go-cve-search - lightweight cve search

go-cve-search is a lightweight tool to search CVE (Common Vulnerabilities and Exposures).

News

NVD Official CVE API is released!

https://csrc.nist.gov/CSRC/media/Projects/National-Vulnerability-Database/documents/web%20service%20documentation/Automation%20Support%20for%20CVE%20Retrieval.pdf

Example CVE-2014-0160 : https://services.nvd.nist.gov/rest/json/cve/1.0/CVE-2014-0160

I recommend you to use the official API.

Futures

• Simple usage
• No initial setup
• Always fetch latest CVE infomation

Installation

Homebrew

You can use homebrew on OS X.

$ brew tap s-index/go-cve-search
$ brew install s-index/go-cve-search/go-cve-search

Binary

Binary files for each OS (Windows/macOS/Linux) are available on the Releases page.

Go Get

$ go get github.com/s-index/go-cve-search

Usage

CVE-2014-0160 (HeartBleed)

$ go-cve-seach -p CVE-2014-0160
{
   "cve": {
      "data_type": "CVE",
      "data_format": "MITRE",
      "data_version": "4.0",
      "CVE_data_meta": {
         "ID": "CVE-2014-0160",
         "ASSIGNER": "cve@mitre.org"
      },
      "problemtype": {
         "problemtype_data": [
            {
               "description": [
                  {
                     "lang": "en",
                     "value": "CWE-119"
                  }
               ]
            }
         ]
      },
      ...snip...
      "description": {
         "description_data": [
            {
               "lang": "en",
               "value": "The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug."
            },
            {
               "lang": "en",
               "value": "CVSS V2 scoring evaluates the impact of the vulnerability on the host where the vulnerability is located. When evaluating the impact of this vulnerability to your organization, take into account the nature of the data that is being protected and act according to your organization’s risk acceptance. While CVE-2014-0160 does not allow unrestricted access to memory on the targeted host, a successful exploit does leak information from memory locations which have the potential to contain particularly sensitive information, e.g., cryptographic keys and passwords.  Theft of this information could enable other attacks on the information system, the impact of which would depend on the sensitivity of the data and functions of that system."
            }
         ]
      }
      ...snip...