From e43d07e5594a0922efb0b2fd601a14c401d62893 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?alex=2Echeng=20=E9=84=AD=E6=BB=87=E6=BF=A4?= Date: Thu, 19 Jun 2025 15:05:24 +0800 Subject: [PATCH 1/4] Add PE metadata extraction for Python version in checker --- cve_bin_tool/checkers/openssl.py | 3 + cve_bin_tool/checkers/openssl.py.bak | 27 + cve_bin_tool/checkers/python.py | 3 + cve_bin_tool/checkers/python.py.bak | 29 + cve_bin_tool/version_scanner.py | 22 + dummy_vex_output | 256 +++ output.cve-bin-tool.2025-06-19.14-59-23.csv | 8 + output.cve-bin-tool.2025-06-19.14-59-23.json | 108 ++ test-report.html | 1536 ++++++++++++++++++ test-report.json | 108 ++ test.sbom | 11 + testfile.csv | 1 + 12 files changed, 2112 insertions(+) create mode 100644 cve_bin_tool/checkers/openssl.py.bak create mode 100644 cve_bin_tool/checkers/python.py.bak create mode 100644 dummy_vex_output create mode 100644 output.cve-bin-tool.2025-06-19.14-59-23.csv create mode 100644 output.cve-bin-tool.2025-06-19.14-59-23.json create mode 100644 test-report.html create mode 100644 test-report.json create mode 100644 test.sbom create mode 100644 testfile.csv diff --git a/cve_bin_tool/checkers/openssl.py b/cve_bin_tool/checkers/openssl.py index a8f3a742db..6205fb7534 100644 --- a/cve_bin_tool/checkers/openssl.py +++ b/cve_bin_tool/checkers/openssl.py @@ -18,6 +18,9 @@ class OpensslChecker(Checker): CONTAINS_PATTERNS = [r"part of OpenSSL", r"openssl.cnf", r"-DOPENSSL_"] FILENAME_PATTERNS = [r"libssl.so.", r"libcrypto.so"] VERSION_PATTERNS = [ + # for general format: OpenSSL 1.0.2uĦBOpenSSL 3.0.0ĦBOpenSSL 1.1.1k + r"OpenSSL\s+([0-9]+\.[0-9]+\.[0-9]+[a-z]*)", + r"OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+\r?\n(?:%s \(Library: %s\)|[a-zA-Z0-9:,_ \.\-\r\n]*OPENSSLDIR|ssl)", r"(?:%s \(Library: %s\)\r?\n|OPENSSLDIR[a-zA-Z0-9:/ \"\-\r\n]*)OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+", ] diff --git a/cve_bin_tool/checkers/openssl.py.bak b/cve_bin_tool/checkers/openssl.py.bak new file mode 100644 index 0000000000..6205fb7534 --- /dev/null +++ b/cve_bin_tool/checkers/openssl.py.bak @@ -0,0 +1,27 @@ +# Copyright (C) 2021 Intel Corporation +# SPDX-License-Identifier: GPL-3.0-or-later + + +""" +CVE checker for openssl + +References: +https://www.openssl.org/news/vulnerabilities.html +http://www.cvedetails.com/vulnerability-list/vendor_id-217/product_id-383/Openssl-Openssl.html + +RSS feed: http://www.cvedetails.com/vulnerability-feed.php?vendor_id=217&product_id=383&version_id=&orderby=3&cvssscoremin=0 +""" +from cve_bin_tool.checkers import Checker + + +class OpensslChecker(Checker): + CONTAINS_PATTERNS = [r"part of OpenSSL", r"openssl.cnf", r"-DOPENSSL_"] + FILENAME_PATTERNS = [r"libssl.so.", r"libcrypto.so"] + VERSION_PATTERNS = [ + # for general format: OpenSSL 1.0.2uĦBOpenSSL 3.0.0ĦBOpenSSL 1.1.1k + r"OpenSSL\s+([0-9]+\.[0-9]+\.[0-9]+[a-z]*)", + + r"OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+\r?\n(?:%s \(Library: %s\)|[a-zA-Z0-9:,_ \.\-\r\n]*OPENSSLDIR|ssl)", + r"(?:%s \(Library: %s\)\r?\n|OPENSSLDIR[a-zA-Z0-9:/ \"\-\r\n]*)OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+", + ] + VENDOR_PRODUCT = [("openssl", "openssl")] diff --git a/cve_bin_tool/checkers/python.py b/cve_bin_tool/checkers/python.py index f7ae562b79..e90bad2b7b 100644 --- a/cve_bin_tool/checkers/python.py +++ b/cve_bin_tool/checkers/python.py @@ -19,6 +19,9 @@ class PythonChecker(Checker): ] FILENAME_PATTERNS = [r"python"] VERSION_PATTERNS = [ + # to match the data from PE file + r"[Pp]ython ([0-9]+\.[0-9]+\.[0-9]+)", + r"src\\python[23]\\Python-([23]+\.[0-9]+\.[0-9]+)", r"python(?:[23]+\.[0-9]+)-([23]+\.[0-9]+\.[0-9]+)", r"pymalloc_debug\r?\n([23]+\.[0-9]+\.[0-9]+)", diff --git a/cve_bin_tool/checkers/python.py.bak b/cve_bin_tool/checkers/python.py.bak new file mode 100644 index 0000000000..f7ae562b79 --- /dev/null +++ b/cve_bin_tool/checkers/python.py.bak @@ -0,0 +1,29 @@ +# Copyright (C) 2021 Intel Corporation +# SPDX-License-Identifier: GPL-3.0-or-later + +""" +CVE checker for Python +References: +https://www.cvedetails.com/vulnerability-list/vendor_id-10210/product_id-18230/Python-Python.html + + +""" +from cve_bin_tool.checkers import Checker + + +class PythonChecker(Checker): + CONTAINS_PATTERNS = [ + r"Fatal Python error: unable to decode the command line argument", + r"Internal error in the Python interpreter", + r"CPython", + ] + FILENAME_PATTERNS = [r"python"] + VERSION_PATTERNS = [ + r"src\\python[23]\\Python-([23]+\.[0-9]+\.[0-9]+)", + r"python(?:[23]+\.[0-9]+)-([23]+\.[0-9]+\.[0-9]+)", + r"pymalloc_debug\r?\n([23]+\.[0-9]+\.[0-9]+)", + r"([23]+\.[0-9]+\.[0-9]+)\r?\nPython %s", + r"([23]+\.[0-9]+\.[0-9]+)\r?\n%\.80s \(%\.80s\) %\.80s", + r"tags/v([23]+\.[0-9]+\.[0-9]+)\r?