3

I'm trying to understand the Common Product Enumeration standard published by Mitre. In the Version field, I've found references to "*" or ANY meaning "Any Version."

However, when I search the CPE Dictionary, I find a dash in that field. Does that mean "No Version" or possibly "All Versions?"

| improve this question | | | | |
3

According the the standard (https://cpe.mitre.org/files/cpe-specification_2.2.pdf), it should mean NA:

"It is often necessary to use a CPE Name when identifying a specific release of a given platform.
If attempting to create a CPE Name for this, and a specific co mponent is not applicable to the given platform, then the term '-' should be used. Note that use of the '-' term is different than leaving the component blank, even though in practice both options might identify with the same set of platform types. For example, an application may not have different editions. A CPE Name for such an application may use the '-' term for the edition component."

cpe:/a:acme:product:1.0:update2:-:en-us

From the usage, it certainly appears to mean null, more often than not.

| improve this answer | | | | |
  • Good find. I was exclusively looking at the CPE 2.3 docs, which doesn't have this text in it. It would seem that they eliminated the dash from the specification but are still allowing it in v2.3 CPE's. – Cargo23 Jun 27 '17 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.