[Starlingx-discuss] CVE Support and Scanning

[Jeremy Stanley]

On 2019-02-06 15:28:24 +0000 (+0000), Victor Rodriguez  wrote:
[...]
> This is the link to the tool that we could use to catch the CVEs
>
> https://github.com/clearlinux/cve-check-tool
>
> Hoep it helps as an starting point

That seems to be unmaintained for the past couple of years (last
commit was from April 2017 and it has accumulated a number of
untriaged issues and pull requests since then). If you're
interested in using it, you may want to consider helping the
previous maintainers resurrect it.

Maybe also consider (actively-maintained)
https://github.com/intel/cve-bin-tool which uses a different
approach: looking for signs of vulnerable libraries linked into
compiled files. It could help you identify when packages you're
maintaining need to be rebuilt due to vulnerabilities in their
dependencies.
-- 
Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20190218/544d635e/attachment.sig>