The CVE Program is currently sending a public announcement that 5.1.0 supports Package URLs through the use of versionType. This means that a provider can choose to enter
{"version": "pkg:npm/foobar@12.3.1", "versionType": "purl", "status": "affected"}
or any of the other example values from the https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst document. The only validation from the schema is that the value is a string of between 1 and 1024 characters. Also, the CVE Services server does not validate that the value complies with the purl specification. In other words, the level of support is different from, for example,
|
"description": "Common Platform Enumeration (CPE) Name in either 2.2 or 2.3 format", |
|
"pattern": "([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9._\\-~%]*){0,6})|(cpe:2\\.3:[aho*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-._]|(\\\\[\\\\*?!\"#$%&'()+,/:;<=>@\\[\\]\\^`{|}~]))+(\\?*|\\*?))|[*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-._]|(\\\\[\\\\*?!\"#$%&'()+,/:;<=>@\\[\\]\\^`{|}~]))+(\\?*|\\*?))|[*\\-])){4})", |
(CPE is not accepted unless it complies with the CPE syntax.)
|
"vectorString": { |
|
"type": "string", |
|
"pattern": "^CVSS:4[.]0/AV:[NALP]/AC:[LH]/AT:[NP]/PR:[NLH]/UI:[NPA]/VC:[HLN]/VI:[HLN]/VA:[HLN]/SC:[HLN]/SI:[HLN]/SA:[HLN](/E:[XAPU])?(/CR:[XHML])?(/IR:[XHML])?(/AR:[XHML])?(/MAV:[XNALP])?(/MAC:[XLH])?(/MAT:[XNP])?(/MPR:[XNLH])?(/MUI:[XNPA])?(/MVC:[XNLH])?(/MVI:[XNLH])?(/MVA:[XNLH])?(/MSC:[XNLH])?(/MSI:[XNLHS])?(/MSA:[XNLHS])?(/S:[XNP])?(/AU:[XNY])?(/R:[XAUI])?(/V:[XDC])?(/RE:[XLMH])?(/U:(X|Clear|Green|Amber|Red))?$" |
(CVSS is not accepted unless it complies with the CVSS syntax.)
etc.
We, of course, don't know whether any provider will ever use "versionType": "purl" with syntactically incorrect data. We might consider whether:
- in the future, syntax validation should be in place before announcing that any new data syntax is supported
- there should be a recommendation that client developers ensure that containers aren't sent to the server with any syntactically invalid
"versionType": "purl" data
The CVE Program is currently sending a public announcement that 5.1.0 supports Package URLs through the use of versionType. This means that a provider can choose to enter
or any of the other example values from the https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst document. The only validation from the schema is that the value is a string of between 1 and 1024 characters. Also, the CVE Services server does not validate that the value complies with the purl specification. In other words, the level of support is different from, for example,
cve-schema/schema/v5.0/docs/CVE_JSON_bundled.json
Lines 253 to 254 in 2aa608b
(CPE is not accepted unless it complies with the CPE syntax.)
cve-schema/schema/v5.0/docs/CVE_JSON_bundled.json
Lines 1303 to 1305 in 2aa608b
(CVSS is not accepted unless it complies with the CVSS syntax.)
etc.
We, of course, don't know whether any provider will ever use
"versionType": "purl"with syntactically incorrect data. We might consider whether:"versionType": "purl"data