Skip to content

Releases

OpenCVEC v0.1.1

OpenCVEC v0.1.1 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Nov 09:20
v0.1.1
07ef0b1

Visual identity release, plus one alerting fix.

Changes

  • New logo everywhere:
    • favicon, home-screen icons (192 and 512 px) and web app manifest;
    • sidebar and sign-in screen;
    • header of PDF and HTML reports (embedded, no external resource);
    • README and a GitHub social preview image.
  • Coherent colors. The interface accent follows the logo's purple (buttons, links, navigation, canaries). Yellow is now reserved for warnings and pending states, and the "probable / exposed" verdict moves to orange so it no longer looks like the brand color. Report verdict colors follow the same scheme.
  • Catalog wording updated: every checker is a signed plugin.

Fix

  • Honeytoken alerts. The DNS requests of a single canary read are recorded concurrently, so two of them could each miss the other and raise two alerts. The decision and insert now run under a PostgreSQL transaction lock per token, so one read raises exactly one alert. Found by CI and verified over 15 runs with the race detector.

Upgrade

docker pull ghcr.io/eizi0/opencvec:v0.1.1
docker compose up -d

No database change is needed beyond the automatic migrations.

Assets 8
Loading

OpenCVEC v0.1.0

OpenCVEC v0.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Nov 08:41
v0.1.0
ad9c090

First public release of OpenCVEC, a self-hosted CVE checker that proves exposure on assets you own, using canaries instead of exploitation.

Highlights

  • Proof by canary. Each check makes the target resolve a single-use DNS name bound by HMAC to one asset and one check, call the HTTP receiver, or read back a canary file planted on the asset. Built-in authoritative DNS server and HTTP receiver.

  • Anti-abuse by design.

    • Mandatory proof of ownership (DNS TXT, /.well-known or administrator allowlist), re-validated before every campaign.
    • Fixed payloads; the network guard blocks DNS rebinding and access to private or metadata addresses.
    • Rate limits and an append-only, hash-chained audit log.

  • Signed YAML plugins. Every checker is a plugin. 10 official plugins are embedded and preinstalled, including offline:

    • DNS callback: Log4Shell, Text4Shell, Spring Cloud Function, Confluence OGNL, PHP-CGI;
    • canary file: Apache traversal;
    • fingerprint: regreSSHion, PHP2Shell, WP2Shell, FortiBleed exposure.

    New plugins are installed from the official catalog or by file, after review and Ed25519 signature check (opencvec plugin keygen | lint | sign | verify | index).

  • Honeytoken alerts. A canary file read outside a check raises a compromise alert.

  • Operations. Notifications (webhook JSON / Slack / Teams, SMTP), scheduled checks, personal API tokens, PDF / HTML / JSON reports with SHA-256 fingerprints, data retention, English and French interface.

  • Small footprint. A 7 MB distroless image for amd64 and arm64, about 11 MiB of RAM at idle, plus PostgreSQL. Two deployment modes:

    • internal network, through a conditional DNS forwarder;
    • Internet, through NS delegation.

Validation

12 lab scenarios against real vulnerable and patched targets (lab/compose.yaml, scripts/lab-e2e.sh, scripts/lab-plugins-e2e.sh). Go unit and PostgreSQL integration tests, front-end tests, govulncheck and npm audit clean.

Known limitations

  • Not yet tested on a real public DNS delegation or a real corporate DNS forwarder.
  • Confluence, PHP-CGI and FortiBleed plugins are covered by unit tests only (no free lab image).
  • Server-generated texts (verdict summaries, errors) and plugin descriptions are in French.

Install

docker pull ghcr.io/eizi0/opencvec:v0.1.0

See README and docs/deployment.md.

Loading