Skip to content

Commit 22259be

Browse files
authored
Include config file examples, fix linter issues (#971)
1 parent d8566c1 commit 22259be

File tree

1 file changed

+156
-46
lines changed

1 file changed

+156
-46
lines changed

doc/MANUAL.md

Lines changed: 156 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,39 @@
1+
# CVE Binary Tool User Manual
2+
13
- [CVE Binary Tool User Manual](#cve-binary-tool-user-manual)
24
- [How it works](#how-it-works)
35
- [Installing](#installing)
46
- [Fixing Known Issues / What should I do if it finds something?](#fixing-known-issues--what-should-i-do-if-it-finds-something)
57
- [Limitations](#limitations)
6-
- [Optional Arguments:](#optional-arguments)
8+
- [Optional Arguments](#optional-arguments)
79
- [-u {now,daily,never}, --update {now,daily,never}](#-u-nowdailynever---update-nowdailynever)
810
- [-e EXCLUDE, --exclude EXCLUDE](#-e-exclude---exclude-exclude)
911
- [-h, --help](#-h---help)
10-
- [-V, --version ](#-V---version)
12+
- [-V, --version](#-v---version)
1113
- [--disable-version-check](#--disable-version-check)
12-
- [Checkers Arguments:](#checkers-arguments)
14+
- [Checkers Arguments](#checkers-arguments)
1315
- [-s SKIPS, --skips SKIPS](#-s-skips---skips-skips)
1416
- [-r CHECKERS, --runs CHECKERS](#-r-checkers---runs-checkers)
15-
- [Input Arguments:](#input-arguments)
17+
- [Input Arguments](#input-arguments)
1618
- [directory (positional argument)](#directory-positional-argument)
1719
- [-i INPUT_FILE, --input-file INPUT_FILE](#-i-input_file---input-file-input_file)
1820
- [-C CONFIG, --config CONFIG](#-c-config---config-config)
19-
- [Output Arguments:](#output-arguments)
21+
- [Yaml example file](#yaml-example-file)
22+
- [Toml example file](#toml-example-file)
23+
- [Output Arguments](#output-arguments)
2024
- [-o OUTPUT_FILE, --output-file OUTPUT_FILE](#-o-output_file---output-file-output_file)
2125
- [--html-theme HTML_THEME](#--html-theme-html_theme)
2226
- [-f {csv,json,console,html}, --format {csv,json,console,html}](#-f-csvjsonconsolehtml---format-csvjsonconsolehtml)
2327
- [-c CVSS, --cvss CVSS](#-c-cvss---cvss-cvss)
24-
- [-S {low,medium,high,critical}, --severity {low,medium,high,critical}](#S-lowmediumhighcritical---severity-lowmediumhighcritical)
28+
- [-S {low,medium,high,critical}, --severity {low,medium,high,critical}](#-s-lowmediumhighcritical---severity-lowmediumhighcritical)
2529
- [Output verbosity](#output-verbosity)
2630
- [Quiet Mode](#quiet-mode)
2731
- [Logging modes](#logging-modes)
28-
- [Deprecated Arguments:](#deprecated-arguments)
32+
- [Deprecated Arguments](#deprecated-arguments)
2933
- [-x, --extract](#-x---extract)
3034
- [Feedback & Contributions](#feedback--contributions)
3135
- [Security Issues](#security-issues)
3236

33-
# CVE Binary Tool User Manual
34-
3537
The CVE Binary Tool scans for a number of common, vulnerable open source
3638
components like openssl, libpng, libxml2, expat etc. to let you know
3739
if a given directory or binary file includes common libraries with
@@ -137,20 +139,20 @@ pip install -U git+https://github.com/intel/cve-bin-tool
137139
CVE Binary Tool relies on a few command line utilities which are usually present
138140
on GNU/Linux systems but you may need to install.
139141

140-
- `file`
141-
- `strings`
142-
- `tar`
143-
- `unzip`
144-
- `rpm2cpio`
145-
- `cpio`
146-
- `ar`
147-
- `cabextract`
142+
- `file`
143+
- `strings`
144+
- `tar`
145+
- `unzip`
146+
- `rpm2cpio`
147+
- `cpio`
148+
- `ar`
149+
- `cabextract`
148150

149151
On Windows, it requires
150152

151-
- `ar`
152-
- `7z`
153-
- `Expand`
153+
- `ar`
154+
- `7z`
155+
- `Expand`
154156

