[RFC] cpesearch: Use NIST api to filter out deprecated CPEs #2511
+12
−6
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Thomas Staudinger <[email protected]>
ermo
added
Type: Feature
silkeh
reviewed
Oct 20, 2024
Comment on lines
11
to
20
| if test "$argv[1]" = "--help"; or test "$argv[1]" = "-h"; or test (count $argv) -ne 1 | ||
| echo "usage: cpesearch <package-name>" | ||
| else | ||
| curl -s -X POST https://cpe-guesser.cve-search.org/search -d "{\"query\": [\"$argv[1]\"]}" | jq . | ||
| curl -s "https://services.nvd.nist.gov/rest/json/cpes/2.0?cpeMatchString=cpe:2.3:*:*:$argv[1]*" |\ | ||
| jq 'del(.products.[] | select(.cpe.deprecated == true))' | jq -r '.products.[].cpe.cpeName' |\ | ||
| cut -d":" -f1-5 | sort -u | ||
|
|
||
| echo "Verify successful hits by visiting https://cve.circl.lu/search/\$VENDOR/\$PRODUCT" | ||
| echo -e "\nVerify successful hits by visiting https://cve.circl.lu/search/\$VENDOR/\$PRODUCT" | ||
| echo "- CPE entries for software applications have the form 'cpe:2.3:a:\$VENDOR:\$PRODUCT" | ||
| end |
There was a problem hiding this comment.
I feel like at this point it might be a good idea to consolidate this by moving it to a bash script in common/Scripts and calling that here instead.
There was a problem hiding this comment.
Yeah, it's more of a proof of concept (also it grew a bit more unwieldy than I initially expected ^^)
|
For the sake of argument, could we, say, allow allow searches w/prefixes and then filter on And, building on Silke's comment above, if this were a python script, would that give us more options re. using it from different shells? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This makes the
cpesearchhelper function use the NIST website API instead of cve-search.org to enable the filtering out of deprecated CPEs.Example output:
Old output:
Note that
cpe:2.3:a:valvesoftware:steamandcpe:2.3:a:valve:steamare deprecatedConsiderations:
Hardcode ":a:" in
cpeMatchStringto only match applications?I'm not sure if we need e.g. ":h:" in some cases (for drivers?)
Also search vendor part of the CPEs?
This would require a second request as far as I can see
Allow matches with a prefix?
With the current version only suffixes to the searched string are allowed (to catch things like
_clientand so on). This could be an issue with libraries that may or may not start withlibat times. On the other hand extending the wildcarding so prefixes are allowed produces A LOT of matches at times. I don't think the API itself allows finer-grained controls but additional filtering could be done injqwhich has regex supportExample of searching for
steamwith prefixes allowed: