-
Notifications
You must be signed in to change notification settings - Fork 64
#1775: validate and update CPE vendor and product for all tools #1796
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
0f81059
e4a43e2
980267f
0bb9303
d56266a
6512285
1b3042a
713d9cb
57291fc
81b059b
4de5d54
e89d3c3
5a563ae
6845b88
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -83,6 +83,6 @@ public String getCpeVendor() { | |
|
|
||
| @Override | ||
| public String getCpeProduct() { | ||
| return "docker"; | ||
| return "desktop"; | ||
| } | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -69,6 +69,6 @@ public String getCpeVendor() { | |
|
|
||
| @Override | ||
| public String getCpeProduct() { | ||
| return "dotnet"; | ||
| return ".net"; | ||
| } | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -59,6 +59,6 @@ public String getCpeVendor() { | |
|
|
||
| @Override | ||
| public String getCpeProduct() { | ||
| return "gh"; | ||
| return "cli"; | ||
| } | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -50,7 +50,7 @@ protected void addVersion(UrlVersion urlVersion) { | |
|
|
||
| @Override | ||
| public String getCpeVendor() { | ||
| return "jenkinsci"; | ||
| return "jenkins"; | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Also no CPE in CVEs like https://cveawg.mitre.org/api/cve/CVE-2026-33001
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I found this one. Isn't this the correct one? |
||
| } | ||
|
|
||
| @Override | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Still not convinced about this one. See e.g.
https://cveawg.mitre.org/api/cve/CVE-2025-21587
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So IMHO here we have two products:
jdkandjava_se.Please have a look and see if you can agree with my observation or not.
If we agree, we maybe create a new issue for that (Support multiple values for CPE product), merge this PR and plan a new PR to fix the new issue.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I agree, there is a few cases where two CPEs exist. For now i just chose one of them, but we should definitely consider adding an option to add more than one CPE 0..N for both CPE
vendorandproduct.