5.1.0 accepts version "*" (usually where "0" was intended) #323
Comments
|
Is this the same type of data quality problem where we have 143,219 CVEs that have "n/a" and the 34,142 CVEs that have "unspecified" in the version field? |
jayjacobs
added
the
section:affected_product
|
The cve-schema repository is not used to discuss data quality problems. The reported issue is an inconsistency between the definition of "version" in the CVE Record Format schema, and the documentation about the meaning of "0" and "*" in the schema/docs/versions.md file. Because (in the example above) the Wordfence CNA is clearly trying to indicate that all versions through 4.0.1 are affected, but chose to use the * special character instead of the 0 special character, the documentation isn't working well enough, and it may be useful to change the schema so that a valid document cannot use one of these two specific special characters in the wrong place. |
|
Let's discuss validating this in the schema. Maybe changing current records form '*' to '0' in each case? |
ccoffin
added
the
Needs Discussion
There are more than 1700 CVE Records that have
even though this is undefined:
cve-schema/schema/docs/versions.md
Lines 253 to 259 in 30f59c7
(There are no wildcards, and "0" - rather than "*" - is used to mean no lower bound.)
Most of these are apparently a syntax error by the Wordfence CNA, e.g.,
which should have been written as
Occasionally other CNAs have done this:
where apparently the intention was:
Other CNAs apparently use * to try to imply wildcarding, e.g.,
which should have been written as
Similarly:
The above is only for CNA containers. About 1500 other CVE Records are affected because of
"version":"*"in the CISA-ADP ADP container, but that ADP has reported that a fix is in progress.To create a schema that doesn't allow
"version":"*"one approach is to have a new definition such asversionButNotAsteriskthat is similar to:cve-schema/schema/CVE_Record_Format.json
Lines 81 to 85 in 30f59c7
but with a negative lookahead:
and use this for:
cve-schema/schema/CVE_Record_Format.json
Lines 298 to 300 in 30f59c7
(but not for lessThan or lessThanOrEqual, where
*is meaningful)The text was updated successfully, but these errors were encountered: