I usually stick to finding the right CPE candidate for product-version I am interested in by using the Search Vulnerability Database with Search Type selected as Advanced and then narrowing down from Vendor to Product to specific Version. Lets call it MyMethod.

Recently I was interested to finding CVEs that applies to HP-UX B.11.31. I applied the above mentioned process and ended up with 33 matching records.

Although a simple Google query gave me CVEs that were not listed in above 33 results. In order to understand what was happening I researched more and found CPE Search utility within NVD. Querying this with just B.11.31 gave me two candidates. The second CPE cpe:2.3:o:hp:hp-ux:b.11.31:*:*:*:*:*:*:* seemed right one for me which gave 80 matching records.

Comparing the CVEs from both the searches, I found that all 33 listed in MyMethod are present in these 80 results. Comparing the CPEs, they are almost similar cpe:/:hp:hp-ux:b.11.31 cpe:2.3:o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*

Going through the CPE specification documents, it appears that the o in second CPE represents operating system which makes sense. Although it is still confusing as far as my understanding goes. Given that the MyMethod builds a more generic CPE and should have more inclusive results from values such as a/o/h and but its the other way around.

I failed to find detailed guides on use of CPEs. I am doubting that MyMethod is erroneous. In my method I manually selected the right products and yet it is still missing out on valid results that applies to the product I am searching for. I am not sure what is happening in the two cases.


You must log in to answer this question.

Browse other questions tagged .