4

I'm trying to understand the Common Product Enumeration standard published by Mitre. In the Version field, I've found references to "*" or ANY meaning "Any Version."

However, when I search the CPE Dictionary, I find a dash in that field. Does that mean "No Version" or possibly "All Versions?"

Improve this question

1 Answer 1

Reset to default
8

According the the standard (https://cpe.mitre.org/files/cpe-specification_2.2.pdf), it should mean NA:

"It is often necessary to use a CPE Name when identifying a specific release of a given platform.
If attempting to create a CPE Name for this, and a specific co mponent is not applicable to the given platform, then the term '-' should be used. Note that use of the '-' term is different than leaving the component blank, even though in practice both options might identify with the same set of platform types. For example, an application may not have different editions. A CPE Name for such an application may use the '-' term for the edition component."

cpe:/a:acme:product:1.0:update2:-:en-us

From the usage, it certainly appears to mean null, more often than not.

Improve this answer
2
  • Good find. I was exclusively looking at the CPE 2.3 docs, which doesn't have this text in it. It would seem that they eliminated the dash from the specification but are still allowing it in v2.3 CPE's.
    – Cargo23
    Commented Jun 27, 2017 at 13:26
  • 1
    Version 2.3 doesn't give that kind of detail on what NA is supposed to mean in context.
    – OrangeDog
    Commented Mar 1 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .