Patchlight 0.1.1 — targets that returned no findings at all

Why this release exists

Free-text product names were turned into CPEs by lowercasing them, replacing
spaces with underscores, and always saying part a. Measured against the live
NVD API, that is right for most application packages and returns exactly
zero for the rest — and zero is indistinguishable from "you have no
vulnerabilities".

target	0.1.0 CPE	0.1.0	correct
nginx 1.24.0	a:*:nginx	2	2
OpenSSH 9.6	a:*:openssh	19	19
MySQL 8.0.35	a:*:mysql	87	87
Apache HTTP Server 2.4.57	a:*:apache_http_server	0	53
Linux Kernel 6.8	a:*:linux_kernel	0	6,582
Ubuntu Linux 22.04	a:*:ubuntu_linux	0	59
Windows Server 2019	a:*:windows_server_2019	0	5,255
Debian 12	a:*:debian_linux:12	0	294

Three causes, all fixed:

• The part field. NVD indexes an operating system under o. A query that
  says a cannot see it, so every OS target reported a clean bill of health.
  The Linux kernel alone accounts for 6,582 CVEs that were invisible.
• The product token. "Apache HTTP Server" is indexed as product
  http_server; gluing the vendor word into the product finds nothing.
• The version string. Distribution releases carry an explicit minor.
  debian_linux 12 returns 0 and 12.0 returns 294; enterprise_linux 9
  returns 3 and 9.0 returns 595. A bare major on an operating system now gets
  its .0. Applications are untouched — tomcat 9 and tomcat 9.0 both
  return 14.

Resolution runs from a built-in table plus part inference, so it works with no
network — which is what an air-gapped install has.

What was not the cause, despite being the prime suspect: the wildcard vendor.
a:*:http_server returns 53 CVEs against 51 for a:apache:http_server, and
o:*:linux_kernel matches o:linux:linux_kernel exactly at 6,582. The wildcard
never lost a CVE and twice found more, so it stays: a guessed vendor can only
narrow the search.

Findings no longer carry another product's fix version

A CVE that requires two products present at once lists both in one
configuration — CVE-2019-0190 is the real case, an AND of Apache httpd and
OpenSSL. Version evidence was taken from the first vulnerable cpeMatch, so an
OpenSSL owner was told their fix version was an httpd release number. The CVE
was right; the evidence was another product's, which is worse, because the
evidence is what you act on.

Evidence now comes only from a cpeMatch that names your own product. When a
configuration never names it, no version evidence is reported at all — an empty
field is honest, a borrowed one is not.

Honest limit

A name Patchlight has never seen can still resolve to the wrong CPE, and a token
NVD does not use finds nothing. A target with zero findings is the first one to
check — open it and confirm the CPE is the one NVD uses.

Verify this download

sha256sum -c SHA256SUMS
tar xzf patchlight-free-0.1.1-linux-amd64.tar.gz
./patchlight

Upgrading from 0.1.0: re-add any operating-system target, or delete and re-add
anything that has been reporting zero findings. Existing targets keep the CPE
they were stored with.

This repository is the free edition — Apache-2.0, no time limit. Pro and Team are paid licences on Whop: whop.com/nizar-tuanku/patchlight-cve-prioritizer. Nothing on Whop is free, so try it here first.