155157
Windows has `ar` and `Expand` installed in default, but `7z` in particular might need to be installed.
156158
If you wan to run our test-suite or scan a zstd compressed file, We recommend installing this [7-zip-zstd](https://github.com/mcmilk/7-Zip-zstd)
@@ -186,8 +188,7 @@ access to a known list of product names and versions, we do have an option `--in
186188
that can be used to look up known vulnerabilities given a CSV or JSON file.
187189
See the detailed description of [`--input-file`](#-i-input_file---input-file-input_file) for more details.
188190

189-
## Optional Arguments:
190-
191+
## Optional Arguments
191192

192193
### -u {now,daily,never}, --update {now,daily,never}
193194

@@ -209,7 +210,7 @@ This option shows program's version number and exits.
209210

210211
This option skips checking for a new version of the program.
211212

212-
## Checkers Arguments:
213+
## Checkers Arguments
213214

214215
### -s SKIPS, --skips SKIPS
215216

@@ -219,7 +220,7 @@ This option allows one to skip (disable) a comma-separated list of checkers. Th
219220

220221
This option allows one to enable a comma-separated list of checkers.
221222

222-
## Input Arguments:
223+
## Input Arguments
223224

224225
### directory (positional argument)
225226

@@ -231,19 +232,19 @@ This option extends functionality of *csv2cve* for other formats like JSON and a
231232

232233
You can provide either CSV or JSON file as input_file with vendor, product and version fields. You can also add optional fields like remarks, comments, cve_number, severity. Here's the detailed description and usecase of each fields:
233234

234-
1. **vendor, product, version** - To query locally stored CVE database and give you a list of CVEs that affect each vendor, product, version listed.
235-
2. **remarks** - remarks help you categorized different CVEs into different categories like:
236-
- NewFound (1, n, N)
237-
- Unexplored (2, u, U)
238-
- Confirmed (3, c, C)
239-
- Mitigated, (4, m, M)
240-
- Ignored (5, i, I)
235+
1. **vendor, product, version** - To query locally stored CVE database and give you a list of CVEs that affect each vendor, product, version listed.
236+
2. **remarks** - remarks help you categorized different CVEs into different categories like:
237+
- NewFound (1, n, N)
238+
- Unexplored (2, u, U)
239+
- Confirmed (3, c, C)
240+
- Mitigated, (4, m, M)
241+
- Ignored (5, i, I)
241242

242-
- All the characters denoted in parenthesis are aliases for that specific value. Output will be displayed in the same order as priority given to the remarks.
243+
- All the characters denoted in parenthesis are aliases for that specific value. Output will be displayed in the same order as priority given to the remarks.
243244

244-
3. **comments** - You can write any comments you want to write in this field. This will be ignored in the console output but will be propagated as it is in CSV, JSON or HTML formats.
245-
4. **severity** - This field allows you to adjust severity score of specific product or CVE. This can be useful in the case where CVE affects a portion of the library that you aren't using currently but you don't want to ignore it completely. In that case, you can reduce severity for this CVE.
246-
5. **cve_number** - This field give you fine grained control over output of specific CVE. You can change remarks, comments and severity for specific CVE instead of whole product.
245+
3. **comments** - You can write any comments you want to write in this field. This will be ignored in the console output but will be propagated as it is in CSV, JSON or HTML formats.
246+
4. **severity** - This field allows you to adjust severity score of specific product or CVE. This can be useful in the case where CVE affects a portion of the library that you aren't using currently but you don't want to ignore it completely. In that case, you can reduce severity for this CVE.
247+
5. **cve_number** - This field give you fine grained control over output of specific CVE. You can change remarks, comments and severity for specific CVE instead of whole product.
247248

248249
You can use `-i` or `--input-file` option to produce list of CVEs found in given vendor, product and version fields (Usage: `cve-bin-tool -i=test.csv`) or supplement extra triage data like remarks, comments etc. while scanning directory so that output will reflect this triage data and you can save time of re-triaging (Usage: `cve-bin-tool -i=test.csv /path/to/scan`).
249250

@@ -265,9 +266,11 @@ For Example if input_file contains following data:
265266
| ssh | ssh2 | 2.0 | Mitigated | | | |
266267

