Building a CVE Intelligence Platform

Create a comprehensive platform for CVE intelligence and management:

# cve-intelligence-platform.py

from flask import Flask, jsonify, request
from flask_sqlalchemy import SQLAlchemy
from datetime import datetime
import asyncio
from typing import List, Dict, Any

app = Flask(__name__)
app.config['SQLALCHEMY_DATABASE_URI'] = 'postgresql://user:pass@localhost/cve_intel'
db = SQLAlchemy(app)

class CVEIntelligence(db.Model):
    __tablename__ = 'cve_intelligence'
    
    id = db.Column(db.String(20), primary_key=True)  # CVE ID
    description = db.Column(db.Text)
    cvss_score = db.Column(db.Float)
    exploit_available = db.Column(db.Boolean)
    patch_available = db.Column(db.Boolean)
    affected_products = db.Column(db.JSON)
    intelligence_data = db.Column(db.JSON)
    last_updated = db.Column(db.DateTime, default=datetime.utcnow)
    
class ImageVulnerability(db.Model):
    __tablename__ = 'image_vulnerabilities'
    
    id = db.Column(db.Integer, primary_key=True)
    image_name = db.Column(db.String(500))
    image_digest = db.Column(db.String(100))
    cve_id = db.Column(db.String(20), db.ForeignKey('cve_intelligence.id'))
    detected_date = db.Column(db.DateTime, default=datetime.utcnow)
    remediation_status = db.Column(db.String(50))
    
@app.route('/api/cve/<cve_id>')
def get_cve_intelligence(cve_id):
    """Get comprehensive intelligence for a specific CVE"""
    cve = CVEIntelligence.query.get(cve_id)
    
    if not cve:
        return jsonify({'error': 'CVE not found'}), 404
        
    # Get affected images
    affected_images = ImageVulnerability.query.filter_by(cve_id=cve_id).all()
    
    return jsonify({
        'cve_id': cve.id,
        'description': cve.description,
        'cvss_score': cve.cvss_score,
        'exploit_available': cve.exploit_available,
        'patch_available': cve.patch_available,
        'affected_products': cve.affected_products,
        'intelligence': cve.intelligence_data,
        'affected_images': [
            {
                'image': img.image_name,
                'detected': img.detected_date.isoformat(),
                'status': img.remediation_status
            }
            for img in affected_images
        ],
        'recommendations': generate_recommendations(cve, affected_images)
    })

@app.route('/api/image/<path:image_name>/cves')
def get_image_cves(image_name):
    """Get all CVEs affecting a specific image"""
    vulns = ImageVulnerability.query.filter_by(image_name=image_name).all()
    
    results = []
    for vuln in vulns:
        cve = CVEIntelligence.query.get(vuln.cve_id)
        results.append({
            'cve_id': cve.id,
            'cvss_score': cve.cvss_score,
            'exploit_available': cve.exploit_available,
            'remediation_status': vuln.remediation_status,
            'risk_score': calculate_contextual_risk(cve, image_name)
        })
    
    # Sort by risk score
    results.sort(key=lambda x: x['risk_score'], reverse=True)
    
    return jsonify({
        'image': image_name,
        'total_cves': len(results),
        'critical': len([r for r in results if r['cvss_score'] >= 9.0]),
        'exploitable': len([r for r in results if r['exploit_available']]),
        'cves': results
    })

def generate_recommendations(cve, affected_images):
    """Generate actionable recommendations based on CVE intelligence"""
    recommendations = []
    
    if cve.exploit_available and not cve.patch_available:
        recommendations.append({
            'priority': 'CRITICAL',
            'action': 'MITIGATE',
            'description': 'Apply compensating controls immediately - exploit available with no patch'
        })
    
    if cve.patch_available:
        recommendations.append({
            'priority': 'HIGH',
            'action': 'PATCH',
            'description': f'Update affected packages to patched versions'
        })
    
    if len(affected_images) > 10:
        recommendations.append({
            'priority': 'HIGH',
            'action': 'STANDARDIZE',
            'description': 'Standardize base images to reduce CVE spread'
        })
    
    return recommendations

if __name__ == '__main__':
    db.create_all()
    app.run(debug=True)

CVE detection in container images requires sophisticated tools and processes to manage the continuous stream of vulnerability disclosures. By implementing comprehensive detection, analysis, and response workflows using both Trivy and Snyk, organizations can stay ahead of security threats. The next chapter compares these tools in detail to help you make informed decisions for your container security program.## Comparing Trivy vs Snyk for Containers

Choosing the right container vulnerability scanner significantly impacts your security program's effectiveness and developer adoption. While both Trivy and Snyk excel at detecting vulnerabilities in container images, they take fundamentally different approaches that result in distinct strengths and trade-offs. This chapter provides an in-depth comparison of these tools across multiple dimensions, helping you make an informed decision based on your organization's specific needs, constraints, and security objectives.