|
1 | 1 | # CVE Binary Tool Release Notes |
2 | 2 |
|
| 3 | +## CVE Binary Tool 3.4 |
| 4 | + |
| 5 | +### Release highlights |
| 6 | + |
| 7 | +This release comes with the finished products from our two Google Summer of Code 2024 contributors: |
| 8 | + |
| 9 | +- GSoC 2024 contributor [@mastersans](https://github.com/mastersans) has improved our triage workflow and VEX support. |
| 10 | +- GSoC 2024 contributor [@inosmeet](https://github.com/inosmeet) has added PURL identifier support and improved tooling for reducing false positives. |
| 11 | + |
| 12 | +Thank you especially to [@anthonyharrison](https://github.com/anthonyharrison), [@BenL-github](https://github.com/BenL-github) and [@terriko](https://github.com/terriko) for being Google Summer of Code mentors for us this year. For more details about these projects, see the "Improved VEX support" and "PURL and mismatch database" sections below. |
| 13 | + |
| 14 | +This release also includes |
| 15 | + |
| 16 | +- numerous new and improved binary checkers thanks to [@ffontaine](https://github.com/ffontaine) |
| 17 | +- improvements both to our fuzzing infrastructure and fixes for issues found (shout out to [@joydeep049](https://github.com/joydeep049) who laid a lot of groundwork here) |
| 18 | +- many other bug fixes and features listed below. |
| 19 | + |
| 20 | +Thanks also to the many new bug reporters who gave us feedback this release. Your feedback has been instrumental in making cve-bin-tool better, and we're so glad you've been willing to work with us as we try to find fixes for your issues. We love finding out how people use cve-bin-tool and ways we can make it more useful to you! |
| 21 | + |
| 22 | +### Breaking changes |
| 23 | + |
| 24 | +The `--triage--input-file` flag has been replaced by `--vex-input`. (See VEX section below for details.) |
| 25 | + |
| 26 | +### Improved VEX support |
| 27 | + |
| 28 | +GSoC 2024 contributor [@mastersans](https://github.com/mastersans) has improved the CVE Binary Tool by revamping the VEX workflow to integrate Lib4vex, which now handles both parsing and generating VEX files. This update aligns the sbom_manager with the vex_manager structure, enhancing overall functionality. |
| 29 | + |
| 30 | +The focus was on integrating advanced VEX triage features, which involved a thorough refactoring of the existing workflow. This includes support for various VEX formats like CSAF, OpenVEX, and CycloneDX. Key enhancements include linking Components in the File being scanned using identifiers such as bom-ref and Package URL (purl) to precisely identify Product_Info (product, version, and vendor). Specifically, bom-ref is used in CycloneDX VEX, while purl is used in CSAF and OpenVEX formats. These identifiers help in accurately pinpointing product details like vendor and release. |
| 31 | + |
| 32 | +The triage process has also been streamlined: the old --triage-input-file flag is replaced with the new --vex-file flag. This new flag automatically detects the VEX format and whether the file is standalone or paired with a companion file. Additionally, the --filter-triage flag allows you to filter out vulnerabilities marked as NotAffected and FalsePositive in the VEX document, ensuring that only relevant vulnerabilities are reported. |
| 33 | + |
| 34 | +The new triaging documentation can be found here: https://cve-bin-tool.readthedocs.io/en/latest/triaging_process.html |
| 35 | + |
| 36 | +### PURL and Mismatch database |
| 37 | + |
| 38 | +GSoC 2024 contributor [@inosmeet](https://github.com/inosmeet) has added support for PURL identifiers and the purl2cpe database to our code, as well as a new "mismatch" database to help us fine tune product name matching. |
| 39 | + |
| 40 | +Previously, our code assumed that the product name in a language dependency list would match the product name in our vulnerability data sources, and this sometimes produced false positives when product names were re-used across languages/vendors. Using PURLs to more precisely identify components from language scans and the purl2cpe database to look up human-verified matches in the vulnerability database should increase cve-bin-tool's accuracy. |
| 41 | + |
| 42 | +The mismatch database provides another way to fine-tune results by allowing us to drop name collisions that are causing false positives. For example, there may be multiple languages with a package named "xml" -- if they had entries in the vulnerability databases then purl2cpe would handle finding the right one, but if they had no matches then we fallback to a search and sometimes found an incorrect set of vulnerabilities. This allows us to explicitly define mistaken matches and exclude them from results. |
| 43 | + |
| 44 | +The new mismatch documentation can be found here: https://cve-bin-tool.readthedocs.io/en/latest/mismatch_data.html |
| 45 | + |
| 46 | +## CVE Binary Tool 3.4rc3 |
| 47 | + |
| 48 | +Pre-release for v3.4. |
| 49 | + |
| 50 | +## CVE Binary Tool 3.4rc2 |
| 51 | + |
| 52 | +Some late-breaking changes to improve backwards compatibility and fix a bug in comment propagation for triage. |
| 53 | + |
| 54 | +## CVE Binary Tool 3.4rc1 |
| 55 | + |
| 56 | +Final (hopefully!) pre-release for 3.4. |
| 57 | + |
| 58 | +## CVE Binary Tool 3.4rc0 |
| 59 | + |
| 60 | +Pre-release for v3.4 |
| 61 | + |
| 62 | +## CVE Binary Tool 3.3 |
| 63 | + |
| 64 | +### Release highlights |
| 65 | + |
| 66 | +- GSoC 2023 contributor [@Rexbeast2](https://github.com/Rexbeast2) added support for EPSS scores to help users assess vulnerability risks (more info : https://cve-bin-tool.readthedocs.io/en/latest/MANUAL.html#metric) |
| 67 | + |
