PyPI - owasp-depscan - Versions diffs - 5.4.7__tar.gz → 5.5.0__tar.gz - Mend

owasp-depscan 5.4.7tar.gz → 5.5.0tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of owasp-depscan might be problematic. Click here for more details.

Files changed (89) hide show

{owasp_depscan-5.4.7/owasp_depscan.egg-info → owasp_depscan-5.5.0}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.4.7
+Version: 5.5.0
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db==5.7.5
+Requires-Dist: appthreat-vulnerability-db==5.8.1
 Requires-Dist: defusedxml
 Requires-Dist: oras~=0.1.26
 Requires-Dist: PyYAML
@@ -55,7 +55,6 @@ OWASP dep-scan is a next-generation security and risk audit tool based on known
     -   [Linux distros](#linux-distros)
 -   [Usage](#usage)
     -   [OCI Artifacts via ORAS cli](#oci-artifacts-via-oras-cli)
-    -   [Single binary executables](#single-binary-executables)
     -   [Server mode](#server-mode)
     -   [Scanning projects locally (Python version)](#scanning-projects-locally-python-version)
     -   [Scanning containers locally (Python version)](#scanning-containers-locally-python-version)
@@ -319,25 +318,35 @@ dep-scan uses [cdxgen](https://github.com/CycloneDX/cdxgen) command internally t
 The following projects and package-dependency format is supported by cdxgen.
-| Language                 | Package format                                                                          |
-| ------------------------ | --------------------------------------------------------------------------------------- |
-| node.js                  | package-lock.json, pnpm-lock.yaml, yarn.lock, rush.js, bower.json, .min.js              |
-| java                     | maven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt), bazel                    |
-| php                      | composer.lock                                                                           |
-| python                   | setup.py, requirements.txt [2], Pipfile.lock, poetry.lock, bdist_wheel, .whl, .egg-info |
-| go                       | binary, go.mod, go.sum, Gopkg.lock                                                      |
-| ruby                     | Gemfile.lock, gemspec                                                                   |
-| rust                     | binary, Cargo.toml, Cargo.lock                                                          |
-| .Net                     | .csproj, packages.config, project.assets.json [3], packages.lock.json, .nupkg           |
-| dart                     | pubspec.lock, pubspec.yaml                                                              |
-| haskell                  | cabal.project.freeze                                                                    |
-| elixir                   | mix.lock                                                                                |
-| c/c++                    | conan.lock, conanfile.txt                                                               |
-| clojure                  | Clojure CLI (deps.edn), Leiningen (project.clj)                                         |
-| docker / oci image       | All supported languages and Linux OS packages                                           |
-| GitHub Actions Workflows | .github/workflows/\*.yml                                                                |
-| Jenkins Plugins          | .hpi files                                                                              |
-| YAML manifests           | docker-compose, kubernetes, kustomization, skaffold, tekton etc                         |
+| Language/Platform     | Project Types                                                                                                                                                    | Package Formats                                                                                                                       | Supported Evidence                                                                                    | Supports Transitives |
+| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | -------------------- |
+| Node.js               | `npm`, `pnpm`, `nodejs`, `js`, `javascript`, `typescript`, `ts`, `tsx`                                                                                           | `npm-shrinkwrap.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `rush.js`, `bower.json`, `.min.js`                         | Yes, except for `.min.`                                                                               | ✅                   |
+| Java                  | `java`, `groovy`, `kotlin`, `scala`, `jvm`, `gradle`, `mvn`, `maven`, `sbt`                                                                                      | `pom.xml` [1], `build.gradle`, `.kts`, `sbt`, `bazel`                                                                                 | Yes, unless `pom.xml` is manually parsed due to unavailability of maven or errors)                    | ✅                   |
+| Android               | `android`, `apk`, `aab`                                                                                                                                          | `apk`, `aab`                                                                                                                          | -                                                                                                     | -                    |
+| JAR                   | `jar`                                                                                                                                                            | `.jar`                                                                                                                                | -                                                                                                     | -                    |
+| JAR (Gradle Cache)    | `gradle-index`, `gradle-cache`                                                                                                                                   | `$HOME/caches/modules-2/files-2.1/\*\*/\*.jar`                                                                                        | -                                                                                                     | -                    |
+| JAR (SBT Cache)       | `sbt-index`, `sbt-cache`                                                                                                                                         | `$HOME/.ivy2/cache/\*\*/\*.jar `                                                                                                      | -                                                                                                     | -                    |
+| JAR (Maven Cache)     | `maven-index`, `maven-cache`, `maven-repo`                                                                                                                       | `$HOME/.m2/repository/\*\*/\*.jar`                                                                                                    | -                                                                                                     | -                    |
+| Python                | `python`, `py`, `pypi`                                                                                                                                           | `pyproject.toml`, `setup.py`, `requirements.txt` [2], `Pipfile.lock`, `poetry.lock`, `pdm.lock`, `bdist_wheel`, `.whl`, `.egg-info`   | Yes using the automatic pip install/freeze. When disabled, only with `Pipfile.lock` and `poetry.lock` | ✅                   |
+| Golang                | `go`, `golang`                                                                                                                                                   | `binary`, `go.mod`, `go.sum`, `Gopkg.lock`                                                                                            | Yes except binary                                                                                     | ✅                   |
+| Rust                  | `rust`, `rust-lang`, `cargo`                                                                                                                                     | `binary`, `Cargo.toml`, `Cargo.lock`                                                                                                  | Only for `Cargo.lock`                                                                                 | -                    |
