The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 200 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.
cve-bin-tool uses https://www.conventionalcommits.org/ style for commit messages, and we have a test that checks the title of your pull request (PR). A good potential title for this one is in the title of this issue.
You can make an issue auto close by including a comment "fixes #ISSUENUMBER" in your PR comments where ISSUENUMBER is the actual number of the issue. This "links" the issue to the pull request.
Claiming issues:
You do not need to have an issue assigned to you before you work on it. To "claim" an issue either make a linked pull request or comment on the issue saying you'll be working on it.
If someone else has already commented or opened a pull request, assume it is claimed and find another issue to work on.
If it's been more than 1 week without progress, you can ask in a comment if the claimant is still working on it before claiming it yourself (give them at least 3 days to respond before assuming they have moved on).
The latest update to scorecard mentioned that there's a nicer viewer for the scorecard data now. Our link is here: https://securityscorecards.dev/viewer/?uri=github.com/intel/cve-bin-tool
It would probably be a nice replacement for the link currently in README.md which is https://api.securityscorecards.dev/projects/github.com/intel/cve-bin-tool which just gives a giant fairly unreadable wall of data.
This should be a one-line fix and would be suitable for a new contributor, so here's the new contributor tips:
Short tips for new contributors:
Claiming issues: