CVE Data Attribution and Notices
================================

BomLens images (ghcr.io/sktelecom/bomlens and the images built from it, such
as ghcr.io/sktelecom/bomlens-firmware) bundle a CPE-to-CVE applicability index
(cpe_match.sqlite) distilled from the U.S. National Vulnerability Database
(NVD). The CPEs of components that carry no package purl are matched against
this index. In the firmware image, binaries are first identified by
cve-bin-tool (Intel, GPL-3.0).
The bundled data is provided "as is", without any warranty of accuracy or
completeness.

NVD — National Vulnerability Database (NIST)
  This product uses NVD data but is not endorsed or certified by the NVD.
  NVD data is a work of the U.S. Government and is in the public domain.
  https://nvd.nist.gov/developers/terms-of-use

NVD data source (bulk mirror)
  The NVD 2.0 JSON records are obtained in bulk, at image-build time, from the
  fkie-cad/nvd-json-data-feeds mirror (Fraunhofer FKIE), which reconstructs the
  NVD feeds from the NVD API. Only application-part CPE applicability rows are
  kept in the distilled index. Not endorsed by NVD or FKIE.
  https://github.com/fkie-cad/nvd-json-data-feeds

cve-bin-tool (Intel)
  Firmware image only. Used for binary component identification only (its
  signature checkers). GPL-3.0.
  https://github.com/intel/cve-bin-tool
