You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The above is only for CNA containers. About 1500 other CVE Records are affected because of "version":"*" in the CISA-ADP ADP container, but that ADP has reported that a fix is in progress.
To create a schema that doesn't allow "version":"*" one approach is to have a new definition such as versionButNotAsterisk that is similar to:
"description": "The single version being described, or the version at the start of the range. By convention, typically 0 denotes the earliest possible version.",
"$ref": "#/definitions/version"
(but not for lessThan or lessThanOrEqual, where * is meaningful)
There are more than 1700 CVE Records that have
even though this is undefined:
cve-schema/schema/docs/versions.md
Lines 253 to 259 in 30f59c7
(There are no wildcards, and "0" - rather than "*" - is used to mean no lower bound.)
Most of these are apparently a syntax error by the Wordfence CNA, e.g.,
which should have been written as
Occasionally other CNAs have done this:
where apparently the intention was:
Other CNAs apparently use * to try to imply wildcarding, e.g.,
which should have been written as
Similarly:
The above is only for CNA containers. About 1500 other CVE Records are affected because of
"version":"*"in the CISA-ADP ADP container, but that ADP has reported that a fix is in progress.To create a schema that doesn't allow
"version":"*"one approach is to have a new definition such asversionButNotAsteriskthat is similar to:cve-schema/schema/CVE_Record_Format.json
Lines 81 to 85 in 30f59c7
but with a negative lookahead:
and use this for:
cve-schema/schema/CVE_Record_Format.json
Lines 298 to 300 in 30f59c7
(but not for lessThan or lessThanOrEqual, where
*is meaningful)The text was updated successfully, but these errors were encountered: