Active CVE Check

Checks a list of packages against the "active" (not yet patched) CVE's as listed in the Ubuntu CVE Tracker.

CVE information is fetched from the cve.circl.lu API.

[!] NOTE

It's a fork with some my improvements.
The original project is hosted here: https://github.com/davbo/active-cve-check

How to use

Get the Ubuntu CVE Tracker repository (this will need to be updated periodically)

$ git clone https://git.launchpad.net/ubuntu-cve-tracker

Grab a list of installed packages from your Ubuntu host

$ dpkg-query -W -f='${source:Package}\n' | sort -u > installed_packages.txt

via SSH:

$ ssh user@host \
 "dpkg-query -W -f='\${source:Package}\n' | sort -u" > installed_packages.txt

Get this repository

$ git clone https://github.com/chinarulezzz/active-cve-check

Install the dependencies

$ pip install --user -r active-cve-check/requirements.txt

Scan the packages against the known active CVE's

$ python active-cve-check/scan_packages.py \
installed_packages.txt ubuntu-cve-tracker/active --ubuntu-version=trusty

CVE: CVE-2017-1000368
Package: sudo
CVSS: 7.2
Published: 2017-06-05T12:29:00.200000
Modified: 2017-06-05T12:29:00.217000
Summary: Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
References: http://www.securityfocus.com/bid/98838 https://www.sudo.ws/alerts/linux_tty.html


CVE: CVE-2017-13049
Package: tcpdump
CVSS: None
Published: 2017-09-14T02:29:03.030000
Modified: 2017-09-14T02:29:03.030000
Summary: The Rx protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-rx.c:ubik_print().
References: http://www.securitytracker.com/id/1039307 http://www.tcpdump.org/tcpdump-changes.txt https://github.com/the-tcpdump-group/tcpdump/commit/aa0858100096a3490edf93034a80e66a4d61aad5

...

Scan specific package against the known active CVE's

$ python active-cve-check/scan_packages.py \
 <(echo sudo) ubuntu-cve-tracker/active --ubuntu-version=trusty

or check the presence of specific CVE

$ python active-cve-check/scan_packages.py \
 <(echo tcpdump) ubuntu-cve-tracker/active --ubuntu-version=trusty | \
 grep CVE-2017-13049

Authors

• David King (davbo)
• Alexandr Savca (chinarulezzz)

License

Probably «AS IS». I wasn't contact the original author to ask the license to his script.