2

I am working in the development of an application that have to download and parse this CPE file definition: http://static.nvd.nist.gov/feeds/xml/cpe/dictionary/official-cpe-dictionary_v2.3.xml

My problem is the following one.

Into some entry (of the XML file) I found something like this:

<vuln:vulnerable-configuration id="http://nvd.nist.gov/">
  <cpe-lang:logical-test negate="false" operator="OR">
    <cpe-lang:fact-ref name="cpe:/a:apache:tomcat:4.1.10"/>
    <cpe-lang:fact-ref name="cpe:/a:apache:tomcat:4.1.12"/>
    <cpe-lang:fact-ref name="cpe:/a:apache:tomcat:4.1.24"/>
    <cpe-lang:fact-ref name="cpe:/a:apache:tomcat:4.1.3:beta"/>
    ..........................................
    ..........................................  
    .......................................... 
    <cpe-lang:fact-ref name="cpe:/a:apache_software_foundation:tomcat:5.3"/>
    <cpe-lang:fact-ref name="cpe:/a:apache_software_foundation:tomcat:5.4"/>
    <cpe-lang:fact-ref name="cpe:/a:apache_software_foundation:tomcat:5.5"/>
  </cpe-lang:logical-test>
</vuln:vulnerable-configuration>

<vuln:vulnerable-software-list>
  <vuln:product>cpe:/a:apache_software_foundation:tomcat:4.1.34</vuln:product>
  <vuln:product>cpe:/a:apache:tomcat:5.5.21</vuln:product>
  <vuln:product>cpe:/a:apache_software_foundation:tomcat:4.1.37</vuln:product>
  <vuln:product>cpe:/a:apache_software_foundation:tomcat:4.1.32</vuln:product>
  .....................................
  .....................................
  .....................................
  <vuln:product>cpe:/a:apache:tomcat:5.5.22</vuln:product>
  <vuln:product>cpe:/a:apache:tomcat:4.1.36</vuln:product>
  <vuln:product>cpe:/a:apache:tomcat:5.5.25</vuln:product>
  <vuln:product>cpe:/a:apache:tomcat:5.5.1</vuln:product>
</vuln:vulnerable-software-list>

As you can see I have 2 differents collection: the first one is represented by the content of tag and the second one is represented by the content of the

What these collection exactly represents and what is the difference between them?

Tnx

2

cpe-lang shows if are other dependencies for the vulnerable product. If you look over the NVD CVE's you will see some products are vulnerable only on some specific platforms. For example

<cpe-lang:logical-test negate="false" operator="AND">
<cpe-lang:logical-test negate="false" operator="OR">
<cpe-lang:fact-ref name="cpe:/o:redhat:enterprise_linux:5.0::desktop"/>
<cpe-lang:fact-ref name="cpe:/o:redhat:enterprise_linux:5.0::desktop_multiple_os"/>
<cpe-lang:fact-ref name="cpe:/o:redhat:enterprise_linux:5.0::server"/>
<cpe-lang:fact-ref name="cpe:/o:redhat:enterprise_linux:5.0::virtualization"/>
<cpe-lang:fact-ref name="cpe:/o:redhat:fedora_core:core_5.0"/>
<cpe-lang:fact-ref name="cpe:/o:redhat:fedora_core:core6"/>
</cpe-lang:logical-test>
<cpe-lang:logical-test negate="false" operator="OR">
<cpe-lang:fact-ref name="cpe:/a:xen:qemu"/>
</cpe-lang:logical-test>
</cpe-lang:logical-test>

<vuln:vulnerable-software-list>
<vuln:product>cpe:/a:xen:qemu</vuln:product>
</vuln:vulnerable-software-list>

What all that means? xen:qemu is vulnerable only on redhat:enterprise_linux::* and Fedora core* . So if you parse this xml and get only the vuln:product, for some products, you are inaccurate.

cpelan stands for - CPE language matching algorithm and was created by NIST. Here you will find more informations: https://cpe.mitre.org/specification/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.