-
Notifications
You must be signed in to change notification settings - Fork 137
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support PURL as identifier #173
Comments
Seconded. Had I known that Purl would take off I would have added it to the original CVE JSON specification I wrote. |
Thirded. Thanks, Steve, for your excellent writeup at OWASP New Recommendations to Improve The NVD. |
As the original purl author I support this of course! and I am available to help as needed. |
The schema currently does indeed support PURLs. The work pending in 5.1 is to allow versionType field for non-range versions (so one can say versionType="PURL" What may be useful:
You can currently (CVE JSON v5.0) supply them in the list of versions eg.,
|
For the record, we have just released our entire CPE <-> PURL dataset here: |
@chandanbn It sounds like your suggestion to address purls is simply to add an extra version to the "affected" list pending the release of the CVE JSON 5.1. Is there any work in process on your other ideas of
Also, any idea when CVE JSON 5.1 will be released? |
impatiently awaiting CVE 5.1 for this. This will go a long way to solve the industry package Naming Problem. |
will be addressed via #201 |
Hello, is there a way to track the progress of NVD adopting CVE JSON 5.1 and supporting queries with pURL ? |
Any update on this? |
Please add PURL as a unique identifier to the schema as there is currently no way to identify software component vulnerabilities without a PURL lookup. https://github.com/package-url/purl-spec
The text was updated successfully, but these errors were encountered: