Giter VIP home page Giter VIP logo

cpe-parser's Issues

Convert.wellFormedToFS issue

When a field in a CPE contains a trailing . character, parsing the CPE and converting it back to string generates a result different from the original cpe string.
For example

String cpe = "cpe:2.3:a:bookly_project:bookly:3.4.:*:*:*:*:wordpress:*:*";
Cpe parsedCpe = CpeParser.parse(cpe);
System.out.println(parsedCpe.toCpe23FS());

Outputs

cpe:2.3:a:bookly_project:bookly:3.4\.:*:*:*:*:wordpress:*:*

Probably an edge case but there are still CPEs with this format in NVD (although probably deprecated).

Should `subset` of `ANY` be considered a match

The CPE 2.3 specification does not specify matching in terms of true/false - rather it defines four relations: equal, disjoint, superset, and subset (see table 6-2 in the specification).

The current implementation treats equal and superset as true. However, subsets are considered false (5, 13, 15 - numbers equate to entries in table 6-2):

CPE-Parser/src/main/java/us/springett/parsers/cpe/Cpe.java

Lines 618 to 627 in b90081a

} else if (LogicalValue.NA.getAbbreviation().equals(left)) {
//5 7 8
return false;
} else if (LogicalValue.NA.getAbbreviation().equals(right)) {
//12 16
return false;
} else if (LogicalValue.ANY.getAbbreviation().equals(right)) {
//13 15
return false;
}

This leads to a scenario where we have a source from the NVD for CVE-2019-1003058 of cpe:2.3:a:jenkins:ftp_publisher:*:*:*:*:*:jenkins:*:* that does not match the target CPE identified by dependency-check: cpe:2.3:a:jenkins:ftp_publisher:*:*:*:*:*:*:*. The comparison of the source target software of jenkins is a subset of the target ANY.

Thus, subset should likely be considered true.

2021-04-21 - NIST NVD data not parseable

Hi Steve! I think this is an issue with the NIST NVD feed starting a few hours ago, but wanted to give you a heads up. Feels like an unintended format change at NIST, if you have any contacts.

Seeing Dependency-Check fail to parse this CPE (seems to parse via CPE-Parser):

cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*

Seen in the 2011 data file from NIST:

➜  ~ curl --silent https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2011.json.gz | gunzip | grep -r -F "cpe:2.3:a:cgiirc:cgi:irc:0.5.7"
(standard input):          "cpe23Uri" : "cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*",

Also see jeremylong/DependencyCheck#3307.

org.owasp.dependencycheck.data.nvdcve.DatabaseException: Unable to parse CPE: cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*
org.owasp.dependencycheck.data.update.exception.UpdateException: org.owasp.dependencycheck.data.nvdcve.DatabaseException: Unable to parse CPE: cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.processFiles(ProcessTask.java:156)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.call(ProcessTask.java:113)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.call(ProcessTask.java:40)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:749)
Caused by: org.owasp.dependencycheck.data.nvdcve.DatabaseException: Unable to parse CPE: cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*
    at org.owasp.dependencycheck.data.nvdcve.CveDB.parseCpe(CveDB.java:1341)
    at org.owasp.dependencycheck.data.nvdcve.CveDB.lambda$parseCpes$3(CveDB.java:1298)
    at java.util.ArrayList.forEach(ArrayList.java:1259)
    at org.owasp.dependencycheck.data.nvdcve.CveDB.parseCpes(CveDB.java:1297)
    at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability(CveDB.java:880)
    at org.owasp.dependencycheck.data.update.nvd.NvdCveParser.parse(NvdCveParser.java:99)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.importJSON(ProcessTask.java:139)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.processFiles(ProcessTask.java:152)
    ... 6 more
Caused by: us.springett.parsers.cpe.exceptions.CpeParsingException: Invalid CPE (too many components): cpe:2.3:a:cgiirc:cgi:irc:0.5.7:*:*:*:*:*:*:*
    at us.springett.parsers.cpe.CpeParser.parse23(CpeParser.java:225)
    at us.springett.parsers.cpe.CpeParser.parse(CpeParser.java:77)
    at org.owasp.dependencycheck.data.nvdcve.CveDB.parseCpe(CveDB.java:1331)
    ... 13 more

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.