\n", + ] + VENDOR_PRODUCT = [("python_software_foundation", "python"), ("python", "python")] diff --git a/cve_bin_tool/version_scanner.py b/cve_bin_tool/version_scanner.py index 7940e51f96..829a70e418 100644 --- a/cve_bin_tool/version_scanner.py +++ b/cve_bin_tool/version_scanner.py @@ -231,6 +231,27 @@ def is_linux_kernel(self, filename: str) -> tuple[bool, str | None]: return False, output + # used to get product name, version, vendor info PE metadata + def extract_version_from_pe(self, filename: str) -> str: + info = "" + try: + import pefile + with pefile.PE(filename) as pe: + #pe = pefile.PE(filename) + for fileinfo in pe.FileInfo: + for entry in fileinfo: + if entry.Key == b'StringFileInfo': + for st in entry.StringTable: + entries = st.entries + product_name = entries.get(b'ProductName', b'').decode(errors='ignore') + product_version = entries.get(b'ProductVersion', b'').decode(errors='ignore') + company_name = entries.get(b'CompanyName', b'').decode(errors='ignore') + info = (f" {product_name} {product_version} {company_name}") + self.logger.debug(f"peFile.PE Metadata:{info}") + except Exception as e: + LOGGER.debug(f"[PE Metadata] Failed to parse PE file {filename}: {e}") + return info + def scan_file(self, filename: str) -> Iterator[ScanInfo]: """Scans a file to see if it contains any of the target libraries, and whether any of those contain CVEs""" @@ -261,6 +282,7 @@ def scan_file(self, filename: str) -> Iterator[ScanInfo]: # parse binary file's strings lines = parse_strings(filename) + lines += self.extract_version_from_pe(filename) if self.no_scan: yield from self.run_checkers(filename, lines) diff --git a/dummy_vex_output b/dummy_vex_output new file mode 100644 index 0000000000..832b433ea9 --- /dev/null +++ b/dummy_vex_output @@ -0,0 +1,256 @@ +{ + "document": { + "category": "csaf_vex", + "csaf_version": "2.0", + "notes": [ + { + "category": "summary", + "title": "Technical Summary", + "text": "Auto generated CSAF document" + } + ], + "publisher": { + "category": "vendor", + "name": "TestVendor", + "namespace": "https://www.example.com", + "contact_details": "TestVendor" + }, + "title": "", + "tracking": { + "current_release_date": "2025-06-19T06:59:24Z", + "generator": { + "date": "2025-06-19T06:59:24Z", + "engine": { + "name": "csaf-tool", + "version": "0.3.2" + } + }, + "id": "TESTPRODUCT-1.0-VEX", + "initial_release_date": "2025-06-19T06:59:24Z", + "revision_history": [ + { + "date": "2025-06-19T06:59:24Z", + "number": "1", + "summary": "None" + } + ], + "status": "final", + "version": "1" + } + }, + "product_tree": { + "branches": [ + { + "category": "vendor", + "name": "TestVendor", + "branches": [ + { + "category": "product_name", + "name": "TestProduct", + "branches": [ + { + "category": "product_version", + "name": "1.0", + "product": { + "name": "TestVendor TestProduct 1.0", + "product_id": "CSAFPID_0001", + "product_identification_helper": { + "sbom_urls": [ + "file:///D:/PythonEnv/dev/cve-bin-tool" + ] + } + } + } + ] + } + ] + } + ] + }, + "vulnerabilities": [ + { + "cve": "CVE-1234-1004", + "notes": [ + { + "category": "description", + "title": "CVE description", + "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1004" + } + ], + "product_status": { + "under_investigation": [ + "CSAFPID_0001" + ] + }, + "threats": [ + { + "category": "impact", + "details": "", + "date": "2025-06-19T06:59:24Z", + "product_ids": [ + "CSAFPID_0001" + ] + } + ] + }, + { + "cve": "CVE-1234-1005", + "notes": [ + { + "category": "description", + "title": "CVE description", + "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1005" + } + ], + "product_status": { + "known_not_affected": [ + "CSAFPID_0001" + ] + }, + "flags": [ + { + "date": "2025-06-19T06:59:24Z", + "label": "component_not_present", + "product_ids": [ + "CSAFPID_0001" + ] + } + ], + "threats": [ + { + "category": "impact", + "details": "Detail field populated.", + "date": "2025-06-19T06:59:24Z", + "product_ids": [ + "CSAFPID_0001" + ] + } + ] + }, + { + "cve": "CVE-1234-1006", + "notes": [ + { + "category": "description", + "title": "CVE description", + "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1006" + } + ], + "product_status": { + "under_investigation": [ + "CSAFPID_0001" + ] + }, + "threats": [ + { + "category": "impact", + "details": "Data field populated.", + "date": "2025-06-19T06:59:24Z", + "product_ids": [ + "CSAFPID_0001" + ] + } + ] + }, + { + "cve": "CVE-1234-1007", + "notes": [ + { + "category": "description", + "title": "CVE description", + "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1007" + } + ], + "product_status": { + "fixed": [ + "CSAFPID_0001" + ] + }, + "threats": [ + { + "category": "impact", + "details": "Data field populated.", + "date": "2025-06-19T06:59:24Z", + "product_ids": [ + "CSAFPID_0001" + ] + } + ] + }, + { + "cve": "CVE-1234-1008", + "notes": [ + { + "category": "description", + "title": "CVE description", + "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1008" + } + ], + "product_status": { + "under_investigation": [ + "CSAFPID_0001" + ] + }, + "threats": [ + { + "category": "impact", + "details": "", + "date": "2025-06-19T06:59:24Z", + "product_ids": [ + "CSAFPID_0001" + ] + } + ] + }, + { + "cve": "CVE-1234-1009", + "notes": [ + { + "category": "description", + "title": "CVE description", + "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1009" + } + ], + "product_status": { + "under_investigation": [ + "CSAFPID_0001" + ] + }, + "threats": [ + { + "category": "impact", + "details": "", + "date": "2025-06-19T06:59:24Z", + "product_ids": [ + "CSAFPID_0001" + ] + } + ] + }, + { + "cve": "CVE-1234-1010", + "notes": [ + { + "category": "description", + "title": "CVE description", + "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1010" + } + ], + "product_status": { + "under_investigation": [ + "CSAFPID_0001" + ] + }, + "threats": [ + { + "category": "impact", + "details": "", + "date": "2025-06-19T06:59:24Z", + "product_ids": [ + "CSAFPID_0001" + ] + } + ] + } + ] +} diff --git a/output.cve-bin-tool.2025-06-19.14-59-23.csv b/output.cve-bin-tool.2025-06-19.14-59-23.csv new file mode 100644 index 0000000000..f8eac84498 --- /dev/null +++ b/output.cve-bin-tool.2025-06-19.14-59-23.csv @@ -0,0 +1,8 @@ +vendor,product,version,cve_number,severity,score,source,cvss_version,cvss_vector,paths,remarks,comments +vendor0,product0,1.0,CVE-1234-1004,CRITICAL,4.2,NVD,2,C:H,,NewFound, +vendor0,product0,1.0,CVE-1234-1005,MEDIUM,4.2,NVD,2,C:H,,NotAffected,Detail field populated. +vendor0,product0,1.0,CVE-1234-1006,LOW,1.2,NVD,2,CVSS2.0/C:H,,NewFound,Data field populated. +vendor0,product0,2.8.6,CVE-1234-1007,LOW,2.5,NVD,3,CVSS3.0/C:H/I:L/A:M,,Mitigated,Data field populated. +vendor0,product0,2.8.6,CVE-1234-1008,UNKNOWN,2.5,NVD,3,CVSS3.0/C:H/I:L/A:M,,NewFound, +vendor0,product0,2.8.6,CVE-1234-1009,MEDIUM,2.5,NVD,3,CVSS3.0/C:H/I:L/A:M,,NewFound, +vendor1,product1,3.2.1.0,CVE-1234-1010,HIGH,7.5,OSV,2,C:H/I:L/A:M,,NewFound, diff --git a/output.cve-bin-tool.2025-06-19.14-59-23.json b/output.cve-bin-tool.2025-06-19.14-59-23.json new file mode 100644 index 0000000000..a7af55381e --- /dev/null +++ b/output.cve-bin-tool.2025-06-19.14-59-23.json @@ -0,0 +1,108 @@ +[ + { + "vendor": "vendor0", + "product": "product0", + "version": "1.0", + "cve_number": "CVE-1234-1004", + "severity": "CRITICAL", + "score": "4.2", + "source": "NVD", + "cvss_version": "2", + "cvss_vector": "C:H", + "paths": "", + "remarks": "NewFound", + "comments": "" + }, + { + "vendor": "vendor0", + "product": "product0", + "version": "1.0", + "cve_number": "CVE-1234-1005", + "severity": "MEDIUM", + "score": "4.2", + "source": "NVD", + "cvss_version": "2", + "cvss_vector": "C:H", + "paths": "", + "remarks": "NotAffected", + "comments": "Detail field populated.", + "response": [ + "will_not_fix" + ], + "justification": "code_not_reachable" + }, + { + "vendor": "vendor0", + "product": "product0", + "version": "1.0", + "cve_number": "CVE-1234-1006", + "severity": "LOW", + "score": "1.2", + "source": "NVD", + "cvss_version": "2", + "cvss_vector": "CVSS2.0/C:H", + "paths": "", + "remarks": "NewFound", + "comments": "Data field populated.", + "response": [ + "workaround_available" + ], + "justification": "protected_by_mitigating_control" + }, + { + "vendor": "vendor0", + "product": "product0", + "version": "2.8.6", + "cve_number": "CVE-1234-1007", + "severity": "LOW", + "score": "2.5", + "source": "NVD", + "cvss_version": "3", + "cvss_vector": "CVSS3.0/C:H/I:L/A:M", + "paths": "", + "remarks": "Mitigated", + "comments": "Data field populated." + }, + { + "vendor": "vendor0", + "product": "product0", + "version": "2.8.6", + "cve_number": "CVE-1234-1008", + "severity": "UNKNOWN", + "score": "2.5", + "source": "NVD", + "cvss_version": "3", + "cvss_vector": "CVSS3.0/C:H/I:L/A:M", + "paths": "", + "remarks": "NewFound", + "comments": "" + }, + { + "vendor": "vendor0", + "product": "product0", + "version": "2.8.6", + "cve_number": "CVE-1234-1009", + "severity": "MEDIUM", + "score": "2.5", + "source": "NVD", + "cvss_version": "3", + "cvss_vector": "CVSS3.0/C:H/I:L/A:M", + "paths": "", + "remarks": "NewFound", + "comments": "" + }, + { + "vendor": "vendor1", + "product": "product1", + "version": "3.2.1.0", + "cve_number": "CVE-1234-1010", + "severity": "HIGH", + "score": "7.5", + "source": "OSV", + "cvss_version": "2", + "cvss_vector": "C:H/I:L/A:M", + "paths": "", + "remarks": "NewFound", + "comments": "" + } +] \ No newline at end of file diff --git a/test-report.html b/test-report.html new file mode 100644 index 0000000000..842d60fa34 --- /dev/null +++ b/test-report.html @@ -0,0 +1,1536 @@ + + + + + + + CVE-BIN-TOOL | Descriptive Report + + + + + + + + + + + +
+ + +
+
+ + + +
+
+ +
+
+
CVE Summary
+
+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + +
SeverityCount
CRITICAL1
HIGH1
MEDIUM2
LOW2
+
+
+
+ +
+ +
+
+
CVE Remarks
+
+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
RemarkCount
NEW5
CONFIRMED0
MITIGATED1
UNEXPLORED0
FALSE POSITIVE0
NOT AFFECTED1
+
+
+
+ +
+ +
+ +
+
+
+ +
+ Scanned Files: + 0 +
+
+
+
+ Vulnerable Files: + 0 +
+
+
+
+ + +
+ +
+
+
+
+
+
+
+ +
+
+
Product CVEs
+
+ + +
+ +
+
+
+
+
+
+
+
CVE metric
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
CVE numberCVSS versionCVSS scoreEPSS probabilityEPSS percentile
CVE-1234-100621.21.8360.79673
CVE-1234-100932.53.8950.37350
CVE-1234-101027.54.680.34072
+
+
+ +
+ +
+
+ +
+
+
+
+
Products Scanned + +
+
+
+
+
+ +
+ + +
+
+ +
+
+ + + + + + + +
+ +
+ +
+ +
+
+
+
    +
    +
    +
    Vendor Name +
    +
    Product Name +
    +
    Version +
    +
    CVE Count +
    +
    +
    + + +
    +
    + vendor0 +
    +
    + product0  + + NEW + +
    +
    + 1.0 +
    + +
    + 3 +
    + + + +
    + +
    + +
    + +     + + +
    +
    + vendor0 +
    +
    + product0  + + NEW + +
    +
    + 2.8.6 +
    + +
    + 3 +
    + + + +
    + +
    + +
    + +     + + +
    +
    + vendor1 +
    +
    + product1  + + NEW + +
    +
    + 3.2.1.0 +
    + +
    + 1 +
    + + + +
    + +
    + +
    + +     + +
+
+
+
+ + +
+ +
+ + + + + +
+
+
+
+

