Skip to content

mithril 0.2.0

Choose a tag to compare

View all tags
@nmatt0 nmatt0 released this 13 Sep 01:35
· 37 commits to master since this release
v0.2.0
b131092

mithril 0.2.0

Detection and output:

  • Raw DER-encoded private key detection (PKCS#8, PKCS#1, SEC1), on top of the existing PEM handling (#2).
  • --license-paths: list the file locations of each license, not just a count, plus a paths array in JSON output (#6).
  • --kernel-cves-all: list every CVE for the detected kernel version against the full kernel.org (Linux CNA) feed, matched branch-aware; the kernel is now surfaced even with zero curated hits, with the curated list labeled non-exhaustive (#4).
  • The default human CVE view is gated to foothold-worthy findings (on CISA KEV, or high CVSS, or EPSS traction); --component-cves-all shows the full set (#9).

Accuracy:

  • Binary version extraction keeps the patch level for hostapd and wpa_supplicant (#10), and requires a real banner date or timestamp before reporting an OpenSSL or U-Boot version (#7).

Docs and CI:

  • Added a man page (mithril.1).
  • GitHub Actions: build and test, an ASan+UBSan job, and a libFuzzer smoke run on every PR and push (#8).

Thanks to @rabernethy for the DER private-key scanner.

Contributors

rabernethy
Assets 8
Loading