Google has introduced the OSV-Scanner toolkit for checking the presence of unpatched vulnerabilities in code and applications, working with the entire chain of code-related dependencies. OSV-Scanner allows identifying situations where an application becomes vulnerable due to issues in one of the libraries used as a dependency. The vulnerable library may be used indirectly, i.e., invoked through another dependency. The project's code is written in Go and is distributed under the Apache 2.0 license.
OSV-Scanner can automatically recursively scan the directory tree, identifying projects and applications by the presence of git directories (vulnerability information is determined through commit hash analysis), SBOM files (Software Bill Of Materials in SPDX and CycloneDX formats), manifests, or lock files from package managers such as Yarn, NPM, GEM, PIP, and Cargo. It also supports scanning the base of Docker container images built from packages in Debian repositories.
Information about vulnerabilities is sourced from the OSV (Open Source Vulnerabilities) database, covering security issues in repositories like Crates.io (Rust), Go, Maven, NPM (JavaScript), NuGet (C#), Packagist (PHP), PyPI (Python), RubyGems, Android, Debian, and Alpine, as well as data on vulnerabilities in the Linux kernel and reports of vulnerabilities in projects hosted on GitHub. The OSV database reflects the status of problem resolution, indicates commits where the vulnerability was introduced and patched, the range of affected versions, links to the project repository with code, and issue notifications. The provided API allows tracking vulnerability manifestation at the commit and tag level and analyzing the exposure of derivative products and dependencies to the issue.
Source: opennet.ru