+| Ruby                  | `ruby`, `gems`                                                                                                                                                   | `Gemfile.lock`, `gemspec`                                                                                                             | Only for `Gemfile.lock`                                                                               | -                    |
+| .NET (#C)             | `csharp`, `netcore`, `dotnet`, `vb`, `dotnet-framework`                                                                                                          | `.csproj`, `.vbproj`, `.fsproj`, `packages.config`, `project.assets.json` [3], `packages.lock.json`, `.nupkg`, `paket.lock`, `binary` | Only for `project.assets.json`, `packages.lock.json`, `paket.lock`                                    | -                    |
+| Dart                  | `dart`, `flutter`, `pub`                                                                                                                                         | `pubspec.lock`, `pubspec.yaml`                                                                                                        | Only for `pubspec.lock`                                                                               | -                    |
+| Haskell               | `haskell`, `hackage`, `cabal`                                                                                                                                    | `cabal.project.freeze`                                                                                                                | Yes                                                                                                   |                      |
+| Elixir                | `elixir`, `hex`, `mix`                                                                                                                                           | `mix.lock`                                                                                                                            | Yes                                                                                                   | -                    |
+| C++                   | `c`, `cpp`, `c++`, `conan`                                                                                                                                       | `conan.lock`, `conanfile.txt`, `\*.cmake`, `CMakeLists.txt`, `meson.build`, codebase without package managers!                        | Yes only for `conan.lock`. Best effort basis for `cmake` without version numbers.                     | ✅                   |
+| Clojure               | `clojure`, `edn`, `clj`, `leiningen`                                                                                                                             | `deps.edn`, `project.clj`                                                                                                             | Yes unless the files are parsed manually due to lack of clojure cli or leiningen command              | -                    |
+| GitHub Actions        | `github`, `actions`                                                                                                                                              | `.github/workflows/\*.yml`                                                                                                            | n/a                                                                                                   | ✅                   |
+| Operation System (OS) | `os`, `osquery`, `windows`, `linux`, `mac`, `macos`, `darwin`                                                                                                    |
+| Jenkins Plugins       | `jenkins`                                                                                                                                                        | `.hpi files`                                                                                                                          | -                                                                                                     | ✅                   |
+| Helm                  | `helm`, `charts`                                                                                                                                                 | `.yaml`                                                                                                                               | n/a                                                                                                   |                      |
+| Helm (Cache)          | `helm-index`, `helm-repo`                                                                                                                                        | `$HOME/.cache/helm/repository/\*\*/\*.yaml`                                                                                           | -                                                                                                     | -                    |
+| Container             | `universal`, `containerfile`, `docker-compose`, `dockerfile`, `swarm`, `tekton`, `kustomize`, `operator`, `skaffold`, `kubernetes`, `openshift`, `yaml-manifest` | `.yaml`, `docker-compose\*.yml`, `*Dockerfile*`, `*Containerfile*`, `bitbucket-pipelines.yml`                                         | n/a                                                                                                   | -                    |
+| Google Cloud Build    | `cloudbuild`                                                                                                                                                     | `cloudbuild.yaml`                                                                                                                     | n/a                                                                                                   | -                    |
+| Swift (iOS)           | `swift`                                                                                                                                                          | `Package.resolved`, `Package.swift` (swiftpm)                                                                                         | Yes                                                                                                   | -                    |
+| Binary                | `binary`, `blint`                                                                                                                                                |
+| Open API              | Open API Specification, Swagger                                                                                                                                  | `openapi\*.json`, `openapi\*.yaml`                                                                                                    | n/a                                                                                                   | -                    |
 ## Reachability analysis
@@ -380,6 +389,30 @@ The following environment variables can be used to customize the behavior.
 -   VDB_HOME - Directory to use for caching database. For docker-based execution, this directory should get mounted as a volume from the host
 -   VDB_DATABASE_URL - Vulnerability DB URL. Defaults to: ghcr.io/appthreat/vdbgz:v5
 -   USE_VDB_10Y - Set to true to use the larger 10-year vulnerability database. Default download url: ghcr.io/appthreat/vdb-10y:v5
+-   VDB_APP_ONLY - Set to true to use a special app-only vulnerability database. Default download url: ghcr.io/appthreat/vdbgz-app:v5
+Example 1 - Run depscan with app-only vdb.
+```shell
+docker run --rm \
+    -e VDB_HOME=/db \
+    -e VDB_APP_ONLY=true \
+    -e SCAN_DEBUG_MODE=debug \
+    -v /tmp:/db \
+    -v $PWD:/app ghcr.io/owasp-dep-scan/dep-scan --src /app --reports-dir /app/reports
+```
+Example 2 - Run depscan with a larger 10 year app-only vdb.
+```shell
+docker run --rm \
+    -e VDB_HOME=/db \
+    -e VDB_APP_ONLY=true \
+    -e USE_VDB_10Y=true \
+    -e SCAN_DEBUG_MODE=debug \
+    -v /tmp:/db \
+    -v $PWD:/app ghcr.io/owasp-dep-scan/dep-scan --src /app --reports-dir /app/reports
+```
 ## GitHub Security Advisory
@@ -521,7 +554,7 @@ The objects available are taken from the CycloneDX \*.vdr.json BOM file generate
 `pkg_group_rows` - List of vulnerability id and the dependency tree prioritized by depscan.
 Furthermore, insights are imaginable to be made available to the template, please reach out or contribute on demand.
-We appreciate it if you like to contribute your report templates as examples, please add/find them [here](contrib/report-templates/).
+We appreciate it if you like to contribute your report templates as examples, please add/find them [here](contrib/report-templates).
 ## Performance tuning

