CVE remediation advisor for Linux and Windows platforms. Looks up CVE details and provides vendor-confirmed fix commands for Ubuntu, Debian, RHEL, Alpine, SUSE, and Microsoft Windows.
pip install -r requirements.txt
python main.py lookup CVE-2023-4863Or install as a package:
pip install -e .
patchadvisor lookup CVE-2023-4863patchadvisor --verbose <command> # Show DEBUG output on console
patchadvisor --versionLogs are always written to logs/patchadvisor.log (rotating, 5 MB × 5 backups).
Fetches CVE metadata first and displays it immediately, then prompts you to choose which vendor(s) to scan. Only the selected vendors are queried, so you avoid unnecessary network calls.
patchadvisor lookup CVE-2023-4863
╭─ CVE-2023-4863 | CRITICAL (10.0) | WebP heap buffer overflow... ─╮
│ Description : ... │
│ Published : 2023-09-12 Last Modified: 2023-09-27 │
│ Source : scaprepo │
│ Base Score : 10.0 Severity : CRITICAL │
╰────────────────────────────────────────────────────────────────────╯
# Vendor Data Source
1 ubuntu Ubuntu Security API
2 debian Debian Security Tracker
3 redhat Red Hat Security Data API
4 alpine Alpine SecDB
5 suse SUSE OVAL
6 microsoft Microsoft Security Update Guide (MSRC)
7 all All vendors (default)
Select vendor(s) to scan [e.g. 1,3 or all, q to quit, Enter for all]:
You can enter:
- A single number:
1 - Multiple numbers:
1,3 - Vendor names directly:
ubuntu,redhat allor just press Enter to scan all vendorsqto quit without scanning
patchadvisor lookup CVE-2023-4863Options:
| Flag | Description |
|---|---|
--select TEXT |
Platform indices, e.g. 1,3 or all. Skips interactive fix prompt. |
--output [text|json] |
Output format (default: text) |
--no-cache |
Bypass cache read; fetch live and refresh cache |
--vendor TEXT |
Skip vendor prompt and restrict to one vendor (see patchadvisor vendors). |
patchadvisor lookup CVE-2023-4863 --select 1,3
patchadvisor lookup CVE-2023-4863 --select all
patchadvisor lookup CVE-2023-4863 --select all --output json
patchadvisor lookup CVE-2023-4863 --no-cache
patchadvisor lookup CVE-2023-4863 --vendor ubuntu
patchadvisor lookup CVE-2023-4863 --vendor redhat --select allTip: Use
--vendorto bypass the interactive prompt in scripts or CI pipelines.
Same two-step flow as lookup: shows CVE metadata, prompts for vendor selection, then applies fix commands for the selected platforms.
patchadvisor fix CVE-2023-4863 --select 1,5
patchadvisor fix CVE-2023-4863 --select all --dry-run
patchadvisor fix CVE-2023-4863 --select all --vendor redhat --dry-runOptions:
| Flag | Description |
|---|---|
--select TEXT |
Platform indices to fix — required |
--dry-run |
Print commands without executing |
--output [text|json] |
Output format |
--no-cache |
Bypass cache read; fetch live |
--vendor TEXT |
Skip vendor prompt and restrict to one vendor |
Displays base score, severity, CVSS vector, description, CWE IDs, and references. Shows [cached] next to the source when data is served from cache. No vendor scanning.
patchadvisor info CVE-2023-4863
patchadvisor info CVE-2023-4863 --output json
patchadvisor info CVE-2023-4863 --no-cachepatchadvisor vendorsPrints a table of vendor keys, data sources, and the --vendor flag to use:
| Vendor Key | Data Source | Usage |
|---|---|---|
ubuntu |
Ubuntu Security API | --vendor ubuntu |
debian |
Debian Security Tracker | --vendor debian |
redhat |
Red Hat Security Data API | --vendor redhat |
alpine |
Alpine SecDB | --vendor alpine |
suse |
SUSE OVAL | --vendor suse |
microsoft |
Microsoft Security Update Guide (MSRC) | --vendor microsoft |
patchadvisor cache list # List all cached keys with remaining TTL
patchadvisor cache clear # Clear all cache entries
patchadvisor cache clear --key scaprepo_CVE-2023-4863 # Clear one entryCache is stored in cache/ at the project root (1-hour TTL for CVE metadata, 2-hour TTL for scraper data).
