search

intel / cve-bin-tool

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 200 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.
https://cve-bin-tool.readthedocs.io/en/latest/
GNU General Public License v3.0
1.15k stars 446 forks source link

fix: NVD cpe parser doesn't escape `\:`'s in product and vendor name #4041

Open fthdrmzzz opened 3 months ago

fthdrmzzz commented 3 months ago

Description

Hello, I think I have noticed a small bug

In nvd_source.py the product data is splitted by :.

 def parse_node(self, node: dict[str, list[dict[str, str]]]) -> list[dict[str, str]]:
        affects_list = []
        if "cpe_match" in node:
            vulnerable_matches = (m for m in node["cpe_match"] if m["vulnerable"])
            for cpe_match in vulnerable_matches:
                cpe_split = cpe_match["cpe23Uri"].split(":") # HERE!!!
                affects = {
                    "vendor": cpe_split[3],
                    "product": cpe_split[4],
                    "version": cpe_split[5],
                }

However, in some cases there is : in the name of the vendor or the product and NVD escapes these :'s by putting a backslash in front. Example here: image

This results in recording the product as \ in the database. To see it, I have made a simple sql query to the mysql database stored in ~/.cache/cve-bin-tool/cve.db to check and see it:

$ select * from cve_range where product like "\" LIMIT 2;
CVE-2007-4829 | archive\ | \ | tar_project|||1.36||NVD

I don't know what are the effects of this bug on tool's behavior. Maybe it might miss some cve's on binaries that it was supposed to hit.

Please assign me for this.

fthdrmzzz commented 3 months ago

assign it to me please

terriko commented 3 months ago

good finding, thanks for working on it!

joydeep049 commented 3 months ago

Hello @fthdrmzzz Since you filed the issue and want to work on it, It will most probably be assigned to you. So dw about that. You can focus on solving the issue Thanx