{owasp_depscan-5.4.7 → owasp_depscan-5.5.0}/README.md RENAMED Viewed

@@ -14,7 +14,6 @@ OWASP dep-scan is a next-generation security and risk audit tool based on known
     -   [Linux distros](#linux-distros)
 -   [Usage](#usage)
     -   [OCI Artifacts via ORAS cli](#oci-artifacts-via-oras-cli)
-    -   [Single binary executables](#single-binary-executables)
     -   [Server mode](#server-mode)
     -   [Scanning projects locally (Python version)](#scanning-projects-locally-python-version)
     -   [Scanning containers locally (Python version)](#scanning-containers-locally-python-version)
@@ -278,25 +277,35 @@ dep-scan uses [cdxgen](https://github.com/CycloneDX/cdxgen) command internally t
 The following projects and package-dependency format is supported by cdxgen.
-| Language                 | Package format                                                                          |
-| ------------------------ | --------------------------------------------------------------------------------------- |
-| node.js                  | package-lock.json, pnpm-lock.yaml, yarn.lock, rush.js, bower.json, .min.js              |
-| java                     | maven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt), bazel                    |
-| php                      | composer.lock                                                                           |
-| python                   | setup.py, requirements.txt [2], Pipfile.lock, poetry.lock, bdist_wheel, .whl, .egg-info |
-| go                       | binary, go.mod, go.sum, Gopkg.lock                                                      |
-| ruby                     | Gemfile.lock, gemspec                                                                   |
-| rust                     | binary, Cargo.toml, Cargo.lock                                                          |
-| .Net                     | .csproj, packages.config, project.assets.json [3], packages.lock.json, .nupkg           |
-| dart                     | pubspec.lock, pubspec.yaml                                                              |
-| haskell                  | cabal.project.freeze                                                                    |
-| elixir                   | mix.lock                                                                                |
-| c/c++                    | conan.lock, conanfile.txt                                                               |
-| clojure                  | Clojure CLI (deps.edn), Leiningen (project.clj)                                         |
-| docker / oci image       | All supported languages and Linux OS packages                                           |
-| GitHub Actions Workflows | .github/workflows/\*.yml                                                                |
-| Jenkins Plugins          | .hpi files                                                                              |
-| YAML manifests           | docker-compose, kubernetes, kustomization, skaffold, tekton etc                         |
+| Language/Platform     | Project Types                                                                                                                                                    | Package Formats                                                                                                                       | Supported Evidence                                                                                    | Supports Transitives |
+| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | -------------------- |
+| Node.js               | `npm`, `pnpm`, `nodejs`, `js`, `javascript`, `typescript`, `ts`, `tsx`                                                                                           | `npm-shrinkwrap.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `rush.js`, `bower.json`, `.min.js`                         | Yes, except for `.min.`                                                                               | ✅                   |
+| Java                  | `java`, `groovy`, `kotlin`, `scala`, `jvm`, `gradle`, `mvn`, `maven`, `sbt`                                                                                      | `pom.xml` [1], `build.gradle`, `.kts`, `sbt`, `bazel`                                                                                 | Yes, unless `pom.xml` is manually parsed due to unavailability of maven or errors)                    | ✅                   |
+| Android               | `android`, `apk`, `aab`                                                                                                                                          | `apk`, `aab`                                                                                                                          | -                                                                                                     | -                    |
+| JAR                   | `jar`                                                                                                                                                            | `.jar`                                                                                                                                | -                                                                                                     | -                    |
+| JAR (Gradle Cache)    | `gradle-index`, `gradle-cache`                                                                                                                                   | `$HOME/caches/modules-2/files-2.1/\*\*/\*.jar`                                                                                        | -                                                                                                     | -                    |
+| JAR (SBT Cache)       | `sbt-index`, `sbt-cache`                                                                                                                                         | `$HOME/.ivy2/cache/\*\*/\*.jar `                                                                                                      | -                                                                                                     | -                    |
+| JAR (Maven Cache)     | `maven-index`, `maven-cache`, `maven-repo`                                                                                                                       | `$HOME/.m2/repository/\*\*/\*.jar`                                                                                                    | -                                                                                                     | -                    |
+| Python                | `python`, `py`, `pypi`                                                                                                                                           | `pyproject.toml`, `setup.py`, `requirements.txt` [2], `Pipfile.lock`, `poetry.lock`, `pdm.lock`, `bdist_wheel`, `.whl`, `.egg-info`   | Yes using the automatic pip install/freeze. When disabled, only with `Pipfile.lock` and `poetry.lock` | ✅                   |
+| Golang                | `go`, `golang`                                                                                                                                                   | `binary`, `go.mod`, `go.sum`, `Gopkg.lock`                                                                                            | Yes except binary                                                                                     | ✅                   |
+| Rust                  | `rust`, `rust-lang`, `cargo`                                                                                                                                     | `binary`, `Cargo.toml`, `Cargo.lock`                                                                                                  | Only for `Cargo.lock`                                                                                 | -                    |
+| Ruby                  | `ruby`, `gems`                                                                                                                                                   | `Gemfile.lock`, `gemspec`                                                                                                             | Only for `Gemfile.lock`                                                                               | -                    |
+| .NET (#C)             | `csharp`, `netcore`, `dotnet`, `vb`, `dotnet-framework`                                                                                                          | `.csproj`, `.vbproj`, `.fsproj`, `packages.config`, `project.assets.json` [3], `packages.lock.json`, `.nupkg`, `paket.lock`, `binary` | Only for `project.assets.json`, `packages.lock.json`, `paket.lock`                                    | -                    |
+| Dart                  | `dart`, `flutter`, `pub`                                                                                                                                         | `pubspec.lock`, `pubspec.yaml`                                                                                                        | Only for `pubspec.lock`                                                                               | -                    |
+| Haskell               | `haskell`, `hackage`, `cabal`                                                                                                                                    | `cabal.project.freeze`                                                                                                                | Yes                                                                                                   |                      |
+| Elixir                | `elixir`, `hex`, `mix`                                                                                                                                           | `mix.lock`                                                                                                                            | Yes                                                                                                   | -                    |
+| C++                   | `c`, `cpp`, `c++`, `conan`                                                                                                                                       | `conan.lock`, `conanfile.txt`, `\*.cmake`, `CMakeLists.txt`, `meson.build`, codebase without package managers!                        | Yes only for `conan.lock`. Best effort basis for `cmake` without version numbers.                     | ✅                   |
+| Clojure               | `clojure`, `edn`, `clj`, `leiningen`                                                                                                                             | `deps.edn`, `project.clj`                                                                                                             | Yes unless the files are parsed manually due to lack of clojure cli or leiningen command              | -                    |
+| GitHub Actions        | `github`, `actions`                                                                                                                                              | `.github/workflows/\*.yml`                                                                                                            | n/a                                                                                                   | ✅                   |
+| Operation System (OS) | `os`, `osquery`, `windows`, `linux`, `mac`, `macos`, `darwin`                                                                                                    |
+| Jenkins Plugins       | `jenkins`                                                                                                                                                        | `.hpi files`                                                                                                                          | -                                                                                                     | ✅                   |
+| Helm                  | `helm`, `charts`                                                                                                                                                 | `.yaml`                                                                                                                               | n/a                                                                                                   |                      |
+| Helm (Cache)          | `helm-index`, `helm-repo`                                                                                                                                        | `$HOME/.cache/helm/repository/\*\*/\*.yaml`                                                                                           | -                                                                                                     | -                    |
+| Container             | `universal`, `containerfile`, `docker-compose`, `dockerfile`, `swarm`, `tekton`, `kustomize`, `operator`, `skaffold`, `kubernetes`, `openshift`, `yaml-manifest` | `.yaml`, `docker-compose\*.yml`, `*Dockerfile*`, `*Containerfile*`, `bitbucket-pipelines.yml`                                         | n/a                                                                                                   | -                    |
+| Google Cloud Build    | `cloudbuild`                                                                                                                                                     | `cloudbuild.yaml`                                                                                                                     | n/a                                                                                                   | -                    |
+| Swift (iOS)           | `swift`                                                                                                                                                          | `Package.resolved`, `Package.swift` (swiftpm)                                                                                         | Yes                                                                                                   | -                    |
+| Binary                | `binary`, `blint`                                                                                                                                                |
+| Open API              | Open API Specification, Swagger                                                                                                                                  | `openapi\*.json`, `openapi\*.yaml`                                                                                                    | n/a                                                                                                   | -                    |
 ## Reachability analysis
@@ -339,6 +348,30 @@ The following environment variables can be used to customize the behavior.
 -   VDB_HOME - Directory to use for caching database. For docker-based execution, this directory should get mounted as a volume from the host
 -   VDB_DATABASE_URL - Vulnerability DB URL. Defaults to: ghcr.io/appthreat/vdbgz:v5
 -   USE_VDB_10Y - Set to true to use the larger 10-year vulnerability database. Default download url: ghcr.io/appthreat/vdb-10y:v5
+-   VDB_APP_ONLY - Set to true to use a special app-only vulnerability database. Default download url: ghcr.io/appthreat/vdbgz-app:v5
+Example 1 - Run depscan with app-only vdb.
+```shell
+docker run --rm \
+    -e VDB_HOME=/db \
+    -e VDB_APP_ONLY=true \
+    -e SCAN_DEBUG_MODE=debug \
+    -v /tmp:/db \
+    -v $PWD:/app ghcr.io/owasp-dep-scan/dep-scan --src /app --reports-dir /app/reports
+```
+Example 2 - Run depscan with a larger 10 year app-only vdb.
+```shell
+docker run --rm \
+    -e VDB_HOME=/db \
+    -e VDB_APP_ONLY=true \
+    -e USE_VDB_10Y=true \
+    -e SCAN_DEBUG_MODE=debug \
+    -v /tmp:/db \
+    -v $PWD:/app ghcr.io/owasp-dep-scan/dep-scan --src /app --reports-dir /app/reports
+```
 ## GitHub Security Advisory
@@ -480,7 +513,7 @@ The objects available are taken from the CycloneDX \*.vdr.json BOM file generate
 `pkg_group_rows` - List of vulnerability id and the dependency tree prioritized by depscan.
 Furthermore, insights are imaginable to be made available to the template, please reach out or contribute on demand.
-We appreciate it if you like to contribute your report templates as examples, please add/find them [here](contrib/report-templates/).
+We appreciate it if you like to contribute your report templates as examples, please add/find them [here](contrib/report-templates).
 ## Performance tuning

