vuls

What's Changed

• chore(deps): bump github.com/Azure/azure-sdk-for-go from 66.0.0+incompatible to 68.0.0+incompatible by @dependabot in https://github.com/future-architect/vuls/pull/1588
• chore(deps): bump github.com/aws/aws-sdk-go from 1.44.136 to 1.44.249 by @dependabot in https://github.com/future-architect/vuls/pull/1656
• chore(deps): bump github.com/emersion/go-smtp from 0.14.0 to 0.16.0 by @dependabot in https://github.com/future-architect/vuls/pull/1580
• feat(ubuntu): add ubuntu 23.04 by @MaineK00n in https://github.com/future-architect/vuls/pull/1647
• chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 by @dependabot in https://github.com/future-architect/vuls/pull/1658
• chore(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 by @dependabot in https://github.com/future-architect/vuls/pull/1657
• chore(deps): bump github.com/c-robinson/iplib from 1.0.3 to 1.0.6 by @dependabot in https://github.com/future-architect/vuls/pull/1659
• chore(deps): bump github.com/aws/aws-sdk-go from 1.44.249 to 1.44.251 by @dependabot in https://github.com/future-architect/vuls/pull/1660
• chore(deps): bump github.com/Ullaakut/nmap/v2 from 2.1.2-0.20210406060955-59a52fe80a4f to 2.2.2 by @dependabot in https://github.com/future-architect/vuls/pull/1665
• chore(deps): bump golang.org/x/oauth2 from 0.1.0 to 0.7.0 by @dependabot in https://github.com/future-architect/vuls/pull/1662
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.0 to 0.7.1 by @dependabot in https://github.com/future-architect/vuls/pull/1663
• fix(saas): remove current directory part by @MaineK00n in https://github.com/future-architect/vuls/pull/1666
• chore(deps): update goval-dictionary v0.8.3 by @MaineK00n in https://github.com/future-architect/vuls/pull/1671
• chore(deps): bump github.com/aws/aws-sdk-go from 1.44.251 to 1.44.254 by @dependabot in https://github.com/future-architect/vuls/pull/1669
• chore(deps): bump golang.org/x/sync from 0.1.0 to 0.2.0 by @dependabot in https://github.com/future-architect/vuls/pull/1673
• chore(deps): bump github.com/aws/aws-sdk-go from 1.44.254 to 1.44.259 by @dependabot in https://github.com/future-architect/vuls/pull/1672
• chore(deps): update dictionary tools, Vuls is now CGO free by @MaineK00n in https://github.com/future-architect/vuls/pull/1667
• test: sort []cveContent by CVEID by @MaineK00n in https://github.com/future-architect/vuls/pull/1674

Full Changelog: https://github.com/future-architect/vuls/compare/v0.23.1...v0.23.2

Changelog

• b91a7b7 fix(detector/github): Github dependency graph API request will be retried on error (#1650)
• 333eae0 fix order in identifying amazon linux version (#1652)
• 93d401c chore(integration): update commit (#1649)
• 99dc8e8 feat(gost/ubuntu): check kernel source package more strictly (#1599)
• fb904f0 refactor(reporter): refactoring TelegramWriter, GoogleChatWriter (#1628)
• d4d33fc fix(scanner/dpkg): Fix false-negative in Debian and Ubuntu (#1646)
• a1d3fbf fix(scan): false positives in Debian Pkg for CVE-IDs already detected by Trivy (#1639)
• 2cdfbe3 fix: dependency graph using small query at once to avoid timeout (#1642)
• ac82901 fix(configtest): amazon linux 2022, 2023 require dnf-utils (#1635)

Changelog

• abdb081 feat(scanner): skip ssh config validation if G option is unknown option (#1632)
• e506125 feat(wp): support csh, no sudo scan (#1523)
• 8ccaa8c fix(scanner/windows): support installationType Domain Controller (#1627)
• de1ed8e feat(ci): add windows for snmp2cpe (#1626)
• 947d668 feat(windows): support Windows (#1581)
• db21149 feat(contrib): add snmp2cpe (#1625)
• 7f35f4e chore(deps): bump github.com/hashicorp/go-getter from 1.6.2 to 1.7.0 (#1606)

Changelog

• 6682232 feat(os): support Amazon Linux 2023 (#1621)
• 984debe fix(detector/github) change timeout 10s to 10m (#1616)

