Skip to content

Releases: Be-zerk/cveprio

Release list

cveprio 0.3.0

cveprio 0.3.0 Latest
Latest

Choose a tag to compare

View all tags
@Be-zerk Be-zerk released this 12 Oct 02:45
v0.3.0
c1cd16b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Settling "needs review" from vendors' version wording (opt-in: --auto-resolve, CVEPRIO_AUTO_RESOLVE)

  • Common wordings ("All versions prior to 26.6.5", "2.4.7 and earlier", "5.3.x prior to 5.3.18") are
    read by exact patterns in code that must match the whole sentence. This needs no AI model.
  • Unusual wording can go to the configured model, under strict rules. Versions are compared in code.
    A model's reading may confirm affected. It can contribute to not affected only by showing a
    version is outside an affected range, with no conditions or open-ended wording, and only when a
    structured source independently agrees. It must keep the record's own affected/fixed status, and
    harmless slips are repaired only by widening an affected range.
  • Reading the wording never overrides another source's open question (such as NVD's "only with
    Oracle JDK"), so such cases stay needs review.
  • Results: with auto-resolve, held-out applicability 4/4 (was 3/4) and decisions 3/4 (was 2/4),
    development set unchanged, 0 unsafe answers. A development result: the feature was designed after
    held-out case h05. With qwen2.5:3b the model resolved nothing; every misreading was rejected or
    contained. Adversarial tests in tests/test_auto_resolve.py.

Dashboard and reports

  • Reserved, not-found and unloadable CVEs are grouped as Cannot assess yet and list what is
    unknown, instead of "no action needed / nothing to do".
  • A summary line reports failed or rate-limited source lookups.
  • New colour-theme switch, visible keyboard focus, and a short legend separating priority, attack
    activity, severity and exposure.
  • AI-raised questions and AI status are shown in plain words. Results that used a model's reading are
    labelled "AI-read wording".
  • The declared-protection rule (attacked flaw → P2, not lower) is explained in reports and docs.

Evaluation

  • Held-out set: the first 4 of 20 cases are labelled by the author, and labels.csv parsing tolerates
    spreadsheet output.
  • Configurable model timeout (CVEPRIO_LLM_TIMEOUT_S); the evaluation reports why model calls failed.

Documentation and project

  • README rebuilt around the demo, with real screenshots and a per-outcome gallery
    (docs/SCREENSHOTS.md). Setup and troubleshooting moved to docs/USAGE.md, including a
    step-by-step guide for real use and "Using Ollama safely" notes.
  • MIT license. *.local.json is git-ignored for private inventories.

Try it: git clone https://github.com/Be-zerk/cveprio.git, then follow the README. The offline demo needs no keys and no network after installation.

Research prototype, not production software; see the README's limitations. Full history: CHANGELOG.md.

Assets 2
Loading