{owasp_depscan-5.4.7 → owasp_depscan-5.5.0}/depscan/lib/analysis.py RENAMED Viewed

@@ -19,7 +19,7 @@ from rich.table import Table
 from rich.tree import Tree
 from vdb.lib import CPE_FULL_REGEX
 from vdb.lib.config import placeholder_exclude_version, placeholder_fix_version
-from vdb.lib.utils import parse_cpe, parse_purl
+from vdb.lib.utils import get_cvss3_from_vector, get_cvss4_from_vector, parse_cpe, parse_purl
 from depscan.lib import config
 from depscan.lib.logger import LOG, console
@@ -336,6 +336,11 @@ def prepare_vdr(options: PrepareVdrOptions):
             justify = "right"
         table.add_column(header=h, justify=justify, vertical="top")
     for vuln_occ_dict in options.results:
+        # If CVSS v4 data is available, override the severity and cvss_score
+        if vuln_occ_dict.get("cvss4_vector_string"):
+            cvss4_obj = get_cvss4_from_vector(vuln_occ_dict.get("cvss4_vector_string"))
+            vuln_occ_dict["cvss_score"] = cvss4_obj.get("baseScore")
+            vuln_occ_dict["severity"] = cvss4_obj.get("baseSeverity").upper()
         vid = vuln_occ_dict.get("id")
         problem_type = vuln_occ_dict.get("problem_type")
         cwes = []
@@ -1026,34 +1031,33 @@ def cvss_to_vdr_rating(vuln_occ_dict):
     :return: A list containing a dictionary with CVSS score information.
     """
-    cvss_score = vuln_occ_dict.get("cvss_score", 2.0)
-    with contextlib.suppress(ValueError, TypeError):
-        cvss_score = float(cvss_score)
-    if (pkg_severity := vuln_occ_dict.get("severity", "").lower()) not in (
-        "critical",
-        "high",
-        "medium",
-        "low",
-        "info",
-        "none",
-    ):
-        pkg_severity = "unknown"
-    ratings = [
-        {
-            "score": cvss_score,
-            "severity": pkg_severity,
-        }
-    ]
-    method = "31"
+    ratings = []
+    # Support for cvss v4
+    if vuln_occ_dict.get("cvss4_vector_string") and (vector_string := vuln_occ_dict.get("cvss4_vector_string")):
+        cvss4_obj = get_cvss4_from_vector(vector_string)
+        ratings.append(
+            {
+                "method": "CVSSv4",
+                "score": cvss4_obj.get("baseScore"),
+                "severity": cvss4_obj.get("baseSeverity").lower(),
+                "vector": vector_string
+            }
+        )
     if vuln_occ_dict.get("cvss_v3") and (
         vector_string := vuln_occ_dict["cvss_v3"].get("vector_string")
     ):
-        ratings[0]["vector"] = vector_string
         with contextlib.suppress(CVSSError):
-            method = cvss.CVSS3(vector_string).as_json().get("version")
+            cvss3_obj = get_cvss3_from_vector(vector_string)
+            method = cvss3_obj.get("version")
             method = method.replace(".", "").replace("0", "")
-    ratings[0]["method"] = f"CVSSv{method}"
+            ratings.append(
+                {
+                    "method": f"CVSSv{method}",
+                    "score": cvss3_obj.get("baseScore"),
+                    "severity": cvss3_obj.get("baseSeverity").lower(),
+                    "vector": vector_string
+                }
+            )
     return ratings