Changelog

• a528362 fix(saas): upload JSON if err occured during scan (#1615)
• ee97d98 feat: update EOL (#1598)
• 4e486da style: fix typo (#1592)
• 897fef2 feat(detector/exploitdb): mod update and add more urls (#1610)
• 73f0ada fix: use GetCveContentTypes instead of NewCveContentType (#1603)
• 7044929 Revert: gost/Ubuntu.ConvertToModel() is public method now (#1597)
• 1927ed3 fix(report): tidy dependencies for multiple repo on integration with GSA (#1593)
• ad2edbb fix(ubuntu): vulnerability detection for kernel package (#1591)
• bfe0db7 feat(cwe): add cwe-id for category and view (#1578)
• ff3b9cd fix: add comment (#1585)
• 2deb1b9 chore: update version for golangci-lint (#1586)
• ca64d7f feat(report): Include dependencies into scan result and cyclondex for supply chain security on Integration with GitHub Security Alerts (#1584)

What's Changed

• chore: update version for golangci-lint by @kl-sinclair in https://github.com/future-architect/vuls/pull/1586
• fix: add comment by @MaineK00n in https://github.com/future-architect/vuls/pull/1585
• feat(cwe): add cwe-id for category and view by @MaineK00n in https://github.com/future-architect/vuls/pull/1578
• fix(ubuntu): vulnerability detection for kernel package by @MaineK00n in https://github.com/future-architect/vuls/pull/1591
• fix(report): tidy dependencies for multiple repo on integration with GSA by @kl-sinclair in https://github.com/future-architect/vuls/pull/1593
• fix(ubuntu): dependency problem by @kl-sinclair in https://github.com/future-architect/vuls/pull/1597
• fix: use GetCveContentTypes instead of NewCveContentType by @MaineK00n in https://github.com/future-architect/vuls/pull/1603
• feat(detector/exploitdb): mod update and add more urls by @MaineK00n in https://github.com/future-architect/vuls/pull/1610
• style: fix typo by @MaineK00n in https://github.com/future-architect/vuls/pull/1592
• feat: update EOL by @MaineK00n in https://github.com/future-architect/vuls/pull/1598

Full Changelog: https://github.com/future-architect/vuls/compare/v0.22.0...v0.23.0-beta

Changelog

• 554ecc4 fix(report/email): add Critical to email summary (#1565)
• f6cd4d9 feat(libscan): support conan.lock C/C++ (#1572)
• 03c5986 feat(libscan): support gradle.lockfile (#1568)

Changelog

• 1d97e91 fix(libscan): delete map that keeps all file contents detected by FindLock to save memory (#1556)

Changelog

• 96333f3 chore(ubuntu): set Ubuntu 22.10 EOL (#1552)
• 8b5d1c8 feat(cwe, cti): update dictionary (#1553)
• dea80f8 feat(report): add cyclonedx format (#1543)
• 6eb4c5a chore(deps): bump github.com/aquasecurity/trivy from 0.31.3 to 0.32.1 (#1538)
• b219a84 fix(cpescan): match if affected version is NA (#1548)

Changelog

• eb87d5d fix(saas): panic: runtime error: comparing uncomparable type config.PortScanConf (#1537)
• 6963442 fix(report): send report to each slack channel (#1530)

Changelog

• f7299b9 fix(scan): detect AL2 even when empty /etc/redhat-release (#1536)
• 379fc8a fix: fix query (#1534)
• 947fbbb fix(ms): always sets isPkgCvesDetactable to true (#1492)
• 06d2032 docs: update slack invite URL (#1524)
• d055c48 chore(deps): bump github.com/aquasecurity/trivy from 0.30.4 to 0.31.3 (#1526)

Changelog

• 2a00339 fix(lockfiles): fix privileges in lockfile scan (#1512)

Changelog

• 2d959b3 Fix func to get EC2 instance ID by IMDSv2. (#1522)

Changelog

• 595e26d Enable to get EC2 instance ID by IMDSv2. (#1520)

Changelog

• 1e45732 chore: bump up version (#1511)
• a06e689 feat(cwe): add cwe top25 2022 (#1504)
• ca3f6b1 feat(amazon): support Amazon Linux 2 Extra Repository (#1510)
• f1c78e4 chore(deps): bump github.com/aquasecurity/trivy from 0.30.3 to 0.30.4 (#1507)
• 2f3b8bf chore(rocky): set Rocky Linux 9 EOL (#1495)
• ab54266 fix(library): fill libraryFixedIns{}.key in ftypes.Pnpm and ftypes.DotNetCore (#1498)
• d79d138 chore(deps): bump github.com/aquasecurity/trivy from 0.30.2 to 0.30.3 (#1499)
• 139f3a8 chore(deps): bump github.com/aquasecurity/trivy from 0.27.1 to 0.30.0 (#1494)
• d1a617c fix(ms): remove duplicate advisories (#1490)

