On 2019-02-06 15:28:24 +0000 (+0000), Victor Rodriguez wrote: [...]
This is the link to the tool that we could use to catch the CVEs
https://github.com/clearlinux/cve-check-tool
Hoep it helps as an starting point
That seems to be unmaintained for the past couple of years (last commit was from April 2017 and it has accumulated a number of untriaged issues and pull requests since then). If you're interested in using it, you may want to consider helping the previous maintainers resurrect it. Maybe also consider (actively-maintained) https://github.com/intel/cve-bin-tool which uses a different approach: looking for signs of vulnerable libraries linked into compiled files. It could help you identify when packages you're maintaining need to be rebuilt due to vulnerabilities in their dependencies. -- Jeremy Stanley