267268
You can test it using our [test input file](https://github.com/intel/cve-bin-tool/blob/master/test/json/test_triage.json) with following command:
269+
268270
```console
269271
cve-bin-tool -i="test/json/test_triage.json"
270272
```
273+
271274
The output will look like following:
272275

273276
╔══════════════════════════════════════════════════════════════════════════════╗
@@ -319,14 +322,121 @@ The output will look like following:
319322
### -C CONFIG, --config CONFIG
320323

321324
We currently have number of command line options and we understand that it won't be feasible to type all the option everytime you want to run a scan. You can use `--config` option to provide configuration file for the tool. You can still override options specified in config file with command line arguments. We support 2 most popular config file format:
325+
322326
1. TOML which is popular amongst Python developer and very similar to INI file. If you are not familiar with TOML checkout official [TOML documentation](https://toml.io/en/)
323327
2. YAML which is popular amongst devops community and since many of our users are devops. We also support YAML as config file format. You can find out more about YAML at [yaml.org](https://yaml.org/)
324328

325329
You can see our sample TOML config file [here](https://github.com/intel/cve-bin-tool/blob/master/test/config/cve_bin_tool_config.toml) and sample YAML config file [here](https://github.com/intel/cve-bin-tool/blob/master/test/config/cve_bin_tool_config.yaml).
326330

327331
> You have to specify either a directory to scan and/or an input file containing vendor, product and version fields either in JSON or CSV format.
328332
329-
## Output Arguments:
333+
334+
#### Yaml example file
335+
336+
```yaml
337+
input:
338+
# Directory to scan
339+
directory: test/assets
340+
# To supplement triage data of previous scan or run standalone as csv2cve
341+
# Currently we only support csv and json file.
342+
input_file: test/csv/triage.csv
343+
344+
checker:
345+
# list of checkers you want to skip
346+
skips:
347+
- python
348+
- bzip2
349+
# list of checkers you want to run
350+
runs:
351+
- curl
352+
- binutils
353+
354+
output:
355+
# specify output verbosity from [debug, info, warning, error, critical]
356+
# verbosity will decreases as you go left to right (default: info)
357+
log_level: debug
358+
# if true then we don't display any output and
359+
# only exit-code with number of cves get returned
360+
# overwrites setting specified in log_level
361+
# Note: it's lowercase true or false
362+
quiet: false
363+
# specify one of an output format: [csv, json, html, console] (default: console)
364+
format: console
365+
# provide output filename (optional)
366+
# if not specified we will generate one according to output format specified
367+
output_file: ''
368+
# specify minimum CVE severity level to report from [low, medium, high, critical] (default: low)
369+
severity: low
370+
# specify minimum CVSS score to report from integer range 0 to 10 (default: 0)
371+
cvss: 0
372+
other:
373+
# set true if you want to skip checking for newer version
374+
disable_version_check: false
375+
# update schedule for NVD database (default: daily)
376+
update: daily
377+
# set true if you want to autoextract archive files. (default: true)
378+
extract: true
379+
```
380+
381+
#### Toml example file
382+
383+
```toml
384+
[input]
385+
386+
# Directory to scan
387+
directory = "test/assets"
388+
389+
# To supplement triage data of previous scan or run standalone as csv2cve
390+
# Currently we only support csv and json file.
391+
input_file = "test/csv/triage.csv"
392+
393+
[checker]
394+
395+
# list of checkers you want to skip
396+
skips = ["python", "bzip2"]
397+
398+
# list of checkers you want to run
399+
runs = ["curl", "binutils"]
400+
401+
[output]
402+
403+
# specify output verbosity from ["debug", "info", "warning", "error", "critical"]
404+
# verbosity will decreases as you go left to right (default: "info")
405+
log_level = "debug"
406+
407+
# if true then we don't display any output and
408+
# only exit-code with number of cves get returned
409+
# overwrites setting specified in log_level
410+
# Note: it's lowercase true or false
411+
quiet = false
412+
413+
# specify one of an output format: ["csv", "json", "html", "console"] (default: "console")
414+
format = "console"
415+
416+
# provide output filename (optional)
417+
# if not specified we will generate one according to output format specified
418+
output_file = ""
419+
420+
# specify minimum CVE severity level to report from ["low", "medium", "high", "critical"] (default: "low")
421+
severity = "low"
422+
423+
# specify minimum CVSS score to report from integer range 0 to 10 (default: 0)
424+
cvss = 0
425+
426+
[other]
427+
# set true if you want to skip checking for newer version
428+
disable_version_check = false
429+
430+
# update schedule for NVD database (default: daily)
431+
update = "daily"
432+
433+
# set true if you want to autoextract archive files. (default: true)
434+
extract = true
435+
```
436+
437+
438+
439+
## Output Arguments
330440

