CPE, PURL, versioning discussions for vulnerability-lookup

[adulau]

Following some discussions, notes about versioning in vulnerability-lookup:

• Improve the UI output with the version is available next to the product name.
• Improve the CPE api to search for product/vendor to be originally compatible with the original cve-search API.
• Add cpe-guesser directly in vulnerability-lookup.
• Add ability to extend or alias CPE name such as new vendor names or product names.
• Review the additional CPE from other users (like JPN).
• Support of purl export if a package name is known.

Ref: package-url/purl-spec#331

[adulau]

Example cpe.json which is the format cpe announce used by software author or vendor to be fetch automatically.

{
  "vendor_name": "misp",
  "vendor_synonyms": [
    "misp-project"
  ],
  "url": [
    "https://www.misp-project.org"
  ],
  "products": [
    {
      "name": "misp",
      "url": [
        "https://www.misp-project.org"
      ],
      "git_reference": [
        "https://github.com/misp/misp"
      ],
      "type": "a"
    },
    {
      "name": "misp-maltego",
      "git_reference": [
        "https://github.com/MISP/MISP-maltego"
      ],
      "type": "a"
    }
  ]
}

[cedricbonhomme]

41f8471 - search for vulnerabilities by CPE string