scanoss/purl2cpe

PURL to CPE Relationship mapping project.

Introduction

The purl2cpe project is a dataset that contains relations between CPEs (Common Product Enumerator) and PURLs (Package URL).

Mitre Corporation’s CVE Program Mission is to Identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. This program issues CVE IDs to identify new vulnerabilities.

The NIST’s National Vulnerability Database analyzes each CVE and, among other things, issues CPE (Common Product Enumerator) IDs to identify specific component versions, and publishes the list of CPE to CVE relationship.

PURL (Package URL) is an open specification that standardizes identification and location of software packages/versions in their respective repositories.

While CPEs provide a precise identification for components and versions, they do not provide an easy way to connect these vulnerable component versions with their respective Open Source repositories. These connections must be made available by human curation.

SCANOSS specializes in Software Composition Analysis and Open Source Intelligence and maintains a dataset that connects PURLs to CPEs. This dataset has now been released as Open Source.

With purl2cpe, it is now easy for anyone to monitor the Open Source packages they use for known vulnerabilities.

Folder Structure

There are two main folders in this repo:

• data
• utilities

Relationship Data

All purl2cpe relationship information is stored in the data folder. The information inside this is structured based on the CPE vendor and product fields. Inside the data folder there is one sub-folder for each vendor, and subsequently one sub-folder for each product of that vendor.

Inside the product folder there are two files:

• cpes.yml stores all CPEs of that product
• purls.yml stores all related purls for that product.

For example, the path for the aerospike_server product from aerospike vendor would be:

data/
    aerospike/
        aerospike_server/
            cpes.yml
            purls.yml

cpes.yml:

cpes:
  - cpe:2.3:a:aerospike:aerospike_server:4.0.0.1:*:*:*:community:*:*:*
  - cpe:2.3:a:aerospike:aerospike_server:4.0.0.6:*:*:*:community:*:*:*
  - cpe:2.3:a:aerospike:aerospike_server:4.1.0.1:*:*:*:community:*:*:*
...

---

purls.yml:

purls:
  - pkg:docker/aerospike/aerospike-server
  - pkg:github/aerospike/aerospike-server

Contributing New Relationship Data

Our automation loads the latest cpes.yml files daily (directly from the NVD). That leaves the purls.yml relationship data.

If you find a missing/invalid relationship, please do the following:

• Fork the repo
• Update the affected purls.yml files
• Create a Pull Request with the details of the update

The PURL2CPE team will review these requests and accept them into list for everyone to benefit from.

Utilities

Utilities to help consume this data are located in the utilities folder. More details can be found here.

purl2cpe's Issues

clone on windows fails because of folder names ending with period

The project cannot be cloned on a windows system.
Here is the log:

Receiving objects: 100% (74000/74000), 579.43 MiB | 6.40 MiB/s, done.
Resolving deltas: 100% (6009/6009), done.
error: invalid path 'data/arj_software_inc./unarj/cpes.yml'
fatal: unable to checkout working tree
warning: Clone succeeded, but checkout failed.
You can inspect what was checked out with 'git status'
and retry with 'git restore --source=HEAD :/'

git did not exit cleanly (exit code 128) (117781 ms @ 06/10/2023 14:04:40)

My work is not dependent on this but we found this in a related project.

spring CVE for working with cve-bin-tool

Hi,

Could you explain me how to add CVE JAVA SPRING Detection with your tool to cve-bin-tool ?
intel/cve-bin-tool#4101

Regards
Philippe

purls do not appear to be validated before being added

For example, look at purl2cpe/data/libav/libav/purls.yml

pkggithub/libav/libav is not correct. That shouldn't pass the most basic check.

I've processed the entire repo and there are thousands of invalid purls. Not sure how they are derived but some simple quality check using https://github.com/package-url/purl-spec would be very helpful.

Do you mind avoiding reusing our project name to avoid confusion?

https://github.com/nexB/purl2cpe and https://github.com/sbs2001/purl2cpe have long been using this name. Please try to find another name for your project to avoid confusion, even if the purpose are similar!

Include version in purl (database)

Hi,

Today, the database only have one purl matching one cpe with all its different versions. So for exemple pkg:github/wp-plugins/simple-banner will have the following cpe:

• cpe:2.3:a:simple_banner_project:simple_banner:1.0.1:*:*:*:*:wordpress:*:*
• cpe:2.3:a:simple_banner_project:simple_banner:1.0.2:*:*:*:*:wordpress:*:*
• cpe:2.3:a:simple_banner_project:simple_banner:1.0.3:*:*:*:*:wordpress:*:*
• [...]
• cpe:2.3:a:simple_banner_project:simple_banner:2.9.4:*:*:*:*:wordpress:*:*
• cpe:2.3:a:simple_banner_project:simple_banner:-:*:*:*:*:wordpress:*:*

Don't you think it would make sense to add the version in the purl field ?

For with my previous example purl field would becomes:

• pkg:github/wp-plugins/[email protected]
• pkg:github/wp-plugins/[email protected]
• pkg:github/wp-plugins/[email protected]
• [...]
• pkg:github/wp-plugins/[email protected]
• pkg:github/wp-plugins/simple-banner

Is it something that would make sense for you ?

Thank you

purl spells wrong

Does the value of purl spell wrong? pkg:gituhb/eldy/awstats

maybe 'pkg:github/eldy/awstats' is correct

Official purl2cpe release on pypi?

Hello,

I find out your project by googling and it seems great. I would like to use it in other open sources such as cve-bin-tool. However, it seems that there is no official release of your project on pypi. So I'm wondering if you plan to make one some day? If not, what is the best way to integrate your project? Should I make a github submodule or perhaps just build and update purl2cpe.db regularly?

Best Regards and thanks for your work

Some CPEs ending with `:*:*:*:*:*:*:*:*` are missing

Firstly, thank you for your great job!

Recently, I find that some CPEs ending with :*:*:*:*:*:*:*:* are missing, for example, cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:* is not listed in this yaml. And it's not an isolated case.

No version information in PURL

Any reason why the PURL references don't contain the version information which is contained within the cpe entry?

CVE-2023-38894 in Tree-kit

Hi there,
Just a heads up there's a new prototype pollution CVE for cronvel/tree-kit that is listed in this file.
More info about the CVE: https://www.code-intelligence.com/blog/treekit-prototype-pollution-cve-2023-38894
Make sure whatever's pulling this repo is updating to the latest version of tree-kit.
Cheers

Typescript cpe is missing

I can't the cpe for typescript in the files.

Typescript cpe is define as show here .

there may be a mistake in the name

the name currently used is node-ipic_project, but it seems to me that the correct name is node-ipc_project.

extra letter

We probably need to change this from - pkg:github/wordpress/wordpress-developt to - pkg:github/wordpress/wordpress-develop. in file data/wordpress/wordpress/purls.yml

Cannot find data for protobuf-java

PURL: pkg:maven/com.google.protobuf/protobuf-java

Query Command:
select cpe from purl2cpe where purl = 'pkg:maven/com.google.protobuf/protobuf-java';