CVE Binary Tool v 3.4.1rc0

+
+
+
+
+
+

Facing Issues?

+
+
+
+ Let us know by creating a new issue. +

+ + + New Issue

+
+
+
+
+
+
+

Have Suggestions?

+
+
+
+ Our community would love to hear your invaluable suggestions. +

+ + Gitter

+
+
+
+ +
+
+
+

Want to Contribute?

+
+
+
+ The cve-bin-tool community always welcomes new ideas and contributors. Join us to learn about security vulnerabilities in your binaries. +

+ + + GitHub

+
+
+
+
+
+
+
+

This report was generated with + + + | cve-bin-tool. +

+
+
+
+
+
+ + + + + + + + + \ No newline at end of file diff --git a/test-report.json b/test-report.json new file mode 100644 index 0000000000..a7af55381e --- /dev/null +++ b/test-report.json @@ -0,0 +1,108 @@ +[ + { + "vendor": "vendor0", + "product": "product0", + "version": "1.0", + "cve_number": "CVE-1234-1004", + "severity": "CRITICAL", + "score": "4.2", + "source": "NVD", + "cvss_version": "2", + "cvss_vector": "C:H", + "paths": "", + "remarks": "NewFound", + "comments": "" + }, + { + "vendor": "vendor0", + "product": "product0", + "version": "1.0", + "cve_number": "CVE-1234-1005", + "severity": "MEDIUM", + "score": "4.2", + "source": "NVD", + "cvss_version": "2", + "cvss_vector": "C:H", + "paths": "", + "remarks": "NotAffected", + "comments": "Detail field populated.", + "response": [ + "will_not_fix" + ], + "justification": "code_not_reachable" + }, + { + "vendor": "vendor0", + "product": "product0", + "version": "1.0", + "cve_number": "CVE-1234-1006", + "severity": "LOW", + "score": "1.2", + "source": "NVD", + "cvss_version": "2", + "cvss_vector": "CVSS2.0/C:H", + "paths": "", + "remarks": "NewFound", + "comments": "Data field populated.", + "response": [ + "workaround_available" + ], + "justification": "protected_by_mitigating_control" + }, + { + "vendor": "vendor0", + "product": "product0", + "version": "2.8.6", + "cve_number": "CVE-1234-1007", + "severity": "LOW", + "score": "2.5", + "source": "NVD", + "cvss_version": "3", + "cvss_vector": "CVSS3.0/C:H/I:L/A:M", + "paths": "", + "remarks": "Mitigated", + "comments": "Data field populated." + }, + { + "vendor": "vendor0", + "product": "product0", + "version": "2.8.6", + "cve_number": "CVE-1234-1008", + "severity": "UNKNOWN", + "score": "2.5", + "source": "NVD", + "cvss_version": "3", + "cvss_vector": "CVSS3.0/C:H/I:L/A:M", + "paths": "", + "remarks": "NewFound", + "comments": "" + }, + { + "vendor": "vendor0", + "product": "product0", + "version": "2.8.6", + "cve_number": "CVE-1234-1009", + "severity": "MEDIUM", + "score": "2.5", + "source": "NVD", + "cvss_version": "3", + "cvss_vector": "CVSS3.0/C:H/I:L/A:M", + "paths": "", + "remarks": "NewFound", + "comments": "" + }, + { + "vendor": "vendor1", + "product": "product1", + "version": "3.2.1.0", + "cve_number": "CVE-1234-1010", + "severity": "HIGH", + "score": "7.5", + "source": "OSV", + "cvss_version": "2", + "cvss_vector": "C:H/I:L/A:M", + "paths": "", + "remarks": "NewFound", + "comments": "" + } +] \ No newline at end of file diff --git a/test.sbom b/test.sbom new file mode 100644 index 0000000000..cba409e653 --- /dev/null +++ b/test.sbom @@ -0,0 +1,11 @@ +SPDXVersion: SPDX-2.3 +DataLicense: CC0-1.0 +SPDXID: SPDXRef-DOCUMENT +DocumentName: SBOM_CVEBINTOOL-CVE-SCAN +DocumentNamespace: http://spdx.org/spdxdocs/SBOM_CVEBINTOOL-CVE-SCAN-a8b7f78b-e567-4ea3-a427-3cdc7b389bfd +LicenseListVersion: 3.25 +Creator: Tool: cve-bin-tool-3.4.1rc0 +Created: 2025-06-19T14:59:23Z +CreatorComment: This document has been automatically generated. +##### + diff --git a/testfile.csv b/testfile.csv new file mode 100644 index 0000000000..9a2c7732fa --- /dev/null +++ b/testfile.csv @@ -0,0 +1 @@ +testing \ No newline at end of file From 515dc7764a5db0e0b094fb3769351fe613052dbd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?alex=2Echeng=20=E9=84=AD=E6=BB=87=E6=BF=A4?= Date: Thu, 19 Jun 2025 15:14:22 +0800 Subject: [PATCH 2/4] Remove test and backup files from commit --- cve_bin_tool/checkers/openssl.py.bak | 27 - cve_bin_tool/checkers/python.py.bak | 29 - dummy_vex_output | 256 --- output.cve-bin-tool.2025-06-19.14-59-23.csv | 8 - output.cve-bin-tool.2025-06-19.14-59-23.json | 108 -- test-report.html | 1536 ------------------ test-report.json | 108 -- test.sbom | 11 - testfile.csv | 1 - 9 files changed, 2084 deletions(-) delete mode 100644 cve_bin_tool/checkers/openssl.py.bak delete mode 100644 cve_bin_tool/checkers/python.py.bak delete mode 100644 dummy_vex_output delete mode 100644 output.cve-bin-tool.2025-06-19.14-59-23.csv delete mode 100644 output.cve-bin-tool.2025-06-19.14-59-23.json delete mode 100644 test-report.html delete mode 100644 test-report.json delete mode 100644 test.sbom delete mode 100644 testfile.csv diff --git a/cve_bin_tool/checkers/openssl.py.bak b/cve_bin_tool/checkers/openssl.py.bak deleted file mode 100644 index 6205fb7534..0000000000 --- a/cve_bin_tool/checkers/openssl.py.bak +++ /dev/null @@ -1,27 +0,0 @@ -# Copyright (C) 2021 Intel Corporation -# SPDX-License-Identifier: GPL-3.0-or-later - - -""" -CVE checker for openssl - -References: -https://www.openssl.org/news/vulnerabilities.html -http://www.cvedetails.com/vulnerability-list/vendor_id-217/product_id-383/Openssl-Openssl.html - -RSS feed: http://www.cvedetails.com/vulnerability-feed.php?vendor_id=217&product_id=383&version_id=&orderby=3&cvssscoremin=0 -""" -from cve_bin_tool.checkers import Checker - - -class OpensslChecker(Checker): - CONTAINS_PATTERNS = [r"part of OpenSSL", r"openssl.cnf", r"-DOPENSSL_"] - FILENAME_PATTERNS = [r"libssl.so.", r"libcrypto.so"] - VERSION_PATTERNS = [ - # for general format: OpenSSL 1.0.2uĦBOpenSSL 3.0.0ĦBOpenSSL 1.1.1k - r"OpenSSL\s+([0-9]+\.[0-9]+\.[0-9]+[a-z]*)", - - r"OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+\r?\n(?:%s \(Library: %s\)|[a-zA-Z0-9:,_ \.\-\r\n]*OPENSSLDIR|ssl)", - r"(?:%s \(Library: %s\)\r?\n|OPENSSLDIR[a-zA-Z0-9:/ \"\-\r\n]*)OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+", - ] - VENDOR_PRODUCT = [("openssl", "openssl")] diff --git a/cve_bin_tool/checkers/python.py.bak b/cve_bin_tool/checkers/python.py.bak deleted file mode 100644 index f7ae562b79..0000000000 --- a/cve_bin_tool/checkers/python.py.bak +++ /dev/null @@ -1,29 +0,0 @@ -# Copyright (C) 2021 Intel Corporation -# SPDX-License-Identifier: GPL-3.0-or-later - -""" -CVE checker for Python -References: -https://www.cvedetails.com/vulnerability-list/vendor_id-10210/product_id-18230/Python-Python.html - - -""" -from cve_bin_tool.checkers import Checker - - -class PythonChecker(Checker): - CONTAINS_PATTERNS = [ - r"Fatal Python error: unable to decode the command line argument", - r"Internal error in the Python interpreter", - r"CPython", - ] - FILENAME_PATTERNS = [r"python"] - VERSION_PATTERNS = [ - r"src\\python[23]\\Python-([23]+\.[0-9]+\.[0-9]+)", - r"python(?:[23]+\.[0-9]+)-([23]+\.[0-9]+\.[0-9]+)", - r"pymalloc_debug\r?\n([23]+\.[0-9]+\.[0-9]+)", - r"([23]+\.[0-9]+\.[0-9]+)\r?\nPython %s", - r"([23]+\.[0-9]+\.[0-9]+)\r?\n%\.80s \(%\.80s\) %\.80s", - r"tags/v([23]+\.[0-9]+\.[0-9]+)\r?\n", - ] - VENDOR_PRODUCT = [("python_software_foundation", "python"), ("python", "python")] diff --git a/dummy_vex_output b/dummy_vex_output deleted file mode 100644 index 832b433ea9..0000000000 --- a/dummy_vex_output +++ /dev/null @@ -1,256 +0,0 @@ -{ - "document": { - "category": "csaf_vex", - "csaf_version": "2.0", - "notes": [ - { - "category": "summary", - "title": "Technical Summary", - "text": "Auto generated CSAF document" - } - ], - "publisher": { - "category": "vendor", - "name": "TestVendor", - "namespace": "https://www.example.com", - "contact_details": "TestVendor" - }, - "title": "", - "tracking": { - "current_release_date": "2025-06-19T06:59:24Z", - "generator": { - "date": "2025-06-19T06:59:24Z", - "engine": { - "name": "csaf-tool", - "version": "0.3.2" - } - }, - "id": "TESTPRODUCT-1.0-VEX", - "initial_release_date": "2025-06-19T06:59:24Z", - "revision_history": [ - { - "date": "2025-06-19T06:59:24Z", - "number": "1", - "summary": "None" - } - ], - "status": "final", - "version": "1" - } - }, - "product_tree": { - "branches": [ - { - "category": "vendor", - "name": "TestVendor", - "branches": [ - { - "category": "product_name", - "name": "TestProduct", - "branches": [ - { - "category": "product_version", - "name": "1.0", - "product": { - "name": "TestVendor TestProduct 1.0", - "product_id": "CSAFPID_0001", - "product_identification_helper": { - "sbom_urls": [ - "file:///D:/PythonEnv/dev/cve-bin-tool" - ] - } - } - } - ] - } - ] - } - ] - }, - "vulnerabilities": [ - { - "cve": "CVE-1234-1004", - "notes": [ - { - "category": "description", - "title": "CVE description", - "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1004" - } - ], - "product_status": { - "under_investigation": [ - "CSAFPID_0001" - ] - }, - "threats": [ - { - "category": "impact", - "details": "", - "date": "2025-06-19T06:59:24Z", - "product_ids": [ - "CSAFPID_0001" - ] - } - ] - }, - { - "cve": "CVE-1234-1005", - "notes": [ - { - "category": "description", - "title": "CVE description", - "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1005" - } - ], - "product_status": { - "known_not_affected": [ - "CSAFPID_0001" - ] - }, - "flags": [ - { - "date": "2025-06-19T06:59:24Z", - "label": "component_not_present", - "product_ids": [ - "CSAFPID_0001" - ] - } - ], - "threats": [ - { - "category": "impact", - "details": "Detail field populated.", - "date": "2025-06-19T06:59:24Z", - "product_ids": [ - "CSAFPID_0001" - ] - } - ] - }, - { - "cve": "CVE-1234-1006", - "notes": [ - { - "category": "description", - "title": "CVE description", - "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1006" - } - ], - "product_status": { - "under_investigation": [ - "CSAFPID_0001" - ] - }, - "threats": [ - { - "category": "impact", - "details": "Data field populated.", - "date": "2025-06-19T06:59:24Z", - "product_ids": [ - "CSAFPID_0001" - ] - } - ] - }, - { - "cve": "CVE-1234-1007", - "notes": [ - { - "category": "description", - "title": "CVE description", - "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1007" - } - ], - "product_status": { - "fixed": [ - "CSAFPID_0001" - ] - }, - "threats": [ - { - "category": "impact", - "details": "Data field populated.", - "date": "2025-06-19T06:59:24Z", - "product_ids": [ - "CSAFPID_0001" - ] - } - ] - }, - { - "cve": "CVE-1234-1008", - "notes": [ - { - "category": "description", - "title": "CVE description", - "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1008" - } - ], - "product_status": { - "under_investigation": [ - "CSAFPID_0001" - ] - }, - "threats": [ - { - "category": "impact", - "details": "", - "date": "2025-06-19T06:59:24Z", - "product_ids": [ - "CSAFPID_0001" - ] - } - ] - }, - { - "cve": "CVE-1234-1009", - "notes": [ - { - "category": "description", - "title": "CVE description", - "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1009" - } - ], - "product_status": { - "under_investigation": [ - "CSAFPID_0001" - ] - }, - "threats": [ - { - "category": "impact", - "details": "", - "date": "2025-06-19T06:59:24Z", - "product_ids": [ - "CSAFPID_0001" - ] - } - ] - }, - { - "cve": "CVE-1234-1010", - "notes": [ - { - "category": "description", - "title": "CVE description", - "text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1010" - } - ], - "product_status": { - "under_investigation": [ - "CSAFPID_0001" - ] - }, - "threats": [ - { - "category": "impact", - "details": "", - "date": "2025-06-19T06:59:24Z", - "product_ids": [ - "CSAFPID_0001" - ] - } - ] - } - ] -} diff --git a/output.cve-bin-tool.2025-06-19.14-59-23.csv b/output.cve-bin-tool.2025-06-19.14-59-23.csv deleted file mode 100644 index f8eac84498..0000000000 --- a/output.cve-bin-tool.2025-06-19.14-59-23.csv +++ /dev/null @@ -1,8 +0,0 @@ -vendor,product,version,cve_number,severity,score,source,cvss_version,cvss_vector,paths,remarks,comments -vendor0,product0,1.0,CVE-1234-1004,CRITICAL,4.2,NVD,2,C:H,,NewFound, -vendor0,product0,1.0,CVE-1234-1005,MEDIUM,4.2,NVD,2,C:H,,NotAffected,Detail field populated. -vendor0,product0,1.0,CVE-1234-1006,LOW,1.2,NVD,2,CVSS2.0/C:H,,NewFound,Data field populated. -vendor0,product0,2.8.6,CVE-1234-1007,LOW,2.5,NVD,3,CVSS3.0/C:H/I:L/A:M,,Mitigated,Data field populated. -vendor0,product0,2.8.6,CVE-1234-1008,UNKNOWN,2.5,NVD,3,CVSS3.0/C:H/I:L/A:M,,NewFound, -vendor0,product0,2.8.6,CVE-1234-1009,MEDIUM,2.5,NVD,3,CVSS3.0/C:H/I:L/A:M,,NewFound, -vendor1,product1,3.2.1.0,CVE-1234-1010,HIGH,7.5,OSV,2,C:H/I:L/A:M,,NewFound, diff --git a/output.cve-bin-tool.2025-06-19.14-59-23.json b/output.cve-bin-tool.2025-06-19.14-59-23.json deleted file mode 100644 index a7af55381e..0000000000 --- a/output.cve-bin-tool.2025-06-19.14-59-23.json +++ /dev/null @@ -1,108 +0,0 @@ -[ - { - "vendor": "vendor0", - "product": "product0", - "version": "1.0", - "cve_number": "CVE-1234-1004", - "severity": "CRITICAL", - "score": "4.2", - "source": "NVD", - "cvss_version": "2", - "cvss_vector": "C:H", - "paths": "", - "remarks": "NewFound", - "comments": "" - }, - { - "vendor": "vendor0", - "product": "product0", - "version": "1.0", - "cve_number": "CVE-1234-1005", - "severity": "MEDIUM", - "score": "4.2", - "source": "NVD", - "cvss_version": "2", - "cvss_vector": "C:H", - "paths": "", - "remarks": "NotAffected", - "comments": "Detail field populated.", - "response": [ - "will_not_fix" - ], - "justification": "code_not_reachable" - }, - { - "vendor": "vendor0", - "product": "product0", - "version": "1.0", - "cve_number": "CVE-1234-1006", - "severity": "LOW", - "score": "1.2", - "source": "NVD", - "cvss_version": "2", - "cvss_vector": "CVSS2.0/C:H", - "paths": "", - "remarks": "NewFound", - "comments": "Data field populated.", - "response": [ - "workaround_available" - ], - "justification": "protected_by_mitigating_control" - }, - { - "vendor": "vendor0", - "product": "product0", - "version": "2.8.6", - "cve_number": "CVE-1234-1007", - "severity": "LOW", - "score": "2.5", - "source": "NVD", - "cvss_version": "3", - "cvss_vector": "CVSS3.0/C:H/I:L/A:M", - "paths": "", - "remarks": "Mitigated", - "comments": "Data field populated." - }, - { - "vendor": "vendor0", - "product": "product0", - "version": "2.8.6", - "cve_number": "CVE-1234-1008", - "severity": "UNKNOWN", - "score": "2.5", - "source": "NVD", - "cvss_version": "3", - "cvss_vector": "CVSS3.0/C:H/I:L/A:M", - "paths": "", - "remarks": "NewFound", - "comments": "" - }, - { - "vendor": "vendor0", - "product": "product0", - "version": "2.8.6", - "cve_number": "CVE-1234-1009", - "severity": "MEDIUM", - "score": "2.5", - "source": "NVD", - "cvss_version": "3", - "cvss_vector": "CVSS3.0/C:H/I:L/A:M", - "paths": "", - "remarks": "NewFound", - "comments": "" - }, - { - "vendor": "vendor1", - "product": "product1", - "version": "3.2.1.0", - "cve_number": "CVE-1234-1010", - "severity": "HIGH", - "score": "7.5", - "source": "OSV", - "cvss_version": "2", - "cvss_vector": "C:H/I:L/A:M", - "paths": "", - "remarks": "NewFound", - "comments": "" - } -] \ No newline at end of file diff --git a/test-report.html b/test-report.html deleted file mode 100644 index 842d60fa34..0000000000 --- a/test-report.html +++ /dev/null @@ -1,1536 +0,0 @@ - - - - - - - CVE-BIN-TOOL | Descriptive Report - - - - - - - - - - - -
- - -
-
- - - -
-
- -
-
-
CVE Summary
-
- -
- - - - - - - - - - - - - - - - - - - - - - - - - -
SeverityCount
CRITICAL1
HIGH1
MEDIUM2
LOW2
-
-
-
- -
- -
-
-
CVE Remarks
-
- -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
RemarkCount
NEW5
CONFIRMED0
MITIGATED1
UNEXPLORED0
FALSE POSITIVE0
NOT AFFECTED1
-
-
-
- -
- -
- -
-
-
- -
- Scanned Files: - 0 -
-
-
-
- Vulnerable Files: - 0 -
-
-
-
- - -
- -
-
-
-
-
-
-
- -
-
-
Product CVEs
-
- - -
- -
-
-
-
-
-
-
-
CVE metric
-
-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
CVE numberCVSS versionCVSS scoreEPSS probabilityEPSS percentile
CVE-1234-100621.21.8360.79673
CVE-1234-100932.53.8950.37350
CVE-1234-101027.54.680.34072
-
-
- -
- -
-
- -
-
-
-
-
Products Scanned - -
-
-
-
-
- -
- - -
-
- -
-
- - - - - - - -
- -
- -
- -
-
-
-
    -
    -
    -
    Vendor Name -
    -
    Product Name -
    -
    Version -
    -
    CVE Count -
    -
    -
    - - -
    -
    - vendor0 -
    -
    - product0  - - NEW - -
    -
    - 1.0 -
    - -
    - 3 -
    - - - -
    - -
    - -
    - -     - - -
    -
    - vendor0 -
    -
    - product0  - - NEW - -
    -
    - 2.8.6 -
    - -
    - 3 -
    - - - -
    - -
    - -
    - -     - - -
    -
    - vendor1 -
    -
    - product1  - - NEW - -
    -
    - 3.2.1.0 -
    - -
    - 1 -
    - - - -
    - -
    - -
    - -     - -
-
-
-
- - -
- -
- - - - - -
-
-
-
-

