#1034575 ITP: cve-bin-tool -- The CVE Binary Tool is a free, open source tool to help you find known vulnerabilities in software, using data from the National Vulnerability Database (NVD) list of Common Vulnerabilities and Exposures (CVEs).

Package:
wnpp
Source:
wnpp
Submitter:
jarebear6expepjozn6rakjq5iczi3irqwphcvbswgkahd6b6twnxxid
Date:
2026-04-13 13:35:01 UTC
Severity:
normal
#1034575#5
Date:
2023-04-18 17:57:11 UTC
From:
To:
* Package name    : cve-bin-tool
  Version         : 3.2.0
  Upstream Author : Teri Oda <terri.oda@intel.com>
* URL             : https://github.com/intel/cve-bin-tool
* License         : GPL
  Programming Lang: Python
  Description     : The CVE Binary Tool is a free, open source tool to help you find known vulnerabilities in software, using data from the National Vulnerability Database (NVD) list of Common Vulnerabilities and Exposures (CVEs).

The tool has two main modes of operation:

    A binary scanner which helps you determine which packages may have been included as part of a piece of software. There are 288 checkers which focus on common, vulnerable open source components such as openssl, libpng, libxml2 and expat.
    Tools for scanning known component lists in various formats, including .csv, several linux distribution package lists, language specific package scanners and several Software Bill of Materials (SBOM) formats.

It is intended to be used as part of your continuous integration system to enable regular vulnerability scanning and give you early warning of known issues in your supply chain.
#1034575#10
Date:
2024-10-10 13:56:52 UTC
From:
To:
Hi,

I just came across this software and found it to be very useful. Do
you have any update on the packaging status?

Please do let me know if you are stuck with something or not
interested in the packaging anymore then I can take it up.
#1034575#15
Date:
2024-10-11 09:01:37 UTC
From:
To:
Hi,

Having a quick look at requirements.txt VS Debian repo, to package this
software, we would need:

python3-cvss
python3-gsutil
python3-lib4sbom
python3-lib4vex
python3-packageurl
python3-rpmfile

6 new dependency seems doable, but that's not nothing... I may, or may
not, look into it someday.

Cheers,

Thomas Goirand (zigo)
#1034575#20
Date:
2024-10-12 13:02:07 UTC
From:
To:
Thanks for the list zigo. But the main intention of my mail was to check if the ITP owner is still interested or not since there has been no progress since 18 Apr 2023.
If the ITP owner is not interestd then I can do this one ( + any other dependency) under the Debian Python team.

I guess I will wait a week for any reply, and if there is no reply by then from the owner I will assume the ITP owner is not interested anymore and take over.
#1034575#25
Date:
2024-10-12 14:43:18 UTC
From:
To:
At this point (ie: 6 months after the ITP), IMO you do not need to wait.


Thomas
#1034575#30
Date:
2024-10-12 17:58:43 UTC
From:
To:
I am sure you meant 1 year 6 months from the ITP.  :D
#1034575#37
Date:
2026-04-13 13:31:31 UTC
From:
To:
Hello,

I am taking over the maintenance of the cve-bin-tool (version 3.4)
package because there has been no activity on this ITP since 2024.
The package has already been built and prepared for Debian, and I will
continue the work on packaging, testing, and ongoing maintenance.

In the process, I have also prepared and built several dependencies
that were missing in Debian 13.1 (sid):

python3-lib4sbom
python3-lib4vex
python3-csaf-tool (required for python3-lib4vex)

These packages are now ready for integration and testing with cve-bin-tool.

Thank you for your attention and guidance.

Best regards,
Eugene Kaddo