ossf/cve-bin-tool

options:

  -h, --help            show this help message and exit

  -e EXCLUDE, --exclude EXCLUDE

                        Comma separated Exclude directory path

  -V, --version         show program's version number and exit

  --disable-version-check

                        skips checking for a new version

  --disable-validation-check

                        skips checking xml files against schema

  --offline             operate in offline mode

  --detailed            add CVE description in csv or json report (no effect on console, html or pdf)



CVE Data Download:

  Arguments related to data sources and Cache Configuration



  -n {api,api2,json,json-mirror,json-nvd}, --nvd {api,api2,json,json-mirror,json-nvd}

                        choose method for getting CVE lists from NVD

  -u {now,daily,never,latest}, --update {now,daily,never,latest}

                        update schedule for data sources and exploits database (default: daily)

  --nvd-api-key NVD_API_KEY

                        Specify NVD API key (used to improve NVD rate limit).

                        Set to `no` to ignore any keys in the environment.

  -d DISABLE_DATA_SOURCE, --disable-data-source DISABLE_DATA_SOURCE

                        comma-separated list of data sources (CURL, EPSS, GAD, NVD, OSV, PURL2CPE, REDHAT, RSD) to disable (default: NONE)



  --use-mirror USE_MIRROR

                        use an mirror to update the database



Input:

  directory             directory to scan

  -i INPUT_FILE, --input-file INPUT_FILE

                        provide input filename

  -C CONFIG, --config CONFIG

                        provide config file

  -L PACKAGE_LIST, --package-list PACKAGE_LIST

                        provide package list

  --sbom {spdx,cyclonedx,swid}

                        specify type of software bill of materials (sbom) (default: spdx)

  --sbom-file SBOM_FILE

                        provide sbom filename

  --vex-file VEX_FILE

                        provide vulnerability exploitability exchange (vex) filename for triage processing





Output:

  -q, --quiet           suppress output

  -l {debug,info,warning,error,critical}, --log {debug,info,warning,error,critical}

                        log level (default: info)

  -o OUTPUT_FILE, --output-file OUTPUT_FILE

                        provide output filename (default: output to stdout)

  --html-theme HTML_THEME

                        provide custom theme directory for HTML Report

  -f {csv,json,json2,console,html,pdf}, --format {csv,json,json2,console,html,pdf}

                        update output format (default: console)

                        specify multiple output formats by using comma (',') as a separator

                        note: don't use spaces between comma (',') and the output formats.

  --generate-config {yaml,toml,yaml,toml,toml,yaml}

                        generate config file for cve bin tool in toml and yaml formats.

  -c CVSS, --cvss CVSS  minimum CVSS score (as integer in range 0 to 10) to report (default: 0)

  -S {low,medium,high,critical}, --severity {low,medium,high,critical}

                        minimum CVE severity to report (default: low)

  --metrics             

                        check for metrics (e.g., EPSS) from found cves

  --epss-percentile EPSS_PERCENTILE

                        minimum epss percentile of CVE range between 0 to 100 to report. Automatically enables `--metrics`

  --epss-probability EPSS_PROBABILITY

                        minimum epss probability of CVE range between 0 to 100 to report. Automatically enables `--metrics`

  --no-0-cve-report     only produce report when CVEs are found

  -A [-], --available-fix [-]

                        Lists available fixes of the package from Linux distribution

  -b [-], --backport-fix [-]

                        Lists backported fixes if available from Linux distribution

  --affected-versions   Lists versions of product affected by a given CVE (to facilitate upgrades)

  --sbom-output SBOM_FILE

                        provide software bill of materials (sbom) filename to generate

  --sbom-type {spdx,cyclonedx}

                        specify type of software bill of materials (sbom) to generate (default: spdx)

  --sbom-format {tag,json,yaml}

                        specify format of software bill of materials (sbom) to generate (default: tag)

  --strip-scan-dir      strip scan directory from sbom evidence location paths and CVE paths (useful with a firmware dump)



Vex Output:

  Arguments related to Vex output document.



  --vex-ouptput VEX_FILE

                        Provide vulnerability exploitability exchange (vex) filename to generate

  --vex-type {cyclonedx, csaf, openvex}

                        specify type of vulnerability exploitability exchange (vex) to generate (default: cyclonedx)

  --product PRODUCT     Product Name

  --release RELEASE     Release Version

  --vendor VENDOR       Vendor/Supplier of Product

  -rr REVISION_REASON, --revision-reason REVISION_REASON

                        a reason for the update to the vex document should be specified in double quotes

  --filter-triage       Filter cves based on triage data from Vex file



Merge Report:

  Arguments related to Intermediate and Merged Reports



  -a [APPEND], --append [APPEND]

                        save output as intermediate report in json format

  -t TAG, --tag TAG     add a unique tag to differentiate between multiple intermediate reports

  -m MERGE, --merge MERGE

                        comma separated intermediate reports path for merging

  -F FILTER, --filter FILTER

                        comma separated tag string for filtering intermediate reports



Checkers:

  -s SKIPS, --skips SKIPS

                        comma-separated list of checkers to disable

  -r RUNS, --runs RUNS  comma-separated list of checkers to enable



Database Management:

  --import-json IMPORT_JSON

                        import database from json files chopped by years

  --ignore-sig          do not verify PGP signature while importing json data

  --log-signature-error

                        when the signature doesn't match log the error only instead of halting (UNSAFE)

  --verify PGP_PUBKEY_PATH

                        verify PGP sign while importing json files

  --export-json EXPORT_JSON

                        export database as json files chopped by years

  --pgp-sign PGP_PRIVATE_KEY_PATH

                        sign exported json files with PGP

  --passphrase PASSPHRASE

                        required passphrase for signing with PGP

  --export EXPORT       export database filename

  --import IMPORT       import database filename



Exploits:

  --exploits            check for exploits from found cves



Deprecated:

  --triage-input-file TRIAGE_INPUT_FILE

                        replaced by --vex-file

  -x, --extract         autoextract compressed files

  --report              Produces a report even if there are no CVE for the respective output format