| 68 | +- GSoC 2023 contributor [@b31ngd3v](https://github.com/b31ngd3v) has set up a github action (available here: https://github.com/intel/cve-bin-tool-action) and did a lot of work related to using our new NVD mirror (available here: https://cveb.in/) |
| 69 | + |
| 70 | +- We now default to using our own NVD mirror unless an NVD_API_KEY is set. |
| 71 | + - The data is updated multiple times per day and duplicated to mirrors in several countries across the globe. They should be significantly faster than getting data from NVD directly, especially if you need to populate a database from scratch. |
| 72 | + - Mirroring infrastructure is provided by FCIX Software Mirrors, who currently provide a large portion of the global mirroring for linux distributions and other open source projects. |
| 73 | + - If you have difficulties with the mirrors or wish us to activate a mirror closer to you (we're only using a fraction of the servers available), please file an issue https://github.com/intel/cve-bin-tool/issues |
| 74 | + - These mirrors can be used in other tools or as part of research. We'd love to know if and how you use them! |
| 75 | + |
| 76 | +- Breaking Change: Windows users will now need to use python 3.12 if they want to scan tarfiles. |
| 77 | + - Testing has been disabled on windows for python < 3.12. It's likely that older versions of python will continue to work on Windows as long as you don't need tarfile support, but our binary checker tests use tarfiles so we can no longer run the full test suite. |
| 78 | + |
| 79 | +- We now provide our own version compare function, which will not be limited to PEP 440 compliant semantic versions. |
| 80 | + |
| 81 | +- Thanks especially to [@ffontaine](https://github.com/ffontaine) we are up to 359 binary checkers! |
| 82 | + |
| 83 | +- Our fuzz testing has been improved to cover more of our language file parsers. Thanks especially to [@joydeep049](https://github.com/joydeep049), [@mastersans](https://github.com/mastersans), [@raffifu](https://github.com/raffifu) and [@inosmeet](https://github.com/inosmeet) for their work in setting these up and fixing errors found via fuzzing. |
| 84 | + |
| 85 | +We've also got a large number of new contributors, many of whom participated in Hacktoberfest 2023 or the first part of GSoC 2024, as well as users and security experts who were generous enough to share their time and expertise with us outside of these open source beginner-focused programs. Thank you! |
| 86 | + |
| 87 | +## CVE Binary Tool 3.3rc3 pre-release |
| 88 | + |
| 89 | +Assorted bugfixes, new checkers, and improvements (see details below). This may be the last pre-release before 3.3 if we don't find any additional issues. |
| 90 | + |
| 91 | +BREAKING CHANGE: Windows users will now have to use python 3.12 if they intend to scan tarfiles. |
| 92 | + |
| 93 | +## CVE Binary Tool 3.3rc2 pre-release |
| 94 | + |
| 95 | +This pre-release improved the version compare function so it can handle certain distro versions and other special version cases more smoothly. Note that it does not have any special handling for hashes because they appear infrequently in the NVD data, but you may have some unpredictable results if you have hashes listed in an SBOM or local version. |
| 96 | + |
| 97 | +## CVE Binary Tool 3.3rc1 pre-release |
| 98 | + |
| 99 | +This has some fixes for the version compare function that were reported against the previous pre-release, as well as some new checkers and bugfixes. |
| 100 | + |
| 101 | +## CVE Binary Tool pre-release 3.3a0 |
| 102 | + |
| 103 | +Preview release for 3.3, which will hopefully be coming in December. |
| 104 | + |
| 105 | +There's a *lot* of changes in this release, but I'm particularly eager to have people try out the new version compare function and make sure it is sufficiently robust for arbitrary versions, as we needed to migrate away from the function provided in python packaging as it could not handle some of the versions we see in the NVD data. |
| 106 | + |
| 107 | +## CVE Binary Tool 3.2.1 |
| 108 | + |
| 109 | +Due to a change in the data used for the `curl` data source, we're issuing a slightly out of band point release for users unable to use 3.2. |
| 110 | + |
| 111 | +There are a number of checker updates to address false positives, new checkers, and other bug fixes and features as described below. |
| 112 | + |
| 113 | +One commonly requested feature has made it into this release: generation of SBOMs. Please try it out and let us know where it can be improved! |
| 114 | + |
| 115 | +Thanks especially to the *many* new contributors in this release |
| 116 | + |
| 117 | +- Many of you joined us via the Google Summer of Code 2023 selection process: I wish we'd had mentors and slots available to have more of you as paid contributors this year! |
| 118 | +- Some of you also joined us via the Intel Open Source Hackathon: thank you so much for taking the time to work with us and it's been a delight to work with so many experienced coders during the event. |
| 119 | +- And some of you just stopped by on your own with great ideas and fixes. Thank you! |
| 120 | + |
| 121 | + |
| 122 | +## CVE Bin Tool pre-release 3.2.1rc0 |
| 123 | + |
| 124 | +Due to a change in the data used for the `curl` data source, we're issuing a slightly out of band point release for users unable to use 3.2. |
| 125 | + |
| 126 | +There are a number of checker updates to address false positives, new checkers, and other bug fixes and features. |
| 127 | + |
| 128 | +One commonly requested feature has made it into this release: generation of SBOMs. Please try it out and let us know where it can be improved! |
| 129 | + |
3 | 130 | ## CVE Binary Tool 3.2 |
4 | 131 |
|
5 | 132 | ### New features from our GSoC 2022 participants: |
|
0 commit comments