logic for generating valid and existing cpes

[mrl5]

1. use cpe match feed (see json schema) or NVD API for CPE Retrieval
2. some requirements:

• cpe_product - strip -bin from package name
• cpe_version exclude 9999
• cpe_update should be _p2 part
• strip -r1 parts

see also:
Official CPE Dictionary
cpe python lib
nvdtools

[mrl5]

PoC for checking if in cpe registry:

dummy_cpe='microsoft:internet_explorer:11'

wget https://nvd.nist.gov/feeds/json/cpematch/1.0/nvdcpematch-1.0.json.gz &&
    zcat nvdcpematch-1.0.json | jq -c --stream | grep $dummy_cpe

[mrl5]

PoC generating valid cpe:

package=busybox

versions=`ego query versions $package |
    grep -E [0-9] |
    cut -d '|' -f1 |
    grep -v 9999 |
    sed -E 's/ +//g' |
    sed 's/*//g'`

searchterms=`for v in $versions; do
    echo "$package:$v" | tr A-Z a-z
done`

for st in $searchterms; do
    zcat nvdcpematch-1.0.json | grep $st | sort -u | sed -E 's/ +//g' | cut -d':' -f2- | sed 's/"//g'
done