cveutils

This library provides functionality for fetching and parsing information about Common Vulnerabilities and Exposures (CVE) using the NIST National Vulnerability Database (NVD) RESTful API.

Instalation

pip install cveutils

Usage

To use this library, simply import the CVE class and initialize an instance with a CVE ID as a string.

from cveutils import CVE

cve = CVE('CVE-2021-12345')

CVE Object

The CVE object has the following attributes:

• ID: The CVE ID
• info: The full JSON response from the NVD API for the given CVE ID
• description: The description of the CVE
• cvss_v2: A dictionary containing the CVSSv2 score and related metrics (if available)
• cvss_v3: A dictionary containing the CVSSv3 score and related metrics (if available)
• published_date: The published date of the CVE in ISO format (YYYY-MM-DD)
• last_modified_date: The last modified date of the CVE in ISO format (YYYY-MM-DD)
• assigner: The organization that assigned the CVE ID
• references: A list of references related to the CVE

The cvss_v2 and cvss_v3 attributes are instances of the CVSSDictionary class, which allows access to the dictionary keys as attributes.

Example Usage

from cveutils import CVE

cve = CVE('CVE-2021-12345')

print(cve.ID)
print(cve.description)
print(cve.cvss_v3.baseScore)
print(cve.published_date)
print(cve.last_modified_date)
print(cve.assigner)
print(cve.references)

Output:

CVE-2021-12345
Description of the vulnerability
7.8
2021-01-01
2021-02-01
MITRE
['https://example.com/reference1', 'https://example.com/reference2']

To do

• Change to v2 api version
• Add more features https://nvd.nist.gov/developers/vulnerabilities
• PEP8
• Think if has some better way to not do the request in the moment of object creation
• Implement other api features