{owasp_depscan-5.4.7 → owasp_depscan-5.5.0}/depscan/lib/config.py RENAMED Viewed

@@ -314,17 +314,21 @@ vdb_rafs_database_url = os.getenv(
     "VDB_RAFS_DATABASE_URL", "ghcr.io/appthreat/vdb:v5-rafs"
 )
-# Larger 10 year database
-vdb_10y_database_url = os.getenv(
-    "VDB_10Y_DATABASE_URL", "ghcr.io/appthreat/vdbgz-10y:v5"
-)
-vdb_10y_rafs_database_url = os.getenv(
-    "VDB_10Y_RAFS_DATABASE_URL", "ghcr.io/appthreat/vdb-10y:v5-rafs"
-)
+# App only data
+if os.getenv("VDB_APP_ONLY", "") in ("true", "1"):
+    vdb_database_url = os.getenv("VDB_APP_DATABASE_URL", "ghcr.io/appthreat/vdbgz-app:v5")
+    vdb_rafs_database_url = os.getenv("VDB_APP_RAFS_DATABASE_URL", "ghcr.io/appthreat/vdb-app:v5-rafs")
-if os.getenv("USE_VDB_10Y", "") in ("true", "1"):
-    vdb_database_url = vdb_10y_database_url
-    vdb_rafs_database_url = vdb_10y_rafs_database_url
+# Larger 10 year database
+if os.getenv("USE_VDB_10Y", "") in ("true", "1") or os.getenv("NVD_START_YEAR", "") in ("2014",):
+    if os.getenv("VDB_APP_ONLY", "") in ("true", "1"):
+        # 10 year app-only database
+        vdb_database_url = os.getenv("VDB_APP_10Y_DATABASE_URL", "ghcr.io/appthreat/vdbgz-app-10y:v5")
+        vdb_rafs_database_url = os.getenv("VDB_APP_10Y_RAFS_DATABASE_URL", "ghcr.io/appthreat/vdb-app-10y:v5-rafs")
+    else:
+        # 10 year database
+        vdb_database_url = os.getenv("VDB_10Y_DATABASE_URL", "ghcr.io/appthreat/vdbgz-10y:v5")
+        vdb_rafs_database_url = os.getenv("VDB_10Y_RAFS_DATABASE_URL", "ghcr.io/appthreat/vdb-10y:v5-rafs")
 # Package risk scoring using a simple weighted formula with no backing
 # research All parameters and their max value and weight can be overridden

