Skip to main content

VulnerableCode is a free and open database of open source software package vulnerabilities because open source software vulnerabilities data and tools should be free and open source themselves.

Project description

Build Status Code License Data License Python 3.8+ stability-wip Gitter chat

VulnerableCode is a free and open database of open source software package vulnerabilities because open source software vulnerabilities data and tools should be free and open source themselves:

we are trying to change this and evolve the status quo in a few other areas!

  • Vulnerability databases have been traditionally proprietary even though they are mostly about free and open source software.

  • Vulnerability databases also often contain a lot of lesser value data which means a lot of false positive signals that require extensive expert reviews.

  • Vulnerability databases are also mostly about vulnerabilities first and software package second, making it difficult to find if and when a vulnerability applies to a piece of code. VulnerableCode focus is on software package first where a Package URL is a key and natural identifier for packages; this is making it easier to find a package and whether it is vulnerable.

Package URL themselves were designed first in ScanCode and VulnerableCode and are now a de-facto standard for vulnerability management and package references.

See https://github.com/package-url/purl-spec

The VulnerableCode project is a FOSS community resource to help improve the security of the open source software ecosystem and its users at large.

VulnerableCode consists of a database and the tools to collect, refine and keep the database current.

Read more about VulnerableCode https://vulnerablecode.readthedocs.org/

VulnerableCode is financially supported by NLnet, nexB, Google (through the GSoC) and the active contributions of several volunteers.

VulnerableCode tech stack is Python, Django, PostgreSQL, nginx and Docker and several libraries.

Getting started

Run with Docker

First install docker and docker-compose, then run:

git clone https://github.com/nexB/vulnerablecode.git && cd vulnerablecode
make envfile
docker-compose build
docker-compose up -d
docker-compose run vulnerablecode ./manage.py import --list

Then run an importer for nginx advisories (which is small):

docker-compose exec vulnerablecode ./manage.py import vulnerabilities.importers.nginx.NginxImporter
docker-compose exec vulnerablecode ./manage.py improve --all

At this point, the VulnerableCode app and API should be up and running with some data at http://localhost

Populate VulnerableCode database

VulnerableCode data collection works in two steps: importing data from multiple sources and then refining and improving how package and software vulnerabilities are related.

To run all importers and improvers use this:

./manage.py import --all
./manage.py improve --all

Local development installation

On a Debian system, use this:

sudo apt-get install  python3-venv python3-dev postgresql libpq-dev build-essential
git clone https://github.com/nexB/vulnerablecode.git && cd vulnerablecode
make dev envfile postgres
make test
source venv/bin/activate
./manage.py import vulnerabilities.importers.nginx.NginxImporter
./manage.py improve --all
make run

At this point, the VulnerableCode app and API is up at http://127.0.0.1:8001/

Interface

VulnerableCode comes with a minimal web UI:

vulnerablecode-ui.png

And a JSON API and its minimal web documentation:

vulnerablecode-json-api.png vulnerablecode-api-doc.png

License

Copyright (c) nexB Inc. and others. All rights reserved.

VulnerableCode is a trademark of nexB Inc.

SPDX-License-Identifier: Apache-2.0 AND CC-BY-SA-4.0

VulnerableCode software is licensed under the Apache License version 2.0.

VulnerableCode data is licensed collectively under CC-BY-SA-4.0.

See https://www.apache.org/licenses/LICENSE-2.0 for the license text.

See https://creativecommons.org/licenses/by-sa/4.0/legalcode for the license text.

See https://github.com/nexB/vulnerablecode for support or download.

See https://aboutcode.org for more information about nexB OSS projects.

Acknowledgements

This project was funded through the NGI0 PET Fund, a fund established by NLnet with financial support from the European Commission’s Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310.

https://nlnet.nl/project/VulnerableCode/

This project was funded through the NGI0 Discovery Fund, a fund established by NLnet with financial support from the European Commission’s Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825322.

https://nlnet.nl/project/vulnerabilitydatabase/

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

vulnerablecode-33.6.3.tar.gz (16.5 MB view details)

Uploaded Source

Built Distribution

vulnerablecode-33.6.3-py3-none-any.whl (2.1 MB view details)

Uploaded Python 3

File details

Details for the file vulnerablecode-33.6.3.tar.gz.

File metadata

  • Download URL: vulnerablecode-33.6.3.tar.gz
  • Upload date:
  • Size: 16.5 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/4.0.2 CPython/3.9.18

File hashes

Hashes for vulnerablecode-33.6.3.tar.gz
Algorithm Hash digest
SHA256 17ba1c63d08b7fcd4123a6bb1089e2598baffa16d75202ca96cb70e47b08aaf0
MD5 b70968f01ac15f2712406b73fbc48fd8
BLAKE2b-256 5a191049f63fca58e5bbc41c3df9486ef3c611b15eeadb8fc23d80151c54ebd7

See more details on using hashes here.

Provenance

File details

Details for the file vulnerablecode-33.6.3-py3-none-any.whl.

File metadata

File hashes

Hashes for vulnerablecode-33.6.3-py3-none-any.whl
Algorithm Hash digest
SHA256 8b5544df7507abd829ae1ac07af25f1fd8cdfd0ee37031063ae45e6ba21155e7
MD5 96fb00830d4f7d222f17e1cb0d59878f
BLAKE2b-256 77ad9ac9829d7c2388eee4ffbc077a7374b6534f1e7e570136509bbb35e871f6

See more details on using hashes here.

Provenance

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page