Step 1 — CVE Metadata Fetch: Fetches CVE details from scaprepo (primary source), with automatic fallback to NVD. The result is displayed immediately so you can make an informed vendor selection.
Step 2 — Interactive Vendor Selection:
A numbered vendor table is shown. You select which vendor(s) to scan. Use --vendor to skip this prompt in non-interactive environments.
Step 3 — Parallel Vendor Scraping:
Only the chosen vendors are queried in parallel (via ThreadPoolExecutor). Each scraper checks the vendor's security advisory API for affected packages and fix versions.
Step 4 — Fix Output:
Generates vendor-confirmed fix commands (e.g. dnf update --advisory, apt-get install --only-upgrade) for selected platforms.
Results are cached to cache/ and reused on subsequent lookups. Use --no-cache to force a live fetch and update the cache.
| Platform | Versions | Source |
|---|---|---|
| Ubuntu | 14.04 – 24.10 | Ubuntu Security API |
| Debian | 8 – 13 | Debian Security Tracker |
| RHEL / CentOS / Rocky / AlmaLinux | 6 – 9 | Red Hat Security Data API |
| Alpine | 3.16 – edge | Alpine SecDB |
| SUSE | 15.4 – 15.6 | SUSE OVAL |
| Microsoft Windows | 10, 11, Server 2016–2025 | MSRC CVRF API |
| Universal fallback | — | OSV.dev |
| Variable | Purpose | Default |
|---|---|---|
SCAPREPO_BASE_URL |
scaprepo service base URL | https://www.scaprepo.com |
SCAPREPO_API_KEY |
scaprepo auth token | None |
NVD_API_KEY |
NVD API key (higher rate limits) | None |
PATCHADVISOR_CACHE_DIR |
Override cache directory | <project root>/cache |
FIXDB_TIMEOUT |
HTTP request timeout (seconds) | 15 |
pip install pytest responses
pytest tests/patchadvisor/
├── main.py # CLI entry point
├── LICENSE
├── README.md
├── pyproject.toml
├── requirements.txt
├── logs/ # Rotating log files (git-ignored)
├── cache/ # Local cache (git-ignored)
├── patchadvisor/
│ ├── models.py # Pydantic data models
│ ├── exceptions.py # Custom exceptions
│ ├── cache.py # File-based cache with no_cache bypass
│ ├── engine.py # Orchestration engine (parallel fan-out)
│ ├── logging_config.py # Rotating file + console logging setup
│ ├── command_builder.py # Fix command generator
│ ├── executor.py # Fix executor
│ ├── sources/ # CVE metadata sources
│ │ ├── base.py
│ │ ├── scaprepo.py # Primary: scaprepo API
│ │ └── nvd.py # Fallback: NVD REST API v2
│ └── scrapers/ # Vendor fix scrapers
│ ├── base.py
│ ├── ubuntu.py # Ubuntu Security API
│ ├── debian.py # Debian Security Tracker
│ ├── redhat.py # Red Hat Security Data API
│ ├── alpine.py # Alpine SecDB
│ ├── suse.py # SUSE OVAL
│ ├── microsoft.py # Microsoft MSRC CVRF API
│ └── osv.py # Universal fallback (OSV.dev)
└── tests/
├── sources/
└── scrapers/
The following vendor and platform support is planned for future releases:
- Arch Linux — via Arch Linux Security Tracker
- Gentoo — via GLSA (Gentoo Linux Security Advisories)
- Amazon Linux — via Amazon Linux Security Center
- Oracle Linux — via Oracle Linux Errata
- Rocky Linux / AlmaLinux — dedicated scrapers (currently covered by RHEL data)
- NuGet / .NET — via GitHub Security Advisories and NuGet vulnerability DB
- Apple / macOS — via Apple Product Security advisories, covering system-level CVEs
- pip / PyPI — via PyPA advisory database and OSV
- npm / Node.js — via npm audit and GitHub Advisory Database
- Maven / Java — via OSS Index and GitHub Advisory Database
- Go modules — via Go vulnerability database (pkg.go.dev/vuln)
- Cargo / Rust — via RustSec advisory database
- Machine-readable output improvements (SARIF format)
- GitHub Actions integration example
- REST API mode (optional local server)
- Plugin API for custom vendor scrapers
Contributions are welcome! Please open an issue first to discuss any significant change.
- Fork the repository
- Create a feature branch (
git checkout -b feature/my-feature) - Commit your changes
- Push and open a Pull Request
Apache License 2.0 — see LICENSE for details.