Changelog

• 48f7597 feat(ms): import gost:MaineK00n/new-windows (#1481)
• 9373131 feat(saas) add vuls tags from env (#1487)
• 999529a feat(scanner): detect host key change (#1406)
• 847d820 feat(os): support Alpine Linux 3.16 (#1479)
• 5234306 feat(cti): add Cyber Threat Intelligence info (#1442)
• 86b60e1 feat(config): support CIDR (#1415)
• 42fdc08 feat(os): support RHEL 9, CentOS Stream 9, Alma Linux 9 (#1465)
• 38b1d62 feat(cwe): update CWE dictionary (#1443)
• 2477f9a chore: tidy go.mod, add arm64 and workflows update (#1461)
• ec6e90a fix getting wp core version string via ssh (#1344)
• 2aca2e4 feat(contrib/trivy) fill image info into scan results (#1475)
• 14518d9 fix(contriv/fvuls) initialize optional map (#1469)
• 948f8c0 add VULS_TAGS env into contiriv future-vuls (#1466)
• 1c1e400 feat(library) output library type when err (#1460)
• 2158fc6 fix: judge by scannedVia (#1456)

Changelog

• 91ed318 chore(deps): update trivy v0.27.1 (#1453)

What's Changed

• feat: support server scan for suse with text/plain by @Nikkely in https://github.com/future-architect/vuls/pull/1433
• chore(deps): bump github.com/aquasecurity/trivy from 0.24.2 to 0.25.1 by @dependabot in https://github.com/future-architect/vuls/pull/1436
• chore: fix lint error by @MaineK00n in https://github.com/future-architect/vuls/pull/1438
• feat: parse OS version from result of trivy-scan by @Nikkely in https://github.com/future-architect/vuls/pull/1444
• feat(ubuntu): add Jammy Jellyfish(22.04) by @MaineK00n in https://github.com/future-architect/vuls/pull/1431
• chore(deps): bump github.com/aquasecurity/trivy from 0.25.4 to 0.27.0 by @dependabot in https://github.com/future-architect/vuls/pull/1451
• chore(deps): update goval-dictionary and gost by @MaineK00n in https://github.com/future-architect/vuls/pull/1452

Full Changelog: https://github.com/future-architect/vuls/compare/v0.19.5...v0.19.6

What's Changed

• fix(oval/suse): use def.Advisory.Cves[0].CveID instead of def.Title by @MaineK00n in https://github.com/future-architect/vuls/pull/1397
• refactor(detector): standardize db.NewDB to db.CloseDB by @MaineK00n in https://github.com/future-architect/vuls/pull/1380
• fix: nil pointer when no match for any OS by @kotakanbe in https://github.com/future-architect/vuls/pull/1401
• fix: handling when image contains no trivy-target by @Nikkely in https://github.com/future-architect/vuls/pull/1405
• chore: update trivy from 0.23.0 to 0.24.02 by @Nikkely in https://github.com/future-architect/vuls/pull/1407
• feat: replace NVD-column with packages-column at output of report by @Masato516 in https://github.com/future-architect/vuls/pull/1414
• feat(library): add auto detect library by @MaineK00n in https://github.com/future-architect/vuls/pull/1417
• chore(mod): update go-kev module by @MaineK00n in https://github.com/future-architect/vuls/pull/1425
• chore: add fvuls image by @MaineK00n in https://github.com/future-architect/vuls/pull/1426
• feat(inthewild): support inTheWild PoCs by @MaineK00n in https://github.com/future-architect/vuls/pull/1428

New Contributors

• @Nikkely made their first contribution in https://github.com/future-architect/vuls/pull/1405
• @Masato516 made their first contribution in https://github.com/future-architect/vuls/pull/1414

Full Changelog: https://github.com/future-architect/vuls/compare/v0.19.4...v0.19.5

What's new in v0.19.4

• SLES15, SLES12SP5, openSUSE, and SLED support

What's Changed

• feat(debian): validate running kernel version by @MaineK00n in https://github.com/future-architect/vuls/pull/1382
• feat(configtest,scan): detect known_hosts error by @MaineK00n in https://github.com/future-architect/vuls/pull/1386
• fix(redhat): detect RedHat version by @MaineK00n in https://github.com/future-architect/vuls/pull/1387
• fix(configtest,scan): support SSH config file by @MaineK00n in https://github.com/future-architect/vuls/pull/1388
• fix(util): Major() behavior for major version by @MaineK00n in https://github.com/future-architect/vuls/pull/1393
• fix(suse): fix openSUSE, openSUSE Leap, SLES, SLED scan by @MaineK00n in https://github.com/future-architect/vuls/pull/1384
• fix(configtest,scan): fix validateSSHConfig by @MaineK00n in https://github.com/future-architect/vuls/pull/1395

Full Changelog: https://github.com/future-architect/vuls/compare/v0.19.3...v0.19.4