search

anthonyharrison / lib4sbom

Library to ingest and generate SBOMs
Apache License 2.0
14 stars 10 forks source link

CPE version (specification) is not taken into account when parsing CycloneDX #28

Closed tgagneret-embedded closed 5 months ago

tgagneret-embedded commented 5 months ago

CycloneDX parser extracts CPE field as cpe23Type by default, but if CPE follows version 2.2 specification, it should be set to cpe22Type.

https://github.com/anthonyharrison/lib4sbom/blob/5a8866db90ab2c8654061ce957f05ddfa69fbb07/lib4sbom/cyclonedx/cyclonedx_parser.py#L263-L266

I your implementation is based on SPDX specification, so you can find the cpe22Type definition here