Affected versions incorrectly migrated from V4

[jspisiak-istrosec]

Problem a

Around one thousand affected products have a version specifier where version == lessThanOrEqual. This might be because of transformation from v4 schema. This situation in v5 schema however causes incomplete versioning information, since according to lessThanOrEqual documentation the matched version should be between closed interval [version, lessThanOrEqual], which when version == lessThanOrEqual covers only a single version. Usually descriptions of the CVE also specifies that earlier versions than version were affected, thus I believe this migration to be incorrect.

Some examples:

• https://github.com/CVEProject/cvelistV5/blob/main/cves/2017/3xxx/CVE-2017-3187.json
• https://github.com/CVEProject/cvelistV5/blob/main/cves/2019/9xxx/CVE-2019-9535.json

Problem b

Some affected products have a version where version == lessThan + "*". This might be caused by v4 data containing version_affected == ">=". I am not sure what the correct transformation should be, but currently it produces strange result where the lessThan specifier might have a value for example 1.3.0*.

Some examples:

• https://github.com/CVEProject/cvelistV5/blob/main/cves/2018/6xxx/CVE-2018-6704.json
• https://github.com/CVEProject/cvelistV5/blob/main/cves/2018/5xxx/CVE-2018-5410.json

Thank you for your input