[WRN] [CVE-2019-6799] Malformed version: [6.20.35 188 17]

[xgt6op]

I ran nuclei on subdomains list and the command was
nuclei -l live_subdomains -es info -t /home/xgt6op/nuclei-templates/http/cves/2019/CVE-2019-6799.yaml -o output2.txt

And got this error

                    __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.9

		projectdiscovery.io

[INF] Supplied input was automatically deduplicated (181 removed).
[INF] Current nuclei version: v2.9.9 (latest)
[INF] Current nuclei-templates version: v9.5.8 (latest)
[INF] New templates added in latest release: 113
[INF] Templates loaded for current scan: 1
[INF] Targets loaded for current scan: 439
[INF] Using Interactsh Server: oast.site
[WRN] [CVE-2019-6799] Malformed version: [6.20.35 188 17]
[WRN] [CVE-2019-6799] Malformed version: [6.20.35 188 17]
[WRN] [CVE-2019-6799] Malformed version: [6.20.35 188 17]
[WRN] [CVE-2019-6799] Malformed version: [17 6.20.35 188]
[WRN] [CVE-2019-6799] Malformed version: [6.20.35 188 17]
[WRN] [CVE-2019-6799] Malformed version: [6.20.35 188 17]
[WRN] [CVE-2019-6799] Malformed version: [488 2960455 710 2 73823375]
[WRN] [CVE-2019-6799] Malformed version: [488 2960455 710 2 73823375]
[WRN] [CVE-2019-6799] Malformed version: [710 2 73823375 488 2960455]
[WRN] [CVE-2019-6799] Malformed version: [2 73823375 488 2960455 710]
[WRN] [CVE-2019-6799] Malformed version: [2 73823375 488 2960455 710]

So is there any problem with my nuclei or my templates

see #3949 for more information.

[MetzinAround]

I noticed you had an issue and a discussion. I'll go ahead and close this issue and keep the discussion for now. Thanks!

#3949

[Mzack9999]

Note: most likely, it's the dsl helper compare_versions receiving invalid values due to faulty regexes extracting invalid versions. While the warning can be ignored, the regexes extracting versions from various templates should be improved:

CVE-2019-12616
CVE-2019-6799
...

[tarunKoyalwar]

as you mentioned @Mzack9999 this is because of parsing error in compare_versions . i tried to create new regex for extracting semver version . which doesnot seem possible without false positives if we want to allow versions like (v1 , v1.8)

since these is not actual deciding factor for template . we can supress/hide parsing errors in compare_version dsl function what do you think @ehsandeep @Mzack9999

[ehsandeep]

@xgt6op This is now fixed with the latest release - https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.10