Skip to content

v0.4.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 20:22
· 7 commits to master since this release
v0.4.0
3f5bf55
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

mithril 0.4.0 extends the --keys pass to recover near-zero EC private scalars (the October 2026 eMudhra P-384 CA compromise), teaches --cve to offer the vulnerability mirror on first run, recovers an SBOM from monolithic non-ELF firmware, and renames a pair of CVE-detail flags for coherence. It stays fully offline at scan time and has zero third-party runtime dependencies; the vulnerability index is distributed separately (fetch it after install with mithril --fetch-db).

Heads up: this release renames two flags with no aliases. If you script --component-cves-all or --kernel-cves-all, see Breaking changes below before upgrading.

Highlights

Public-key weakness (--keys)

  • Recover near-zero EC private scalars by a bounded d*G == Q search, the EC analog of the existing RSA factoring recoveries. This detects the October 2026 eMudhra P-384 CA compromise, and covers P-256, P-384, P-521, and secp256k1.
  • The eight real compromised eMudhra intermediate CAs are fingerprinted against the compiled-in corpus, so a direct match reports even when the scalar is out of search range.

CVE mirror (--cve)

  • On an interactive terminal with no local mirror, --cve now offers to download it before scanning instead of failing outright.
  • New --no-fetch (and the MITHRIL_NO_FETCH environment variable) suppress the offer for scripts and CI, where a missing mirror stays a hard error with a nonzero exit, exactly as before.

SBOM

  • Recover components from monolithic non-ELF firmware (a single flat image with no package manager and no ELF objects), widening coverage of stripped and bare-metal targets.
  • -C/--outdir now documents its full output set: mithril-report.json, plus sbom.cdx.json and sbom.spdx.json when the SBOM pass runs.

Breaking changes

  • --component-cves-all is now --component-cves-full.
  • --kernel-cves-all is now --kernel-cves-full.

No aliases are kept. The names now read consistently: --all / -A means all passes, while --full means all detail within a pass. A new --full turns on maximum human detail in one switch (verbose, license paths, and both full CVE listings). JSON output is always complete and is unaffected by any of these.

Install

  • Homebrew: brew install nmatt0/tap/mithril
  • Prebuilt binaries / .deb: attached below (linux-x86_64, linux-arm64, macos-arm64).
  • From source: cmake -S . -B build -DCMAKE_BUILD_TYPE=Release && cmake --build build -j
  • After install, fetch the offline vulnerability index: mithril --fetch-db
Assets 12
Loading