google/osv.dev
Osv.dev
OSV is a distributed database and aggregator of open-source security advisories that uses a standardized vulnerability schema to track security flaws. It functions as a system for collecting and normalizing security data from diverse ecosystems into a single unified format, providing a web API for querying package vulnerabilities and submitting standardized records.
The project distinguishes itself through a security advisory distribution service that supports bulk dataset exports via cloud storage buckets and incremental synchronization of security record updates. It also employs sandbox-based impact analysis, using version bisections in isolated containers to determine the exact range of affected software versions.
The system provides capabilities for software dependency scanning, allowing users to identify known flaws by mapping project versions and commit hashes against the vulnerability database. It includes tools for batch package querying, library version identification, and vulnerability record validation to ensure data integrity.
The project also provides auditing utilities to identify and report ingestion failures and data integrity issues during the import process.
Features
- Vulnerability Aggregators - Functions as a centralized aggregator that collects and normalizes security data from various open-source ecosystems.
- Ecosystem Normalizers - Functions as a centralized system that collects and normalizes security data from diverse ecosystems into a unified format.
- Dataset Distribution Services - Ships a cloud-based distribution service for bulk vulnerability dataset exports and incremental updates.
- Data Normalization - Collects and normalizes security advisories from diverse open-source ecosystems and external databases into a single unified format.
- Schema-Driven Data Normalizers - Converts diverse security advisories from multiple ecosystems into a single unified format using a standardized open source schema.
- External Data Ingestion - Provides web endpoints to ingest vulnerability contributions and updates from external sources to maintain a real-time database.
- Vulnerability Detail Retrievals - Fetches comprehensive information about a specific vulnerability using its unique identifier.
- CVE Vulnerability Search Engines - Provides a searchable distributed aggregator of open-source vulnerability databases to identify risks in dependencies.
- Dependency Vulnerability Scanners - Provides tools for identifying known security flaws in project dependencies by cross-referencing versions against a vulnerability database.
- Dependency Vulnerability Scanning - Checks software dependencies and lockfiles against a distributed database to identify known security flaws.
- Vulnerability Database Management - Provides systems for synchronizing and maintaining local copies of security metadata through bulk exports and incremental updates.
- Vulnerability Databases - Provides a system for submitting vulnerability information to a database via web API to keep security data current.
- Vulnerability Data Query Engines - Determines if a specific software version or commit is affected by a vulnerability using precise version ranges and identifiers.
- Vulnerability Analysis Tools - Executes bisections and impact analysis tasks in sandboxed containers to determine the scope of software vulnerabilities.
- Affected Version Bisections - Determines the exact range of affected software versions using bisection and version analysis.
- Vulnerability Contributions - Supports the submission and validation of new vulnerability records via API to keep open source security data current.
- Vulnerability Database APIs - Offers a programmatic web interface for querying package vulnerabilities and submitting standardized security records.
- Vulnerability Data Aggregators - Collects and serves security information from multiple sources that follow a standardized open-source vulnerability format.
- Vulnerability Data Synchronization - Imports security records from public repositories, web APIs, or cloud storage buckets after validating they match a specific schema.
- Vulnerability Schema Validations - Provides validation to ensure that vulnerability data conforms to a standardized open-source schema.
- Sandbox-Based Analysis - Runs version bisections and vulnerability tests inside isolated containers to determine the exact range of affected software versions.
- Bulk Dataset Export - Exports bulk vulnerability datasets as compressed archives stored in public cloud buckets for high-throughput offline downloading.
- Incremental Data Synchronization - Tracks modification dates for vulnerability records to allow clients to fetch only new or updated data since a specific point.
- Vulnerability Datasets - Exports the complete vulnerability database or ecosystem-specific subsets as compressed archives via a public cloud bucket.
- Vulnerability Package Queries - Allows retrieving vulnerability IDs and modification dates for a batch of packages in a single request.
- Cross-Ecosystem Relation Mappings - Links vulnerability records to equivalent identifiers and tracks dependencies across diverse package ecosystems.
- Package and Version Identification - Matches source code hashes of libraries to the closest upstream library and version for accurate identification.
- Hash-Based Resolutions - Matches software source code hashes to upstream library versions to identify the exact release affected by a flaw.
- Vulnerability Dependency Mapping - Identifies known vulnerabilities by mapping a project's list of dependencies against a distributed database of security advisories.
