stevespringett / cpe-parser Goto Github PK
View Code? Open in Web Editor NEWA utility for validating and parsing Common Platform Enumeration (CPE) v2.2 and v2.3 as originally defined by MITRE and maintained by NIST
License: Apache License 2.0
A utility for validating and parsing Common Platform Enumeration (CPE) v2.2 and v2.3 as originally defined by MITRE and maintained by NIST
License: Apache License 2.0
Hi Steve! I think this is an issue with the NIST NVD feed starting a few hours ago, but wanted to give you a heads up. Feels like an unintended format change at NIST, if you have any contacts.
Seeing Dependency-Check fail to parse this CPE (seems to parse via CPE-Parser):
cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*
Seen in the 2011 data file from NIST:
โ ~ curl --silent https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2011.json.gz | gunzip | grep -r -F "cpe:2.3:a:cgiirc:cgi:irc:0.5.7"
(standard input): "cpe23Uri" : "cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*",
Also see jeremylong/DependencyCheck#3307.
org.owasp.dependencycheck.data.nvdcve.DatabaseException: Unable to parse CPE: cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*
org.owasp.dependencycheck.data.update.exception.UpdateException: org.owasp.dependencycheck.data.nvdcve.DatabaseException: Unable to parse CPE: cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*
at org.owasp.dependencycheck.data.update.nvd.ProcessTask.processFiles(ProcessTask.java:156)
at org.owasp.dependencycheck.data.update.nvd.ProcessTask.call(ProcessTask.java:113)
at org.owasp.dependencycheck.data.update.nvd.ProcessTask.call(ProcessTask.java:40)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:749)
Caused by: org.owasp.dependencycheck.data.nvdcve.DatabaseException: Unable to parse CPE: cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*
at org.owasp.dependencycheck.data.nvdcve.CveDB.parseCpe(CveDB.java:1341)
at org.owasp.dependencycheck.data.nvdcve.CveDB.lambda$parseCpes$3(CveDB.java:1298)
at java.util.ArrayList.forEach(ArrayList.java:1259)
at org.owasp.dependencycheck.data.nvdcve.CveDB.parseCpes(CveDB.java:1297)
at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability(CveDB.java:880)
at org.owasp.dependencycheck.data.update.nvd.NvdCveParser.parse(NvdCveParser.java:99)
at org.owasp.dependencycheck.data.update.nvd.ProcessTask.importJSON(ProcessTask.java:139)
at org.owasp.dependencycheck.data.update.nvd.ProcessTask.processFiles(ProcessTask.java:152)
... 6 more
Caused by: us.springett.parsers.cpe.exceptions.CpeParsingException: Invalid CPE (too many components): cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*
at us.springett.parsers.cpe.CpeParser.parse23(CpeParser.java:225)
at us.springett.parsers.cpe.CpeParser.parse(CpeParser.java:77)
at org.owasp.dependencycheck.data.nvdcve.CveDB.parseCpe(CveDB.java:1331)
... 13 more
The CPE 2.3 specification does not specify matching in terms of true/false - rather it defines four relations: equal
, disjoint
, superset
, and subset
(see table 6-2 in the specification).
The current implementation treats equal
and superset
as true. However, subsets are considered false (5, 13, 15 - numbers equate to entries in table 6-2):
CPE-Parser/src/main/java/us/springett/parsers/cpe/Cpe.java
Lines 618 to 627 in b90081a
This leads to a scenario where we have a source
from the NVD for CVE-2019-1003058 of cpe:2.3:a:jenkins:ftp_publisher:*:*:*:*:*:jenkins:*:*
that does not match the target
CPE identified by dependency-check: cpe:2.3:a:jenkins:ftp_publisher:*:*:*:*:*:*:*
. The comparison of the source
target software of jenkins is a subset of the target
ANY.
Thus, subset should likely be considered true.
When a field in a CPE contains a trailing . character, parsing the CPE and converting it back to string generates a result different from the original cpe string.
For example
String cpe = "cpe:2.3:a:bookly_project:bookly:3.4.:*:*:*:*:wordpress:*:*";
Cpe parsedCpe = CpeParser.parse(cpe);
System.out.println(parsedCpe.toCpe23FS());
Outputs
cpe:2.3:a:bookly_project:bookly:3.4\.:*:*:*:*:wordpress:*:*
Probably an edge case but there are still CPEs with this format in NVD (although probably deprecated).
According to the MITRE CPE 2.2 specification ("[c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\._\-~%]*){0,6}"
), a CPE with a lone /
in its part component cpe:/:
is a valid CPE.
Yet when attempting to parse such a cpe, an exception is thrown:
Could not parse CPE [cpe:/:redhat:enterprise_linux:::hypervisor]: CPE String contains a malformed part: cpe:/:redhat:enterprise_linux:::hypervisor
Now as I understand it, CPE's in such a format are exceedingly rare, yet they do exist. Is there a reason why they are not supported or is this perhaps an oversight?
Maven Central requires all published artifacts to be signed using PGP. If a publisher provides their key ID to PGP keys map then end users can use the Verify PGP signatures plugin to validate that the artifact has not been altered or replaced as part of a supply-chain attack.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.