Should subset of ANY be considered a match

[jeremylong]

The CPE 2.3 specification does not specify matching in terms of true/false - rather it defines four relations: equal, disjoint, superset, and subset (see table 6-2 in the specification).

The current implementation treats equal and superset as true. However, subsets are considered false (5, 13, 15 - numbers equate to entries in table 6-2):

CPE-Parser/src/main/java/us/springett/parsers/cpe/Cpe.java

Lines 618 to 627 in b90081a

	} else if (LogicalValue.NA.getAbbreviation().equals(left)) {
	//5 7 8
	return false;
	} else if (LogicalValue.NA.getAbbreviation().equals(right)) {
	//12 16
	return false;
	} else if (LogicalValue.ANY.getAbbreviation().equals(right)) {
	//13 15
	return false;
	}

This leads to a scenario where we have a source from the NVD for CVE-2019-1003058 of cpe:2.3:a:jenkins:ftp_publisher:*:*:*:*:*:jenkins:*:* that does not match the target CPE identified by dependency-check: cpe:2.3:a:jenkins:ftp_publisher:*:*:*:*:*:*:*. The comparison of the source target software of jenkins is a subset of the target ANY.

Thus, subset should likely be considered true.

[stevespringett]

Agree with analysis. Let me know when you need a release.

[jeremylong]

I'll need this released fairly soon as part of the fully resolution to ODC issue #2386. I have two more minor bugs to fix and would like to release. So within 2 weeks if you could merge PR #31 and release - that would be great.

[stevespringett]

v2.0.2 was released to central.