Software Vulnerability Analysis Using CPE and CVE — mentioned by tkadlec

Thu, 16 Nov 2017 20:55:41 GMT

Automated tooling is a must, yes. The riskiest part about relying on ONLY GH's solution (IMO) is the NVD/CVE limitation. I agree, CVE would be _awesome_ in theory. In reality, very few file for CVE's and so the coverage is iffy (~11% of npm package vulns and about ~67% of rubygem vulns https://snyk.io/stateofossecurity/). But it goes beyond that. There was a great paper earlier this year (https://arxiv.org/abs/1705.05347) that highlighted many other issues: lag between CVE and NVD (which is where all the useful info comes from), mismatched CPE's, nonexistent CPE's, etc. I would love to see us…

Paper and discussion history. A mention is not an endorsement.

Software Vulnerability Analysis Using CPE and CVE · HackerPapers discussions

Software Vulnerability Analysis Using CPE and CVE — mentioned by tkadlec