CVE Binary Tool v 3.4.1rc0

-
-
-
-
-
-

Facing Issues?

-
-
-
- Let us know by creating a new issue. -

- - - New Issue

-
-
-
-
-
-
-

Have Suggestions?

-
-
-
- Our community would love to hear your invaluable suggestions. -

- - Gitter

-
-
-
- -
-
-
-

Want to Contribute?

-
-
-
- The cve-bin-tool community always welcomes new ideas and contributors. Join us to learn about security vulnerabilities in your binaries. -

- - - GitHub

-
-
-
-
-
-
-
-

This report was generated with - - - | cve-bin-tool. -

-
-
-
-
-
- - - - - - - - - \ No newline at end of file diff --git a/test-report.json b/test-report.json deleted file mode 100644 index a7af55381e..0000000000 --- a/test-report.json +++ /dev/null @@ -1,108 +0,0 @@ -[ - { - "vendor": "vendor0", - "product": "product0", - "version": "1.0", - "cve_number": "CVE-1234-1004", - "severity": "CRITICAL", - "score": "4.2", - "source": "NVD", - "cvss_version": "2", - "cvss_vector": "C:H", - "paths": "", - "remarks": "NewFound", - "comments": "" - }, - { - "vendor": "vendor0", - "product": "product0", - "version": "1.0", - "cve_number": "CVE-1234-1005", - "severity": "MEDIUM", - "score": "4.2", - "source": "NVD", - "cvss_version": "2", - "cvss_vector": "C:H", - "paths": "", - "remarks": "NotAffected", - "comments": "Detail field populated.", - "response": [ - "will_not_fix" - ], - "justification": "code_not_reachable" - }, - { - "vendor": "vendor0", - "product": "product0", - "version": "1.0", - "cve_number": "CVE-1234-1006", - "severity": "LOW", - "score": "1.2", - "source": "NVD", - "cvss_version": "2", - "cvss_vector": "CVSS2.0/C:H", - "paths": "", - "remarks": "NewFound", - "comments": "Data field populated.", - "response": [ - "workaround_available" - ], - "justification": "protected_by_mitigating_control" - }, - { - "vendor": "vendor0", - "product": "product0", - "version": "2.8.6", - "cve_number": "CVE-1234-1007", - "severity": "LOW", - "score": "2.5", - "source": "NVD", - "cvss_version": "3", - "cvss_vector": "CVSS3.0/C:H/I:L/A:M", - "paths": "", - "remarks": "Mitigated", - "comments": "Data field populated." - }, - { - "vendor": "vendor0", - "product": "product0", - "version": "2.8.6", - "cve_number": "CVE-1234-1008", - "severity": "UNKNOWN", - "score": "2.5", - "source": "NVD", - "cvss_version": "3", - "cvss_vector": "CVSS3.0/C:H/I:L/A:M", - "paths": "", - "remarks": "NewFound", - "comments": "" - }, - { - "vendor": "vendor0", - "product": "product0", - "version": "2.8.6", - "cve_number": "CVE-1234-1009", - "severity": "MEDIUM", - "score": "2.5", - "source": "NVD", - "cvss_version": "3", - "cvss_vector": "CVSS3.0/C:H/I:L/A:M", - "paths": "", - "remarks": "NewFound", - "comments": "" - }, - { - "vendor": "vendor1", - "product": "product1", - "version": "3.2.1.0", - "cve_number": "CVE-1234-1010", - "severity": "HIGH", - "score": "7.5", - "source": "OSV", - "cvss_version": "2", - "cvss_vector": "C:H/I:L/A:M", - "paths": "", - "remarks": "NewFound", - "comments": "" - } -] \ No newline at end of file diff --git a/test.sbom b/test.sbom deleted file mode 100644 index cba409e653..0000000000 --- a/test.sbom +++ /dev/null @@ -1,11 +0,0 @@ -SPDXVersion: SPDX-2.3 -DataLicense: CC0-1.0 -SPDXID: SPDXRef-DOCUMENT -DocumentName: SBOM_CVEBINTOOL-CVE-SCAN -DocumentNamespace: http://spdx.org/spdxdocs/SBOM_CVEBINTOOL-CVE-SCAN-a8b7f78b-e567-4ea3-a427-3cdc7b389bfd -LicenseListVersion: 3.25 -Creator: Tool: cve-bin-tool-3.4.1rc0 -Created: 2025-06-19T14:59:23Z -CreatorComment: This document has been automatically generated. -##### - diff --git a/testfile.csv b/testfile.csv deleted file mode 100644 index 9a2c7732fa..0000000000 --- a/testfile.csv +++ /dev/null @@ -1 +0,0 @@ -testing \ No newline at end of file From efaf961a8bf286b121a344fb3cc2db2807e35f4c Mon Sep 17 00:00:00 2001 From: alex-cheng-techman Date: Fri, 27 Jun 2025 15:02:21 +0800 Subject: [PATCH 3/4] fix: update Python checker and version scanner for PE metadata improvements --- cve_bin_tool/checkers/python.py | 5 ++--- cve_bin_tool/version_scanner.py | 25 +++++++++++++++++-------- 2 files changed, 19 insertions(+), 11 deletions(-) diff --git a/cve_bin_tool/checkers/python.py b/cve_bin_tool/checkers/python.py index e90bad2b7b..1d7a50add5 100644 --- a/cve_bin_tool/checkers/python.py +++ b/cve_bin_tool/checkers/python.py @@ -16,17 +16,16 @@ class PythonChecker(Checker): r"Fatal Python error: unable to decode the command line argument", r"Internal error in the Python interpreter", r"CPython", + r"Python Software Foundation", # from PE metadata ] FILENAME_PATTERNS = [r"python"] VERSION_PATTERNS = [ - # to match the data from PE file - r"[Pp]ython ([0-9]+\.