@@ -107,7 +107,7 @@ You can also do `python -m cve_bin_tool.cli`
107107which is useful if you're trying the latest code from
108108[ the cve-bin -tool github] ( https://github.com/intel/cve-bin-tool ) .
109109
110- optional arguments :
110+ options :
111111 -h, --help show this help message and exit
112112 -e EXCLUDE, --exclude EXCLUDE
113113 Comma separated Exclude directory path
@@ -117,20 +117,22 @@ which is useful if you're trying the latest code from
117117 --disable-validation-check
118118 skips checking xml files against schema
119119 --offline operate in offline mode
120- --detailed display detailed report
120+ --detailed add CVE description in csv or json report (no effect on console, html or pdf)
121121
122122 CVE Data Download:
123123 Arguments related to data sources and Cache Configuration
124124
125- -n {api,api2,json-nvd ,json-mirror}, --nvd {api,api2,json-nvd ,json-mirror}
125+ -n {api,api2,json,json-mirror,json-nvd }, --nvd {api,api2,json,json-mirror,json-nvd }
126126 choose method for getting CVE lists from NVD
127127 -u {now,daily,never,latest}, --update {now,daily,never,latest}
128128 update schedule for data sources and exploits database (default: daily)
129129 --nvd-api-key NVD_API_KEY
130130 Specify NVD API key (used to improve NVD rate limit).
131131 Set to `no` to ignore any keys in the environment.
132- -d {NVD,OSV,GAD,REDHAT,CURL} [{NVD,OSV,GAD,REDHAT,CURL} ...], --disable-data-source {NVD,OSV,GAD,REDHAT,CURL} [{NVD,OSV,GAD,REDHAT,CURL} ...]
133- specify data sources that should be disabled
132+ -d DISABLE_DATA_SOURCE, --disable-data-source DISABLE_DATA_SOURCE
133+ comma-separated list of data sources (CURL, EPSS, GAD, NVD, OSV, PURL2CPE, REDHAT, RSD) to disable (default: NONE)
134+ --use-mirror USE_MIRROR
135+ use an mirror to update the database
134136
135137 Input:
136138 directory directory to scan
@@ -144,6 +146,7 @@ which is useful if you're trying the latest code from
144146 specify type of software bill of materials (sbom) (default: spdx)
145147 --sbom-file SBOM_FILE
146148 provide sbom filename
149+ --vex-file VEX_FILE provide vulnerability exploitability exchange (vex) filename for triage processing
147150
148151 Output:
149152 -q, --quiet suppress output
@@ -157,29 +160,42 @@ which is useful if you're trying the latest code from
157160 update output format (default: console)
158161 specify multiple output formats by using comma (',') as a separator
159162 note: don't use spaces between comma (',') and the output formats.
163+ --generate-config {yaml,toml,yaml,toml,toml,yaml}
164+ generate config file for cve bin tool in toml and yaml formats.
160165 -c CVSS, --cvss CVSS minimum CVSS score (as integer in range 0 to 10) to report (default: 0)
161- --epss-percentile minimum EPSS percentile of CVE range between 0 to 100 to report
162- (input value can also be floating point)(default: 0)
163- --epss-probability minimum EPSS probability of CVE range between 0 to 100 to report
164- (input value can also be floating point)(default: 0)
165166 -S {low,medium,high,critical}, --severity {low,medium,high,critical}
166167 minimum CVE severity to report (default: low)
168+ --metrics check for metrics (e.g., EPSS) from found cves
169+ --epss-percentile EPSS_PERCENTILE
170+ minimum epss percentile of CVE range between 0 to 100 to report. Automatically enables `--metrics`
171+ --epss-probability EPSS_PROBABILITY
172+ minimum epss probability of CVE range between 0 to 100 to report. Automatically enables `--metrics`
167173 --no-0-cve-report only produce report when CVEs are found
168174 -A [<distro_name>-<distro_version_name>], --available-fix [<distro_name>-<distro_version_name>]
169175 Lists available fixes of the package from Linux distribution
170176 -b [<distro_name>-<distro_version_name>], --backport-fix [<distro_name>-<distro_version_name>]
171177 Lists backported fixes if available from Linux distribution
172178 --affected-versions Lists versions of product affected by a given CVE (to facilitate upgrades)
173179 --sbom-output SBOM_OUTPUT
174- provide software bill of materials (sbom) filename to generate
180+ Provide software bill of materials (sbom) filename to generate
175181 --sbom-type {spdx,cyclonedx}
176182 specify type of software bill of materials (sbom) to generate (default: spdx)
177183 --sbom-format {tag,json,yaml}
178184 specify format of software bill of materials (sbom) to generate (default: tag)
179- --vex-type {cyclonedx, csaf, openvex}
180- specify type of vulnerability exploitability exchange (vex) to generate (default: cyclonedx)
185+
186+ Vex Output:
187+ Arguments related to Vex output document.
188+
181189 --vex-output VEX_OUTPUT
182- provide vulnerability exploitability exchange (vex) filename to generate
190+ Provide vulnerability exploitability exchange (vex) filename to generate
191+ --vex-type {cyclonedx,csaf,openvex}
192+ specify type of vulnerability exploitability exchange (vex) to generate (default: cyclonedx)
193+ --product PRODUCT Product Name
194+ --release RELEASE Release Version
195+ --vendor VENDOR Vendor/Supplier of Product
196+ -rr REVISION_REASON, --revision-reason REVISION_REASON
197+ a reason for the update to the vex document should be specified in double quotes
198+ --filter-triage Filter cves based on triage data from Vex file
183199
184200 Merge Report:
185201 Arguments related to Intermediate and Merged Reports
@@ -198,17 +214,30 @@ which is useful if you're trying the latest code from
198214 -r RUNS, --runs RUNS comma-separated list of checkers to enable
199215
200216 Database Management:
217+ --import-json IMPORT_JSON
218+ import database from json files chopped by years
219+ --ignore-sig do not verify PGP signature while importing json data
220+ --log-signature-error
221+ when the signature doesn't match log the error only instead of halting (UNSAFE)
222+ --verify PGP_PUBKEY_PATH
223+ verify PGP sign while importing json files
224+ --export-json EXPORT_JSON
225+ export database as json files chopped by years
226+ --pgp-sign PGP_PRIVATE_KEY_PATH
227+ sign exported json files with PGP
228+ --passphrase PASSPHRASE
229+ required passphrase for signing with PGP
201230 --export EXPORT export database filename
202231 --import IMPORT import database filename
203232
204233 Exploits:
205234 --exploits check for exploits from found cves
206235
207236 Deprecated:
237+ --triage-input-file TRIAGE_INPUT_FILE
238+ replaced by --vex-file
208239 -x, --extract autoextract compressed files
209- CVE Binary Tool autoextracts all compressed files by default now
210240 --report Produces a report even if there are no CVE for the respective output format
211- CVE Binary Tool produces report by default even if there are no CVEs
212241
213242<!-- CHECKERS TABLE BEGIN-->
214243| | | | Available checkers | | | |
0 commit comments