331441
Although the examples in this section show results for a single library to make them shorter and easier to read, the tool was designed to be run on entire directories and will scan all files in a directory if one is supplied.
332442

@@ -342,7 +452,7 @@ This option specifies the theme directory to be used in formatting the HTML repo
342452

343453
This option allows the CVE Binary Tool to produce a report in an alternate format. This is useful if you have other tools which only take a specific format. The default is `console` which prints category wise beautiful tables of CVEs on terminal.
344454

345-
1. `--format csv` - write output file in csv (comma separated) format.
455+
1. `--format csv` - write output file in csv (comma separated) format.
346456

347457
```csv
348458
vendor,product,version,cve_number,severity,remarks,comments
@@ -351,7 +461,7 @@ haxx,curl,7.34.0,CVE-2014-0138,MEDIUM,NewFound,
351461
haxx,curl,7.34.0,CVE-2014-0139,MEDIUM,Unexplored,
352462
```
353463

354-
2. `--format json` - write output file in json (javascript object notation) format.
464+
2. `--format json` - write output file in json (javascript object notation) format.
355465

356466
```json
357467
[
@@ -376,23 +486,23 @@ haxx,curl,7.34.0,CVE-2014-0139,MEDIUM,Unexplored,
376486
]
377487
```
378488

379-
3. `--format console` - prints in nice colored tabular format.
489+
3. `--format console` - prints in nice colored tabular format.
490+
380491
<figure>
381492
<img src="https://i.imgur.com/UwH6vA7.png"
382493
alt="
383494
cve-bin-tool: Report Generated: 2020-07-31 17:49:56
384495
1. NewFound CVEs:
385496
Vendor, Product, Version, CVE Number , Severity
386-
haxx , curl , 7.34.0 , CVE-2014-0138, HIGH
497+
haxx , curl , 7.34.0 , CVE-2014-0138, HIGH
387498
haxx , curl , 7.34.0 , CVE-2014-0139, CRITICAL
388499
haxx , curl , 7.34.0 , CVE-2014-0015, MEDIUM
389500
"
390501
style="width:100%;white-space:pre;">
391502
<figcaption>formated console output</figcaption>
392503
</figure>
393504

394-
395-
4. `--format html` - creates a report in html format according to the specified HTML theme.
505+
4. `--format html` - creates a report in html format according to the specified HTML theme.
396506

397507
### -c CVSS, --cvss CVSS
398508

@@ -402,14 +512,14 @@ This option specifies the minimum CVSS score (as integer in range 0 to 10) of th
402512

403513
This option specifies the minimum CVE severity to report. The default value is low which results in all CVEs being reported.
404514

405-
Note that this option is overridden by `--cvss` parameter if this is also specified.
515+
Note that this option is overridden by `--cvss` parameter if this is also specified.
406516

407517
### Output verbosity
408518

409519
As well as the modes above, there are two other output options to decrease or increase the number of messages printed:
410520

411-
1. **Quiet mode (-q)** suppresses all output but exits with an error number indicating the number of files with known CVEs. This is intended for continuous integration and headless tests, while the other modes are all more human-friendly.
412-
2. **Log mode (-l log_level)** prints logs of the specified log_level and above. The default log level is info. The logs can be suppressed by using quiet mode.
521+
1. **Quiet mode (-q)** suppresses all output but exits with an error number indicating the number of files with known CVEs. This is intended for continuous integration and headless tests, while the other modes are all more human-friendly.
522+
2. **Log mode (-l log_level)** prints logs of the specified log_level and above. The default log level is info. The logs can be suppressed by using quiet mode.
413523

414524
#### Quiet Mode
415525

@@ -431,7 +541,7 @@ indicates that CVEs may be present in the code. A good result here is 0.
431541

432542
The logging modes provide additional fine-grained control for debug information.
433543

434-
## Deprecated Arguments:
544+
## Deprecated Arguments
435545

436546
### -x, --extract
437547

0 commit comments

Comments
 (0)