3

So my naive approach was to query NVD for CPE URIs of software products I use.

Unfortunately I notice a lot of entries don't have CPE entries. (e.g. for 2016 there are currently 1332 without CPE URI).

So this means I have to grep through these for keywords, which is quite error prone.

Are there any other ways to get all CVEs for software X?

4
  • What is your goal here?
    – Tom K.
    Commented Jul 3, 2018 at 14:33
  • As I wrote: get all CVEs for software X. Ideally programmatically without manual greping through lots of false positives
    – arved
    Commented Jul 3, 2018 at 21:20
  • Why are you trying to do this?
    – Tom K.
    Commented Jul 4, 2018 at 11:17
  • assess if my system is vulnerable or not.
    – arved
    Commented Jul 5, 2018 at 6:10

1 Answer 1

3

Since you did not delivered some examples, such as: where did you get information that a CVE does not deliver CPE - either by the basis of some platform or files provided by some specific vendor. I assume you are using the National Vulnerability Database (NVD) Data Feeds, either in XML 2.0 or JSON format provided by NIST at https://nvd.nist.gov/vuln/data-feeds, because the information collected from NIST's (NVDCVE) files is the same in CVEDetails.com.

You claim that there are over a thousand entries without CPE:

$ ls -lh
total 96136
-rw-r--r--  1 test  test    44M Aug 18 03:25 nvdcve-2.0-2016.xml
-rw-r--r--  1 test  test   2.6M Aug 20 06:57 nvdcve-2.0-2016.xml.zip
$ grep -c "\*\* REJECT \*\*" nvdcve-2.0-2016.xml
1106

If you are wondering, why did I used the keyword "REJECT": This is the only way that there is a CVE and cannot find a CPE. For example:

$ grep -A5 "<entry id=\"CVE-2016-0001\">" nvdcve-2.0-2016.xml
  <entry id="CVE-2016-0001">
    <vuln:cve-id>CVE-2016-0001</vuln:cve-id>
    <vuln:published-datetime>2017-05-11T10:29:55.767-04:00</vuln:published-datetime>
    <vuln:last-modified-datetime>2017-05-11T10:29:55.767-04:00</vuln:last-modified-datetime>
    <vuln:summary>** REJECT **  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.</vuln:summary>
  </entry>

The reason why this happens, I have explained in this question: Categorizing CVE product name

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .