GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing osv.dev — OSV - Open Source Vulnerabilities

A distributed vulnerability database for Open Source

An open, precise, and distributed approach to producing and consuming vulnerability information for open source.

search Search Vulnerability Database Use the API

Vulnerability Scanner Remediation Tools GitHub Workflows

Ecosystems

AlmaLinux: 6419 View AlmaLinux vulnerabilities
Alpaquita: 17596 View Alpaquita vulnerabilities
Alpine: 10696 View Alpine vulnerabilities
Android: 4072 View Android vulnerabilities
Azure Linux: 20376 View Azure Linux vulnerabilities
BellSoft Hardened Containers: 946 View BellSoft Hardened Containers vulnerabilities
Bitnami: 10023 View Bitnami vulnerabilities
Chainguard: 1291374 View Chainguard vulnerabilities
CleanStart: 17691 View CleanStart vulnerabilities
crates.io: 2982 View crates.io vulnerabilities
Debian: 73474 View Debian vulnerabilities
Echo: 7984 View Echo vulnerabilities
GIT: 119330 View GIT vulnerabilities
GitHub Actions: 63 View GitHub Actions vulnerabilities
Go: 9765 View Go vulnerabilities
Hackage: 36 View Hackage vulnerabilities
Hex: 431 View Hex vulnerabilities
Julia: 1713 View Julia vulnerabilities
Linux: 31104 View Linux vulnerabilities
Mageia: 6361 View Mageia vulnerabilities
Maven: 7135 View Maven vulnerabilities
MinimOS: 184476 View MinimOS vulnerabilities
npm: 230948 View npm vulnerabilities
NuGet: 1954 View NuGet vulnerabilities
opam: 36 View opam vulnerabilities
openEuler: 9532 View openEuler vulnerabilities
openSUSE: 15275 View openSUSE vulnerabilities
OSS-Fuzz: 4056 View OSS-Fuzz vulnerabilities
Packagist: 7291 View Packagist vulnerabilities
PyPI: 26234 View PyPI vulnerabilities
Red Hat: 23995 View Red Hat vulnerabilities
Red Hat Lightwell: 272 View Red Hat Lightwell vulnerabilities
Rocky Linux: 4769 View Rocky Linux vulnerabilities
Root: 20235 View Root vulnerabilities
RubyGems: 5432 View RubyGems vulnerabilities
SUSE: 24389 View SUSE vulnerabilities
SwiftURL: 61 View SwiftURL vulnerabilities
TuxCare: 23159 View TuxCare vulnerabilities
Ubuntu: 70148 View Ubuntu vulnerabilities
Wolfi: 329715 View Wolfi vulnerabilities

OSV schema

All advisories in this database use the OpenSSF OSV format, which was developed in collaboration with open source communities.

The OSV schema provides a human and machine readable data format to describe vulnerabilities in a way that precisely maps to open source package versions or commit hashes.

{
  "schema_version": "1.7.4",
  "id": "GHSA-c3g4-w6cv-6v7h",
  "modified": "2022-04-01T13:56:42Z",
  "published": "2022-04-01T13:56:42Z",
  "aliases": [ "CVE-2022-27651" ],
  "summary": "Non-empty default inheritable capabilities for linux container in Buildah",
  "details": "A bug was found in Buildah where containers were created ...",
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/containers/buildah"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/containers/buildah/commit/..."
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/containers/buildah"
    }
  ]
}

OSV Schema Blog post

Data sources

This infrastructure serves as an aggregator of vulnerability databases that have adopted the OSV schema, including GitHub Security Advisories, PyPA, RustSec, and Global Security Database, and more.

Learn more

Use the API

An easy-to-use API is available to query for all known vulnerabilities by either a commit hash, or a package version.

Query by commit hash

curl -d \
  '{"commit": "6879efc2c1596d11a6a6ad296f80063b558d5e0f"}' \
  "https://api.osv.dev/v1/query"

content_copy

Query by version number

curl -d \
  '{"version": "2.4.1",
    "package": {"name": "jinja2", "ecosystem": "PyPI"}}' \
  "https://api.osv.dev/v1/query"

content_copy

API Documentation

Vulnerability Scanner

Install OSV‑Scanner

go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2

content_copy

Scan SBOM or Lockfiles

osv-scanner --sbom=cycloned-or-spdx-sbom.json
osv-scanner --lockfile=package-lock.json

content_copy

Scan directory recursively

osv-scanner -r path/to/your/project

content_copy

More details

Remediation Tools

Guided Remediation (basic)

osv-scanner fix --non-interactive --strategy=in-place -L path/to/package-lock.json
osv-scanner fix --non-interactive --strategy=relock -M path/to/package.json -L path/to/package-lock.json

content_copy

Guided Remediation (interactive)

osv-scanner fix -M path/to/package.json -L path/to/package-lock.json

content_copy

More details

Container Image Scanning

You can use OSV-Scanner to scan your container images for known vulnerabilities.

Scan container image

osv-scanner scan image --serve alpine:3.12

content_copy

Screenshot of container scan HTML output

GitHub Workflows

OSV-Scanner also provides reusable GitHub workflows that can be easily integrated into CI/CD pipelines to provide continuous vulnerability scanning coverage. This can scan newly added dependencies in pull requests for introduced vulnerabilities, as well as perform regular vulnerability scans for the entire project.

Learn more

Open source

This project is open source. If you have any ideas or questions, please feel free to reach out by creating an issue!

Learn more

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.