jayjacobs
commented
2 weeks ago Is this the same type of data quality problem where we have 143,219 CVEs that have "n/a" and the 34,142 CVEs that have "unspecified" in the version field?
Open ElectricNroff opened 5 months ago
jayjacobs
commented
2 weeks ago Is this the same type of data quality problem where we have 143,219 CVEs that have "n/a" and the 34,142 CVEs that have "unspecified" in the version field?
There are more than 1700 CVE Records that have
even though this is undefined: https://github.com/CVEProject/cve-schema/blob/30f59c7de92fbc77bddade302601cb500c66f718/schema/docs/versions.md?plain=1#L253-L259 (There are no wildcards, and "0" - rather than "*" - is used to mean no lower bound.)
Most of these are apparently a syntax error by the Wordfence CNA, e.g.,
which should have been written as
Occasionally other CNAs have done this:
where apparently the intention was:
Other CNAs apparently use * to try to imply wildcarding, e.g.,
which should have been written as
Similarly:
The above is only for CNA containers. About 1500 other CVE Records are affected because of
"version":"*"in the CISA-ADP ADP container, but that ADP has reported that a fix is in progress.To create a schema that doesn't allow
"version":"*"one approach is to have a new definition such asversionButNotAsteriskthat is similar to: https://github.com/CVEProject/cve-schema/blob/30f59c7de92fbc77bddade302601cb500c66f718/schema/CVE_Record_Format.json#L81-L85 but with a negative lookahead:and use this for: https://github.com/CVEProject/cve-schema/blob/30f59c7de92fbc77bddade302601cb500c66f718/schema/CVE_Record_Format.json#L298-L300 (but not for lessThan or lessThanOrEqual, where
*is meaningful)