{owasp_depscan-5.4.7 → owasp_depscan-5.5.0/owasp_depscan.egg-info}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.4.7
+Version: 5.5.0
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db==5.7.5
+Requires-Dist: appthreat-vulnerability-db==5.8.1
 Requires-Dist: defusedxml
 Requires-Dist: oras~=0.1.26
 Requires-Dist: PyYAML
@@ -55,7 +55,6 @@ OWASP dep-scan is a next-generation security and risk audit tool based on known
     -   [Linux distros](#linux-distros)
 -   [Usage](#usage)
     -   [OCI Artifacts via ORAS cli](#oci-artifacts-via-oras-cli)
-    -   [Single binary executables](#single-binary-executables)
     -   [Server mode](#server-mode)
     -   [Scanning projects locally (Python version)](#scanning-projects-locally-python-version)
     -   [Scanning containers locally (Python version)](#scanning-containers-locally-python-version)
@@ -319,25 +318,35 @@ dep-scan uses [cdxgen](https://github.com/CycloneDX/cdxgen) command internally t
 The following projects and package-dependency format is supported by cdxgen.
-| Language                 | Package format                                                                          |
-| ------------------------ | --------------------------------------------------------------------------------------- |
-| node.js                  | package-lock.json, pnpm-lock.yaml, yarn.lock, rush.js, bower.json, .min.js              |
-| java                     | maven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt), bazel                    |
-| php                      | composer.lock                                                                           |
-| python                   | setup.py, requirements.txt [2], Pipfile.lock, poetry.lock, bdist_wheel, .whl, .egg-info |
-| go                       | binary, go.mod, go.sum, Gopkg.lock                                                      |
-| ruby                     | Gemfile.lock, gemspec                                                                   |
-| rust                     | binary, Cargo.toml, Cargo.lock                                                          |
-| .Net                     | .csproj, packages.config, project.assets.json [3], packages.lock.json, .nupkg           |
-| dart                     | pubspec.lock, pubspec.yaml                                                              |
-| haskell                  | cabal.project.freeze                                                                    |
-| elixir                   | mix.lock                                                                                |
-| c/c++                    | conan.lock, conanfile.txt                                                               |
-| clojure                  | Clojure CLI (deps.edn), Leiningen (project.clj)                                         |
-| docker / oci image       | All supported languages and Linux OS packages                                           |
-| GitHub Actions Workflows | .github/workflows/\*.yml                                                                |
-| Jenkins Plugins          | .hpi files                                                                              |
-| YAML manifests           | docker-compose, kubernetes, kustomization, skaffold, tekton etc                         |
+| Language/Platform     | Project Types                                                                                                                                                    | Package Formats                                                                                                                       | Supported Evidence                                                                                    | Supports Transitives |
+| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | -------------------- |
+| Node.js               | `npm`, `pnpm`, `nodejs`, `js`, `javascript`, `typescript`, `ts`, `tsx`                                                                                           | `npm-shrinkwrap.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `rush.js`, `bower.json`, `.min.js`                         | Yes, except for `.min.`                                                                               | ✅                   |
+| Java                  | `java`, `groovy`, `kotlin`, `scala`, `jvm`, `gradle`, `mvn`, `maven`, `sbt`                                                                                      | `pom.xml` [1], `build.gradle`, `.kts`, `sbt`, `bazel`                                                                                 | Yes, unless `pom.xml` is manually parsed due to unavailability of maven or errors)                    | ✅                   |
+| Android               | `android`, `apk`, `aab`                                                                                                                                          | `apk`, `aab`                                                                                                                          | -                                                                                                     | -                    |
+| JAR                   | `jar`                                                                                                                                                            | `.jar`                                                                                                                                | -                                                                                                     | -                    |
+| JAR (Gradle Cache)    | `gradle-index`, `gradle-cache`                                                                                                                                   | `$HOME/caches/modules-2/files-2.1/\*\*/\*.jar`                                                                                        | -                                                                                                     | -                    |
+| JAR (SBT Cache)       | `sbt-index`, `sbt-cache`                                                                                                                                         | `$HOME/.ivy2/cache/\*\*/\*.jar `                                                                                                      | -                                                                                                     | -                    |
+| JAR (Maven Cache)     | `maven-index`, `maven-cache`, `maven-repo`                                                                                                                       | `$HOME/.m2/repository/\*\*/\*.jar`                                                                                                    | -                                                                                                     | -                    |
+| Python                | `python`, `py`, `pypi`                                                                                                                                           | `pyproject.toml`, `setup.py`, `requirements.txt` [2], `Pipfile.lock`, `poetry.lock`, `pdm.lock`, `bdist_wheel`, `.whl`, `.egg-info`   | Yes using the automatic pip install/freeze. When disabled, only with `Pipfile.lock` and `poetry.lock` | ✅                   |
+| Golang                | `go`, `golang`                                                                                                                                                   | `binary`, `go.mod`, `go.sum`, `Gopkg.lock`                                                                                            | Yes except binary                                                                                     | ✅                   |
+| Rust                  | `rust`, `rust-lang`, `cargo`                                                                                                                                     | `binary`, `Cargo.toml`, `Cargo.lock`                                                                                                  | Only for `Cargo.lock`                                                                                 | -                    |
+| Ruby                  | `ruby`, `gems`                                                                                                                                                   | `Gemfile.lock`, `gemspec`                                                                                                             | Only for `Gemfile.lock`                                                                               | -                    |
