This version adds a component vulnerability search, gives every NIST
query a chosen ordering reference, and repairs the queries themselves,
which returned only a fraction of the CVEs that matched.
NEW OPTIONS
- --nist 6 lists the CVEs associated with a component, given either its
name or the path to a local binary. Naming it works on any platform:
--nist 6 --NIST openssl, WebKit or Safari. Pointing at a Windows PE
searches three keys and merges the results: the file name on disk, the
internal name in its VERSIONINFO and its component description, so
--nist 6 --NIST afd.sys matches 7 CVEs while passing the driver itself
matches 74, because modern NVD entries name the component ("Ancillary
Function Driver for WinSock") and not the file. A file that is not a
Windows PE carries no such metadata, so only its name is searched and
the report says so. Off Windows, name the project rather than the file
it ships as: libssl.so.3 matches 9 CVEs where openssl matches 658.
Results are a table, most recent first.
REPAIRED OPTIONS
-
--nist 1, 3, 4 and 5 returned only the last one percent of the CVEs
that matched and discarded everything older than the previous year, so
a keyword search for "Ancillary Function Driver" reported 1 CVE of the
74 that matched and --time did not recover them. The queries now
paginate through the whole result set, and a year filter is applied
only when --time asks for one. -
--nist 1 sent a CPE to NIST only when the value carried a concrete
version; every other value, including a CPE without a version, became
a keyword search over the CVE text. A partial CPE is now matched as a
CPE, so --nist 1 --NIST "cpe:2.3:a:openbsd:openssh" reports the 137
CVEs of the product instead of the descriptions that mention it.
NEW BEHAVIOUR
-
All NIST results are ordered most recent first, by the year in the CVE
ID. NVD often publishes a record years after its ID was assigned, so
--sort-by published orders by the NVD publication date instead. The
choice governs --time as well, which used to bound results by the CVE
ID year while the table was ordered by publication date: --time 5 on
a component listed 17 CVEs when 28 had been published inside that
window. Both surfaces now use one reference, and the closing line of
the table names which one produced the order. -
--nist 6 lists the 25 most recent CVEs, since the whole history of a
component is rarely what is wanted. --ncves lists more,
--ncves 0 lists all and --time bounds them by year. -
NIST matches the words of a keyword separately rather than as a
phrase, so a component named with common words also matches other
vendors' products: "HTTP Protocol Stack" matches Apache, Envoy and
Novell CVEs. A Vendor column and a closing line name the vendors of
the affected products, taken from the CPE data of each CVE, and the
exported records carry them. -
--rpp is the page size used while paginating and defaults to 2000, the
NIST maximum. A query that cannot be retrieved completely now says so
instead of silently returning its oldest part.
INTERACTIVE AND GRAPHICAL MODES
- The component search is reachable as "nist component <name|file>" in
interactive mode and as NIST Component in the TUI.
REPORTS
- Advisory lines are wrapped by terminal cells instead of by characters,
so a value holding East Asian characters no longer runs past the rule
of its own table. Every report that prints an advisory is affected.
The changes below are security fixes.
-
LOW: every value that becomes part of an NIST query is now length
capped and stripped of terminal control characters, whether it was
typed, taken from a file name or read out of a binary, and the file
handle is released when a binary cannot be parsed. -
LOW: a negative --ncves printed an empty table instead of the CVEs
that matched, and a negative --time discarded all of them. Both now
list everything rather than reporting a component as clean.