Listing Vulnerabilities
To dispaly a list of known vulnerabilities affecting a product, call “vulnerability”, “list” and then name and version of the product:
bomnipotent_client vulnerability list vulny 0.1.0╭─────────┬─────────┬─────────────────────┬───────────────────────────┬───────┬──────────┬─────────┬─────────────────╮
│ Product │ Version │ Vulnerability │ Description │ Score │ Severity │ TLP │ CSAF Assessment │
├─────────┼─────────┼─────────────────────┼───────────────────────────┼───────┼──────────┼─────────┼─────────────────┤
│ vulny │ 0.1.0 │ GHSA-qg5g-gv98-5ffh │ rustls network-reachable │ │ medium │ Default │ │
│ │ │ │ panic in `Acceptor::accep │ │ │ │ │
│ │ │ │ t` │ │ │ │ │
╰─────────┴─────────┴─────────────────────┴───────────────────────────┴───────┴──────────┴─────────┴─────────────────╯Product name and version are optional positional arguments. If you do not provide a version, you will get the output for all versions of the product, and if you do not provide either, the output of all products accessible to you.
bomnipotent_client vulnerability list╭─────────────┬─────────┬─────────────────────┬───────────────────────────┬───────┬──────────┬─────────┬─────────────────╮
│ Product │ Version │ Vulnerability │ Description │ Score │ Severity │ TLP │ CSAF Assessment │
├─────────────┼─────────┼─────────────────────┼───────────────────────────┼───────┼──────────┼─────────┼─────────────────┤
│ BOMnipotent │ 1.0.0 │ GHSA-qg5g-gv98-5ffh │ rustls network-reachable │ │ medium │ Default │ │
│ │ │ │ panic in `Acceptor::accep │ │ │ │ │
│ │ │ │ t` │ │ │ │ │
│ vulny │ 0.1.0 │ GHSA-qg5g-gv98-5ffh │ rustls network-reachable │ │ medium │ Default │ │
│ │ │ │ panic in `Acceptor::accep │ │ │ │ │
│ │ │ │ t` │ │ │ │ │
╰─────────────┴─────────┴─────────────────────┴───────────────────────────┴───────┴──────────┴─────────┴─────────────────╯The output contains an ID for the vulnerability, a description, and a CVSS value and/or severity if available. It also contains a TLP Classification derived from that of the affected product, and ideally a CSAF Assessment by the vendor.
The CSAF document is a crucial part, because it tells you, the user of the product, how you should react to this supply chain vulnerability. Read the next section to find out how to access them.