+| .NET (#C)             | `csharp`, `netcore`, `dotnet`, `vb`, `dotnet-framework`                                                                                                          | `.csproj`, `.vbproj`, `.fsproj`, `packages.config`, `project.assets.json` [3], `packages.lock.json`, `.nupkg`, `paket.lock`, `binary` | Only for `project.assets.json`, `packages.lock.json`, `paket.lock`                                    | -                    |
+| Dart                  | `dart`, `flutter`, `pub`                                                                                                                                         | `pubspec.lock`, `pubspec.yaml`                                                                                                        | Only for `pubspec.lock`                                                                               | -                    |
+| Haskell               | `haskell`, `hackage`, `cabal`                                                                                                                                    | `cabal.project.freeze`                                                                                                                | Yes                                                                                                   |                      |
+| Elixir                | `elixir`, `hex`, `mix`                                                                                                                                           | `mix.lock`                                                                                                                            | Yes                                                                                                   | -                    |
+| C++                   | `c`, `cpp`, `c++`, `conan`                                                                                                                                       | `conan.lock`, `conanfile.txt`, `\*.cmake`, `CMakeLists.txt`, `meson.build`, codebase without package managers!                        | Yes only for `conan.lock`. Best effort basis for `cmake` without version numbers.                     | ✅                   |
+| Clojure               | `clojure`, `edn`, `clj`, `leiningen`                                                                                                                             | `deps.edn`, `project.clj`                                                                                                             | Yes unless the files are parsed manually due to lack of clojure cli or leiningen command              | -                    |
+| GitHub Actions        | `github`, `actions`                                                                                                                                              | `.github/workflows/\*.yml`                                                                                                            | n/a                                                                                                   | ✅                   |
+| Operation System (OS) | `os`, `osquery`, `windows`, `linux`, `mac`, `macos`, `darwin`                                                                                                    |
+| Jenkins Plugins       | `jenkins`                                                                                                                                                        | `.hpi files`                                                                                                                          | -                                                                                                     | ✅                   |
+| Helm                  | `helm`, `charts`                                                                                                                                                 | `.yaml`                                                                                                                               | n/a                                                                                                   |                      |
+| Helm (Cache)          | `helm-index`, `helm-repo`                                                                                                                                        | `$HOME/.cache/helm/repository/\*\*/\*.yaml`                                                                                           | -                                                                                                     | -                    |
+| Container             | `universal`, `containerfile`, `docker-compose`, `dockerfile`, `swarm`, `tekton`, `kustomize`, `operator`, `skaffold`, `kubernetes`, `openshift`, `yaml-manifest` | `.yaml`, `docker-compose\*.yml`, `*Dockerfile*`, `*Containerfile*`, `bitbucket-pipelines.yml`                                         | n/a                                                                                                   | -                    |
+| Google Cloud Build    | `cloudbuild`                                                                                                                                                     | `cloudbuild.yaml`                                                                                                                     | n/a                                                                                                   | -                    |
+| Swift (iOS)           | `swift`                                                                                                                                                          | `Package.resolved`, `Package.swift` (swiftpm)                                                                                         | Yes                                                                                                   | -                    |
+| Binary                | `binary`, `blint`                                                                                                                                                |
+| Open API              | Open API Specification, Swagger                                                                                                                                  | `openapi\*.json`, `openapi\*.yaml`                                                                                                    | n/a                                                                                                   | -                    |
 ## Reachability analysis
@@ -380,6 +389,30 @@ The following environment variables can be used to customize the behavior.
 -   VDB_HOME - Directory to use for caching database. For docker-based execution, this directory should get mounted as a volume from the host
 -   VDB_DATABASE_URL - Vulnerability DB URL. Defaults to: ghcr.io/appthreat/vdbgz:v5
 -   USE_VDB_10Y - Set to true to use the larger 10-year vulnerability database. Default download url: ghcr.io/appthreat/vdb-10y:v5
+-   VDB_APP_ONLY - Set to true to use a special app-only vulnerability database. Default download url: ghcr.io/appthreat/vdbgz-app:v5
+Example 1 - Run depscan with app-only vdb.
+```shell
+docker run --rm \
+    -e VDB_HOME=/db \
+    -e VDB_APP_ONLY=true \
+    -e SCAN_DEBUG_MODE=debug \
+    -v /tmp:/db \
+    -v $PWD:/app ghcr.io/owasp-dep-scan/dep-scan --src /app --reports-dir /app/reports
+```
+Example 2 - Run depscan with a larger 10 year app-only vdb.
+```shell
+docker run --rm \
+    -e VDB_HOME=/db \
+    -e VDB_APP_ONLY=true \
+    -e USE_VDB_10Y=true \
+    -e SCAN_DEBUG_MODE=debug \
+    -v /tmp:/db \
+    -v $PWD:/app ghcr.io/owasp-dep-scan/dep-scan --src /app --reports-dir /app/reports
+```
 ## GitHub Security Advisory
@@ -521,7 +554,7 @@ The objects available are taken from the CycloneDX \*.vdr.json BOM file generate
 `pkg_group_rows` - List of vulnerability id and the dependency tree prioritized by depscan.
 Furthermore, insights are imaginable to be made available to the template, please reach out or contribute on demand.
-We appreciate it if you like to contribute your report templates as examples, please add/find them [here](contrib/report-templates/).
+We appreciate it if you like to contribute your report templates as examples, please add/find them [here](contrib/report-templates).
 ## Performance tuning