[0-9]+\.[0-9]+)", - r"src\\python[23]\\Python-([23]+\.[0-9]+\.[0-9]+)", r"python(?:[23]+\.[0-9]+)-([23]+\.[0-9]+\.[0-9]+)", r"pymalloc_debug\r?\n([23]+\.[0-9]+\.[0-9]+)", r"([23]+\.[0-9]+\.[0-9]+)\r?\nPython %s", r"([23]+\.[0-9]+\.[0-9]+)\r?\n%\.80s \(%\.80s\) %\.80s", r"tags/v([23]+\.[0-9]+\.[0-9]+)\r?\n", + r"ProductVersion:\s*([23]\.[0-9]+\.[0-9]+)", ] VENDOR_PRODUCT = [("python_software_foundation", "python"), ("python", "python")] diff --git a/cve_bin_tool/version_scanner.py b/cve_bin_tool/version_scanner.py index 829a70e418..27dfe11f3f 100644 --- a/cve_bin_tool/version_scanner.py +++ b/cve_bin_tool/version_scanner.py @@ -231,22 +231,29 @@ def is_linux_kernel(self, filename: str) -> tuple[bool, str | None]: return False, output - # used to get product name, version, vendor info PE metadata + # used to get product name, version, vendor info PE metadata def extract_version_from_pe(self, filename: str) -> str: info = "" try: import pefile + with pefile.PE(filename) as pe: - #pe = pefile.PE(filename) + # pe = pefile.PE(filename) for fileinfo in pe.FileInfo: for entry in fileinfo: - if entry.Key == b'StringFileInfo': + if entry.Key == b"StringFileInfo": for st in entry.StringTable: entries = st.entries - product_name = entries.get(b'ProductName', b'').decode(errors='ignore') - product_version = entries.get(b'ProductVersion', b'').decode(errors='ignore') - company_name = entries.get(b'CompanyName', b'').decode(errors='ignore') - info = (f" {product_name} {product_version} {company_name}") + product_name = entries.get(b"ProductName", b"").decode( + errors="ignore" + ) + product_version = entries.get( + b"ProductVersion", b"" + ).decode(errors="ignore") + company_name = entries.get(b"CompanyName", b"").decode( + errors="ignore" + ) + info = f"ProductName:{product_name}\nProductVersion:{product_version}\nCompanyName:{company_name}\n" self.logger.debug(f"peFile.PE Metadata:{info}") except Exception as e: LOGGER.debug(f"[PE Metadata] Failed to parse PE file {filename}: {e}") @@ -282,7 +289,9 @@ def scan_file(self, filename: str) -> Iterator[ScanInfo]: # parse binary file's strings lines = parse_strings(filename) - lines += self.extract_version_from_pe(filename) + # lines += self.extract_version_from_pe(filename) + ver_info = self.extract_version_from_pe(filename) + lines += ver_info if self.no_scan: yield from self.run_checkers(filename, lines) From 18ad411be5b58a1c365df66d221b40e3571cca30 Mon Sep 17 00:00:00 2001 From: alex-cheng-techman Date: Fri, 27 Jun 2025 21:25:56 +0800 Subject: [PATCH 4/4] fix: set more strict python pattern extracting from pe metadata --- cve_bin_tool/checkers/python.py | 3 +-- cve_bin_tool/version_scanner.py | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/cve_bin_tool/checkers/python.py b/cve_bin_tool/checkers/python.py index 1d7a50add5..0e8e841481 100644 --- a/cve_bin_tool/checkers/python.py +++ b/cve_bin_tool/checkers/python.py @@ -16,7 +16,6 @@ class PythonChecker(Checker): r"Fatal Python error: unable to decode the command line argument", r"Internal error in the Python interpreter", r"CPython", - r"Python Software Foundation", # from PE metadata ] FILENAME_PATTERNS = [r"python"] VERSION_PATTERNS = [ @@ -26,6 +25,6 @@ class PythonChecker(Checker): r"([23]+\.[0-9]+\.[0-9]+)\r?\nPython %s", r"([23]+\.[0-9]+\.[0-9]+)\r?\n%\.80s \(%\.80s\) %\.80s", r"tags/v([23]+\.[0-9]+\.[0-9]+)\r?\n", - r"ProductVersion:\s*([23]\.[0-9]+\.[0-9]+)", + r"Python\n([23]+\.[0-9]+\.[0-9]+)\nPython Software Foundation", ] VENDOR_PRODUCT = [("python_software_foundation", "python"), ("python", "python")] diff --git a/cve_bin_tool/version_scanner.py b/cve_bin_tool/version_scanner.py index 27dfe11f3f..b061546bee 100644 --- a/cve_bin_tool/version_scanner.py +++ b/cve_bin_tool/version_scanner.py @@ -253,7 +253,7 @@ def extract_version_from_pe(self, filename: str) -> str: company_name = entries.get(b"CompanyName", b"").decode( errors="ignore" ) - info = f"ProductName:{product_name}\nProductVersion:{product_version}\nCompanyName:{company_name}\n" + info = f"{product_name}\n{product_version}\n{company_name}\n" self.logger.debug(f"peFile.PE Metadata:{info}") except Exception as e: LOGGER.debug(f"[PE Metadata] Failed to parse PE file {filename}: {e}")