goval-dictionary

This is tool to build a local copy of the OVAL. The local copy is generated in sqlite format, and the tool has a server mode for easy querying.

Installation

Requirements

goval-dictionary requires the following packages.

• SQLite3, MySQL (or MariaDB), PostgreSQL or Redis
• git
• gcc
• lastest version of go
  • https://golang.org/doc/install

Install

$ mkdir -p $GOPATH/src/github.com/vulsio
$ cd $GOPATH/src/github.com/vulsio
$ git clone https://github.com/vulsio/goval-dictionary.git
$ cd goval-dictionary
$ make install

Usage

$ goval-dictionary --help
OVAL(Open Vulnerability and Assessment Language) dictionary

Usage:
  goval-dictionary [command]

Available Commands:
  completion  generate the autocompletion script for the specified shell
  fetch       Fetch Vulnerability dictionary
  help        Help about any command
  select      Select from DB
  server      Start OVAL dictionary HTTP server
  version     Show version

Flags:
      --config string       config file (default is $HOME/.oval.yaml)
      --dbpath string       /path/to/sqlite3 or SQL connection string (default "$PWD/oval.sqlite3")
      --dbtype string       Database type to store data in (sqlite3, mysql, postgres or redis supported) (default "sqlite3")
      --debug               debug mode (default: false)
      --debug-sql           SQL debug mode
  -h, --help                help for goval-dictionary
      --http-proxy string   http://proxy-url:port (default: empty)
      --log-dir string      /path/to/log (default "/var/log/goval-dictionary")
      --log-json            output log as JSON

Use "goval-dictionary [command] --help" for more information about a command.

Usage: Fetch OVAL data

$ goval-dictionary fetch --help
Fetch Vulnerability dictionary

Usage:
  goval-dictionary fetch [command]

Available Commands:
  alpine      Fetch Vulnerability dictionary from Alpine secdb
  amazon      Fetch Vulnerability dictionary from Amazon ALAS
  debian      Fetch Vulnerability dictionary from Debian
  fedora      Fetch Vulnerability dictionary from Fedora
  oracle      Fetch Vulnerability dictionary from Oracle
  redhat      Fetch Vulnerability dictionary from RedHat
  suse        Fetch Vulnerability dictionary from SUSE
  ubuntu      Fetch Vulnerability dictionary from Ubuntu

Flags:
  -h, --help          help for fetch
      --no-details    without vulnerability details

Global Flags:
      --config string       config file (default is $HOME/.oval.yaml)
      --dbpath string       /path/to/sqlite3 or SQL connection string (default "$PWD/oval.sqlite3")
      --dbtype string       Database type to store data in (sqlite3, mysql, postgres or redis supported) (default "sqlite3")
      --debug               debug mode (default: false)
      --debug-sql           SQL debug mode
      --http-proxy string   http://proxy-url:port (default: empty)
      --log-dir string      /path/to/log (default "/var/log/goval-dictionary")
      --log-json            output log as JSON

Use "goval-dictionary fetch [command] --help" for more information about a command.

Usage: Fetch OVAL data from RedHat

• Redhat OVAL

$ goval-dictionary fetch redhat 5 6 7 8 9

Usage: Fetch OVAL data from Debian

• Debian OVAL

$ goval-dictionary fetch debian 7 8 9 10 11 12

Usage: Fetch OVAL data from Ubuntu

• Ubuntu(main)
• Ubuntu(sub)

  $ goval-dictionary fetch ubuntu 14.04 16.04 18.04 20.04 21.04 21.10 22.04 22.10 23.04 23.10 24.04

Usage: Fetch OVAL data from SUSE

• SUSE

$ goval-dictionary fetch suse --help
Fetch Vulnerability dictionary from SUSE

Usage:
  goval-dictionary fetch suse [flags]

Flags:
  -h, --help               help for suse
      --suse-type string   Fetch SUSE Type (default "opensuse-leap")

Global Flags:
      --config string       config file (default is $HOME/.oval.yaml)
      --dbpath string       /path/to/sqlite3 or SQL connection string (default "/$PWD/oval.sqlite3")
      --dbtype string       Database type to store data in (sqlite3, mysql, postgres or redis supported) (default "sqlite3")
      --debug               debug mode (default: false)
      --debug-sql           SQL debug mode
      --http-proxy string   http://proxy-url:port (default: empty)
      --log-dir string      /path/to/log (default "/var/log/goval-dictionary")
      --log-json            output log as JSON
      --no-details          without vulnerability details

$ goval-dictionary fetch suse --suse-type opensuse 10.2 10.3 11.0 11.1 11.2 11.3 11.4 12.1 12.2 12.3 13.1 13.2 tumbleweed
$ goval-dictionary fetch suse --suse-type opensuse-leap 42.1 42.2 42.3 15.0 15.1 15.2 15.3 15.4 15.5 15.6
$ goval-dictionary fetch suse --suse-type suse-enterprise-server 9 10 11 12 15
$ goval-dictionary fetch suse --suse-type suse-enterprise-desktop 10 11 12 15

Usage: Fetch OVAL data from Oracle

• Oracle Linux

 $ goval-dictionary fetch oracle 5 6 7 8 9

Usage: Fetch alpine-secdb as OVAL data type

• Alpine Linux alpine-secdb is provided in YAML format and not OVAL, but it is supported by goval-dictionary to make alpine-secdb easier to handle from Vuls. See here for a list of supported alpines.

 $ goval-dictionary fetch alpine 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17 3.18 3.19 3.20

Usage: Fetch Amazon ALAS as OVAL data type

Amazon ALAS provideis Vulnerability data as no-OVAL-format, but it is supported by goval-dictionary to make Amazon ALAS easier to handle from Vuls.

 $ goval-dictionary fetch amazon 1 2 2022 2023

Usage: Fetch Security Updates from Fedora

• Fedora Updates

$ goval-dictionary fetch fedora 32 33 34 35 36 37 38 39 40

Usage: select oval by package name

Select from DB where package name is golang.

Usage: select oval by CVE-ID

Usage: select advisories