cpe-guesser 2.0 released - Multi-Source CPE Imports, Better Ranking, and Greater Autonomy Beyond NVD

cpe-guesser 2.0

Overview

Version 2.0 brings major improvements to CPE import, ranking, and CVE v5 data handling. This release focuses on better import performance, broader format support, improved search relevance, and more robust indexing for vendor and product matching.

A notable change in this release is that cpe-guesser is no longer limited to NVD as its only practical CPE source. In addition to the NVD feeds, it can also leverage the Vulnerability-Lookup dump available at https://vulnerability.circl.lu/dumps/, providing additional CPE sources and more autonomy from the previously NVD-only source model.

Highlights

Improved search and ranking

• Improved search ranking using CPE rank scores.
• Enhanced server-side lookup ranking with rank:cpe scoring.
• Reset of CVE v5 rank state before each import to ensure consistent ranking behavior.

CVE v5 import and indexing enhancements

• Added CVE v5 NDJSON rank importer.
• Added support for handling incomplete or multiline NDJSON records in CVEListV5Handler.
• Introduced optional CVE v5 word indexing.
• Added missing-word tracking for CVE v5 imports.
• Split missing-word tracking into separate vendor and product sets for more precise analysis.

Faster and more flexible CPE imports

• Parallelized NVD CPE imports for improved performance.
• Refactored import logic into reusable handler classes.
• Added NVDCPEHandler for importing the NVD CPE Dictionary 2.0 JSON format.
• Extended import support for tar archives and standalone JSON files.
• Continued support for legacy XML imports through XMLCPEHandler.
• Added logging of JSON file names found inside tar archives.
• Expanded the import model so cpe-guesser can integrate CPE data from additional sources, including Vulnerability-Lookup dumps, instead of relying solely on NVD feeds.

Configuration and deployment improvements

• Improved configuration robustness by embedding default settings in code when configuration is missing or incomplete.
• Made the Valkey database number configurable.
• Fixed Docker deployment and docker-compose configuration to use Valkey correctly.
• Corrected settings.yaml structure issues.
• Added missing requirements and improved script executability in bin/.

Documentation and maintenance

• Updated README documentation.
• Added examples for the JSON format while keeping legacy format examples.
• Applied Black formatting across library code and regression/import tests.
• General linting and formatting cleanups.

Breaking / notable changes

• The project now defaults to the CPE Dictionary 2.0 feed.
• Import handling has been refactored significantly around dedicated handler classes.
• CLI import behavior was simplified by removing the redundant --update flag and improving boolean toggle handling.
• The project architecture is now better suited for multi-source CPE ingestion, reducing dependence on NVD as the single upstream source.

Contributors

Thanks to everyone who contributed to this release, including:

• Alexandre Dulaunoy
• Esa Jokinen
• Surya Kanagasabapathy

Upgrade notes

When upgrading to 2.0, review:

• Your import workflows, especially if you rely on legacy XML-only behavior.
• Your configuration files, although defaults now make startup more robust.
• Your Docker and Valkey setup if you deploy with containers.
• Your data ingestion pipeline if you want to take advantage of alternative CPE sources such as the Vulnerability-Lookup dumps.

Summary

cpe-guesser 2.0 is a substantial release that modernizes the import pipeline, adds support for current NVD CPE data formats, improves ranking quality, and makes deployments more robust and scalable. It also opens the door to a more autonomous and flexible ingestion model by supporting additional CPE sources beyond NVD.

CPE Guesser v1.2 released - a tool or web service guess the CPE name based on one or more keywords.

Release Notes - CPE Guesser v1.2 (2024-11-23)

CPE Guesser is a command-line tool or web service designed to guess the CPE name based on one or more keywords. The resulting CPE can then be used with tools like cve-search or vulnerability-lookup to perform actual searches using CPE names.

We are glad to announce the release of CPE Guesser v1.2! This version introduces new features, significant updates, and various improvements to enhance usability and performance.

---

🚀 New Features

• New API Endpoint:
  Added the /unique endpoint to return the best CPE matches, simplifying the process of finding the most relevant entries.
  Contributed by Alexandre Dulaunoy.

---

✨ Changes

• Documentation Enhancements:

  • Added a contribution guide.
  • Updated the documentation to include details about the new /unique API endpoint.
    Contributed by Alexandre Dulaunoy.

• Command-Line Improvements:
  Added the --unique option in the lookup command to retrieve the best-matching CPE.
  Contributed by Alexandre Dulaunoy.

• Database Update:
  Transitioned from Redis to Valkey for better performance and reliability.
  Contributed by Alexandre Dulaunoy.

---

🛠️ Other Improvements

• Documentation Updates:
  Enhanced and unified paths in installation instructions, linted markdown, and added syntax highlighting.
  Contributed by Esa Jokinen and Alexandre Dulaunoy.

• GitHub Workflow Enhancements:

  • Added workflows for ShellCheck and Black formatting.
  • Updated to actions/checkout@v4, which uses Node.js 20.
  • Applied Black 24.3.0 formatting for Python code.
    Contributed by Esa Jokinen.

• General Maintenance:

  • Merged pull requests to improve documentation and workflows.
  • Updated copyright years.
    Contributed by Alexandre Dulaunoy and Esa Jokinen.

---

A big thank you to all the contributors who made this release possible. Your efforts ensure the continued growth and improvement of CPE Guesser.

cpe-guesser version 1.1 released

v1.1 (2023-08-09)

Changes

• [code] black. [Alexandre Dulaunoy]

Other

• Merge pull request #10 from cosad3s/main. [Alexandre Dulaunoy]

  Add Docker & Docker-compose + external configuration

• No error code if import.py exits with warning. [Sébastien Copin]

  It can block app restarting, especially with container usage

• Add missing configuration in lib cpeguesser.py. [Sébastien Copin]

• Update readme. [Sébastien Copin]

• Add Docker & docker-compose. [Sébastien Copin]

• Add external configuration. [Sébastien Copin]

• Merge pull request #8 from FafnerKeyZee/patch-1. [Alexandre Dulaunoy]

  Fixing cpeweb service in case of failure

• Fixing cpeweb service in case of failure. [Fafner [KeyZee]]

• Merge pull request #7 from FafnerKeyZee/main. [Alexandre Dulaunoy]

  Adding systemd and logrotate

• Adding systemd & logrotate. [Olivier Ferrand]

• Adding systemd & logrotate. [Olivier Ferrand]

CPE guesser v1.0 released - guess CPE from one or more keyword(s)

CPE guesser

CPE guesser is a command-line and web service to guess the CPE name based on one or more keyword(s). Then the result can be used against cve-search to do actual searches by CPE names. The algorithm made by @adulau is described there.

Public online version

cpe-guesser.cve-search.org is public online version of CPE guesser which can be used via a simple API (if you don't want to install this software). The endpoint is /search and the JSON is composed of a query list with the list of keyword(s) to search for.

curl -s -X POST https://cpe-guesser.cve-search.org/search -d "{\"query\": [\"outlook\", \"connector\"]}" | jq .
[
  [
    18117,
    "cpe:2.3:a:microsoft:outlook_connector"
  ],
  [
    60947,
    "cpe:2.3:a:oracle:oracle_communications_unified_communications_suite_connector_for_microsoft_outlook"
  ],
  [
    68306,
    "cpe:2.3:a:oracle:corporate_time_outlook_connector"
  ]
]

What's Changed

• CPE guessing logic & database access as a class. by @oh2fih in #2
• Implement the import process fully in Python by @oh2fih in #4
• Optimization: replace format() with f-strings by @oh2fih in #5
• chg: [lookup] use positional arguments for WORD(s) by @oh2fih in #6

New Contributors

• @oh2fih made their first contribution in #2

Full Changelog: https://github.com/cve-search/cpe-guesser/commits/v1.0