NAME

vuxml — FreeBSD VuXML query tool

SYNOPSIS

DESCRIPTION

The vuxml utility provides easy and flexible ways to query the FreeBSD VuXML database of security issues in FreeBSD and its ports collection.

You can search or explore the database:

• by vulnerability ID (with the [--id|-i] option),
• by regular expression in topics (with the [--topic|-t] option),
• by regular expression in topics and descriptions (with the [--keyword|-k] option),
• by package name or package name and version (with the [--package|-p] option),
  • the package name can be treated as a regular expression (with the [--re-names|-R] option),
• by reference source, reference source and ID, or ID (with the [--ref|-r] option),
  • existing sources can be listed (with the [--sources|-s] option),
• by discovery, entry or modification dates (with the [--discovery|-d], [--entry|-e] or [--modified|-m] options),
  • these dates can be a specific day, month or year.

For all these queries the detailed description is not printed, unless you use the [--desc|-d] option to render the HTML description as text.

For the package and reference queries, the package and version, or reference source and ID, are separated using the '~' character.

All the options can be used several times and their results are cumulative (ie. treated as logical OR).

ENVIRONMENT

The VUXML_DEBUG environment variable can be set to any value to enable debug mode.

The LOCALAPPDATA and TMP environment variables under Windows, and HOME, TMPDIR and TMP environment variables under other operating systems can influence the caching directory used.

FILES

The vuxml utility will attempt to maintain a caching directory for the web service it uses, where the downloaded database will be re-used within the next 24 hours.

This directory will be located in one of the following places:

• Windows:
  • %LOCALAPPDATA%/cache/vuxml
  • %TMP%/cache/vuxml
• Unix:
  • ${HOME}/.cache/vuxml
  • ${TMPDIR}/.cache/vuxml
  • ${TMP}/.cache/vuxml

EXIT STATUS

The vuxml utility exits 0 on success, and >0 if an error occurs.

EXAMPLES

Use the following command to search for vulnerabilities affecting the "gnutls" package:

vuxml -p gnutls

And the following one to search for vulnerabilities affecting packages whose name starts with "gnutls" ("gnutls", "gnutls-devel", "gnutls3" will match, while "linux-f10-gnutls" won't):

vuxml -Rp "^gnutls"

SEE ALSO

vuxml(3), VuXML website FreeBSD VuXML website VuXML database explanation in the Porter's handbook VuXML database as a FreeBSD port pkg-audit(8), vxquery

STANDARDS

The vuxml utility is not a standard UNIX command.

It tries to follow the PEP 8 style guide for Python code.

PORTABILITY

Tested OK under Windows.

Packaged for FreeBSD as pyXX-pnu-vuxml.

HISTORY

This implementation was made for the PNU project

While working on the pipinfo(1) tool, I noticed that some Python packages installed as FreeBSD ports where marked as vulnerable in Python advisories but not in FreeBSD ports advisories.

I made a tool called pysec2vuxml to check the 4000+ FreeBSD ports of Python packages, and found around 1% of them vulnerable.

So I made a library in order to verify if these vulnerable ports where also marked as vulnerable in FreeBSD VuXML, and got carried away writing this utility to demonstrate the use of the library!

LICENSE

This utility is available under the 3-clause BSD license.

AUTHORS

Hubert Tournier

CAVEATS

PORTEPOCH (ie. software versions ending with ",number") is not taken into account when checking if a vulnerable Python package is also a vulnerable FreeBSD port.

Exotic version numbers (ie. with letters for example) are also not taken into account.