cvereport(1)

📦 version 4.0, in alpine 3.22, alpine 3.23, alpine 3.24, fedora 43, fedora 44

💖 cvereport(1) — the cvechecker glow-up report generator 💖

okay bestie, sit DOWN, because this little icon of a tool is about to make your vulnerability data look cute. it's called cvereport, and it lives in section 1 of the manual (iykyk), and yes, it's giving certified main character energy. 🎀

✨ NAME ✨

cvereport — generates an HTML report for the cvechecker output. periodt. 💅

🦋 SYNOPSIS 🦋

cvereport [-d | -D] <targetdir> <acknowledgementfile>

that's it. two args, one lil flag. so slay. ✨

🌸 DESCRIPTION 🌸

so basically cvereport takes your cvechecker output and turns it into a whole HTML report. 💖 it does this through some simple XML/XSLT transformations — nothing dramatic, just a lil glow-up pipeline — and it leans on an acknowledgement file to keep track of the state of the CVE entries that match your system. no cap. 🔥

👑 USAGE 👑

🫶 COMMAND USAGE 🫶

the command literally needs two user-specified options, bestie, no skipping:

  • the targetdir — an existing, writeable directory where cvereport can store its report.html output. 📁✨
  • the acknowledgementfile — an existing, readable XML file that contains the analysis of the CVE entries for your system. 🧚

the difference between -d and -D? okay so:

  • -d runs the standard cvechecker report, whereas
  • -D runs the cvechecker report including matches for higher versions of the installed software 👀

like, -D is the overachiever version. lowkey obsessed. 💜

🎀 ACKNOWLEDGEMENT FILE FORMAT 🎀

the XML file for the acknowledgements uses the following syntax:

<?xml version="1.0"?>
<acknowledgements>
  <resolution id="resolution_id_1">Comment about why a CVE entry is irrelevant for your system</resolution>
  <resolution id="resolution_id_2">Another comment</resolution>
  <comment id="comment_id_1">Comment why the CVE is acknowledged, but not resolved</comment>
  <file name="/path/to/filename1" cve="CVE-2000-1234" state="irrelevant" resolution="resolution_id_1" />
  <file name="/path/to/filename2" cve="CVE-2000-5678" state="irrelevant" resolution="resolution_id_2" />
  <file name="/path/to/filename3" cve="CVE-2001-9012" state="acknowledged" comment="comment_id_1" />
</acknowledgements>

the use of comments or resolutions within the file entity is not mandatory, but recommended. like, you can skip them, but why would you bestie, treat yourself. 🙈

💀 note: this is XML, so keep those tags closed and those attributes quoted, or the vibe check will fail hard.

🌈 AUTHOR 🌈

cvereport is part of the cvechecker tool. cvereport was written by Sven Vermeulen <sven.vermeulen@siphos.be>. iconic behaviour fr fr. 👑

okay that's the whole page, bestie — this little cutie is dated September 1, 2010 (with the 27 November 2010 version of the cvereport manual, section cvereport(1)), and that's a wrap. go generate that report and ate. 💖✨🎀🦋🌸💅🫶

📦 where this page comes from