD, JVN, and RedHat in a radar chart. You can switch between the CVSS v2 and CVSS v3.x charts by clicking the Cvss v2 tab or the Cvss v3.x tab. The initial display is CVSS v3.x.
-You can control to show or hide the chart by clicking the NVD v3.x, JVN v3.x, or RehHat v3.x. In the following example, the chart of NVD v3.1 and RehHat v3.0 is hidden.
-
-Mitigation section
-This section will appear if information on mitigation measures is available. Click on the header to open and close the section.
-
-CweID section
-By clicking on MITRE and JVN, a new window will open with the appropriate CWE details Display the description page.
-If CweID is ranked in one of the following categories, the rank will be displayed as a badge. Clicking on a badge will take you to a new window for each piece of information.
-
-Links section
-Open the following page in a new window.
-
-
-Item Link MITRE The corresponding CVE page provided by MITRE CveDetails The corresponding CVE page provided by CVE Details CVSS Calculator V2 Common Vulnerability Scoring System Calculator Version 2 page from NISTCVSS Calculator V3 Common Vulnerability Scoring System Calculator Version 3.0 page from NISTCVSS Calculator V3 (JVN) Common Vulnerability Scoring System Version 3.0 Calculator page provided by JVN. Amazon (Amazon Linux only) Amazon Linux Security Advisories, Amazon Linux2 Security Advisories, Amazon Linux2022 Security Advisories, Amazon Linux2023 Security Advisories RedHat Network (RedHat only) Red Hat Product Errata OracleLinux Errata (Oracle Linux only) Unbreakable Linux Network
-CVSS Calculator is useful for calculating severity, including Environmental Metrics.
-USCERT / JPCERT Alert section
-If there is USCERT Alert or JPCERT Alert, USCERT / JPCERT Alert section appears. Click on the header to open and close the section. Shows links to USCERT Alert and JPCERT Alert. Clicking on them will open the page in a new window.
-
-Exploits section
-Exploits section is displayed if there is information on Exploit Codes or Metasploit Modules. Click on the header to open and close the section. Displays links for each Exploit Codes and Metasploit Modules. Clicking on them will open the page in a new window.
-
-References section
-Click on the header to open and close the section. Displays the reference information provided by each information organization and distributor. Clicking on them will open the page in a new window.
-You can filter by tags. Clicking on a tag toggles it on and off. The default is Show All. You can open and close the display for each information source. Click on the ▼ button. The default is open.
-
-Package tab
-Here is a list of packages that contain vulnerabilities. Click each PackageName to open the Package panel.
-
-Package panel
-To close the panel, click outside the panel frame or press the ESC key.
-
-Affected Processes
-If there are processes affected by the vulnerability, they will be shown. Lists the process ID, process name, IP address and port.
-
-Changelog
-View the package changelog.
-The changelog description is highlighted in orange if the corresponding CVE ID is present. Any other CVE IDs are highlighted in light blue.
-URL parameters
-You can filter the target data and display it immediately by specifying the date, server and filter by URL parameters. If you already know the period, server and filter you want to view, you can specify these parameters in the URL when you open VulsRepo, saving you the trouble of manually selecting them each time.
-The following parameters can be specified.
-
-
-Parameter Purpose Value server Target server (container) For all, all. If more than one, concatenate them with +. ex）foo.json, foo.json+bar.json+baz@foo.json daterange Date Range today, yesterday, last7days, last30days, thismonth, lastmonth or alldaysdatefrom Date Range from (*) YYYY-MM-DD format ex）2020-11-01 dateto Date Range to (*) YYYY-MM-DD format ex）2021-01-23 time Specific date and time ISO8601 format ex) 2020-02-04T01:25:11Z or 2021-01-25T12:34:56+09:00 filter Specifying a filter Filter name. If not specified, no filter ex) 01.%20Graph:%20CVSS-Severity%20=>%20ServerName
-(*) datefrom and dateto must be specified as a set.
-Priority of date-related parameters
-High daterange > datefrom and dateto > time Low
-If none of these are specified, the latest date will be set.
-Examples
-Here are some examples.
-localhost.json of the latest date
-http://<server-address>:5111/?server=localhost.json
-localhost.json and raspberry10.json for the last 30 days
-http://<server-address>:5111/?daterange=last30days&server=localhost.json+raspberry10.json
-All servers (containers) from 2020-09-18 to 2020-11-16
-http://<server-address>:5111/?datefrom=2020-09-18&dateto=2020-11-16&server=all
-localhost.json on 2020-02-04T01:25:11Z
-http://<server-address>:5111/?time=2020-02-04T01:25:11Z&server=localhost.json
-localhost.json and vulsrepo@localhost.json on 2020-02-04T01:25:11Z
-http://<server-address>:5111/?time=2020-02-04T01:25:11Z&server=localhost.json+vulsrepo@localhost.json
-localhost.json on 2020-02-04T01:25:11Z with 01. Graph: CVSS-Severity => ServerName filter
-http://<server-address>:5111/?time=2020-02-04T01:25:11Z&server=localhost.json&filter=01.%20Graph:%20CVSS-Severity%20=%3E%20ServerName
-localhost.json on 2020-02-04T01:25:11Z with 02. Graph: CVSS-Severity => CVSS-Score filter
-http://<server-address>:5111/?time=2020-02-04T01:25:11Z&server=localhost.json&filter=02.%20Graph:%20CVSS-Severity%20=%3E%20CVSS-Score
-localhost.json on 2020-02-04T01:25:11Z with 03. Pivot: Package/CVSS-Severity/CveID/Summary => ServerName filter
-http://<server-address>:5111/?time=2020-02-04T01:25:11Z&server=localhost.json&filter=03.%20Pivot:%20Package/CVSS-Severity/CveID/Summary%20=%3E%20ServerName
-localhost.json on 2020-02-04T01:25:11Z with 04. Pivot: Package/CveID => ScanTime filter
-http://<server-address>:5111/?time=2020-02-04T01:25:11Z&server=localhost.json&filter=04.%20Pivot:%20Package/CveID%20=%3E%20ScanTime
-localhost.json on 2020-02-04T01:25:11Z with 05. Pivot: CveID/PackageInfo => NotFixedYet filter
-http://<server-address>:5111/?time=2020-02-04T01:25:11Z&server=localhost.json&filter=05.%20Pivot:%20CveID/PackageInfo%20=%3E%20NotFixedYet
-FAQ
-
-- Why does not Total of Vuls and VulsRepo result match ?
-
-Vuls aggregates the number of CveIDs included in the host. However, VulsRepo counts Packages related to CveID as one case. If more than one package is associated with one CveID, Total will increase more than Vuls.
-
-ギャラリー
-
-