search

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
6.13k stars 1.23k forks source link

Handling of - (NA) in CPE #6499

Open OrangeDog opened 4 months ago

OrangeDog commented 4 months ago

Describe the bug The value of - for a CPE field is supposed to mean "NA" but it is not apparent how that should be handled differently to "ANY".

I have noticed it being used for the version in CVE-2024-1459, as cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*, causing that to not be detected at all.

Version of dependency-check used Maven plugin 9.0.9

To Reproduce

<dependency>
  <groupId>io.undertow</groupId>
  <artifactId>undertow-core</artifactId>
  <version>2.3.12.Final</version>
</dependency>

Expected behavior I guess this should be a match, as the CVE description seems to indicate it applies to all versions (currently).

jeremylong commented 2 months ago

I wonder if this bug is now located in https://github.com/stevespringett/CPE-Parser

I'll have to do some testing.

OrangeDog commented 2 months ago

Just to note that example CVE is actually fixed in 2.3.12.Final, but I don't think any data sources have been updated to reflect that (they hadn't when I filed this). Testing with 2.3.11 may be a more reliable reproduction.