Script to check an installed packages list against the ubuntu-cve-tracker
Branch: master
Clone or download
Pull request Compare This branch is 5 commits ahead of davbo:master.
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitignore
README.md
requirements.txt
scan_packages.py

README.md

Active CVE Check

Checks a list of packages against the "active" (not yet patched) CVE's as listed in the Ubuntu CVE Tracker.

CVE information is fetched from the cve.circl.lu API.

It's a fork with some my improvements. The original project is hosted here.

How to use

Get the Ubuntu CVE Tracker repository (this will need to be updated periodically)

$ git clone https://git.launchpad.net/ubuntu-cve-tracker

Grab a list of installed packages from your Ubuntu host

$ dpkg-query -W -f='${source:Package}\n' | sort -u > installed_packages.txt

via SSH:

$ ssh user@host \
 "dpkg-query -W -f='\${source:Package}\n' | sort -u" > installed_packages.txt
Get this repository

$ git clone https://github.com/chinarulezzz/active-cve-check

Install the dependencies

$ pip install --user -r active-cve-check/requirements.txt

Scan the packages against the known active CVE's
$ python active-cve-check/scan_packages.py \
installed_packages.txt ubuntu-cve-tracker/active --ubuntu-version=trusty

CVE: CVE-2017-1000368
Package: sudo
CVSS: 7.2
Published: 2017-06-05T12:29:00.200000
Modified: 2017-06-05T12:29:00.217000
Summary: Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
References: http://www.securityfocus.com/bid/98838 https://www.sudo.ws/alerts/linux_tty.html


CVE: CVE-2017-13049
Package: tcpdump
CVSS: None
Published: 2017-09-14T02:29:03.030000
Modified: 2017-09-14T02:29:03.030000
Summary: The Rx protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-rx.c:ubik_print().
References: http://www.securitytracker.com/id/1039307 http://www.tcpdump.org/tcpdump-changes.txt https://github.com/the-tcpdump-group/tcpdump/commit/aa0858100096a3490edf93034a80e66a4d61aad5

...
Scan specific package against the known active CVE's
$ python active-cve-check/scan_packages.py \
 <(echo sudo) ubuntu-cve-tracker/active --ubuntu-version=trusty
or check the presence of specific CVE
$ python active-cve-check/scan_packages.py \
 <(echo tcpdump) ubuntu-cve-tracker/active --ubuntu-version=trusty | \
 grep CVE-2017-13049

Authors

License

Probably «AS IS». I wasn't contact the original author to ask the license to his script.