{owasp_depscan-5.4.7 → owasp_depscan-5.5.0}/owasp_depscan.egg-info/requires.txt RENAMED Viewed

@@ -1,4 +1,4 @@
-appthreat-vulnerability-db==5.7.5
+appthreat-vulnerability-db==5.8.1
 defusedxml
 oras~=0.1.26
 PyYAML

{owasp_depscan-5.4.7 → owasp_depscan-5.5.0}/pyproject.toml RENAMED Viewed

@@ -1,12 +1,12 @@
 [project]
 name = "owasp-depscan"
-version = "5.4.7"
+version = "5.5.0"
 description = "Fully open-source security audit for project dependencies based on known vulnerabilities and advisories."
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},
 ]
 dependencies = [
-    "appthreat-vulnerability-db==5.7.5",
+    "appthreat-vulnerability-db==5.8.1",
     "defusedxml",
     "oras~=0.1.26",
     "PyYAML",

{owasp_depscan-5.4.7 → owasp_depscan-5.5.0}/test/test_analysis.py RENAMED Viewed

@@ -708,8 +708,7 @@ def test_cvss_to_vdr_rating():
         "severity": "HIGH",
     }
     # Test missing score and vector string
-    assert cvss_to_vdr_rating(res) == [
-        {'method': 'CVSSv31', 'score': 2.0, 'severity': 'high'}]
+    assert cvss_to_vdr_rating(res) == []
     # Test parsing
     res["cvss_v3"]["vector_string"] = ("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I"
                                        ":N/A:H")
@@ -729,6 +728,24 @@ def test_cvss_to_vdr_rating():
         'severity': 'high',
         'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
     }]
+    assert cvss_to_vdr_rating({
+        "cvss_v3": {
+            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H"
+        },
+        "cvss4_vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H"
+    }) == [{
+        'method': 'CVSSv4',
+        'score': 7.9,
+        'severity': 'high',
+        'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H'
+    },
+    {
+        'method': 'CVSSv31',
+        'score': 10.0,
+        'severity': 'critical',
+        'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H'
+    }
+    ]
 def test_get_version_range():

{owasp_depscan-5.4.7 → owasp_depscan-5.5.0}/vendor/choosealicense.com/_licenses/mpl-2.0.txt RENAMED Viewed

@@ -393,7 +393,7 @@ Exhibit A - Source Code Form License Notice
   This Source Code Form is subject to the terms of the Mozilla Public
   License, v. 2.0. If a copy of the MPL was not distributed with this
-  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  file, You can obtain one at https://mozilla.org/MPL/2.0/.
 If it is not possible or desirable to put the notice in a particular
 file, then You may include the notice in a location (such as a LICENSE

owasp-depscan 5.4.7__tar.gz → 5.5.0__tar.gz

Potentially problematic release.

owasp-depscan 5.4.7tar.gz → 5.5.0tar.gz