Open Interchange on CPE - Purl Between Communities of Interest and the CVE and NVD Programs
summary
Proposes adding Pearl identifiers and Omnibore references into CVE/JSON to stop scanners inventing product IDs, shows CNAs and NVD are under-reporting CPEs (coverage often around one‑third of CVEs) and that only a handful of records include pearls today, and points to practical tooling: SBOMs, VEX files, Guac mappings and Anchore enrichment feeds. QWG and federation workgroups are extending the CPE dictionary and CPE applicability language, but adoption and canonical naming remain unresolved.
AI-written summary · about
chapters (12)
- 0:00CPE and CVE interchange challenges
- 10:00Data producers vs consumers perspectives
- 20:00CPE dictionary limitations
- 30:00CNAs assigning software IDs
- 40:00Vulnerability scanners and CPE
- 50:00CVSS scoring issues
- 1:00:00CPE and Pearl for identification
- 1:10:00Hierarchical component tracking
- 1:20:00Naming conventions for software IDs
- 1:30:00ADP extending CVE records
- 1:40:00Industry collaboration needs
- 1:50:00Q&A
related talks
33mCVE Decaf: Brewing Better and More Actionable Data Quality
46mCVE Record Format - Purl and CPE Workshop
35mVulnrichment Playground
45mFuture of CVE
53mThe Trials and Tribulations of Bulk Converting CVEs to OSV
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
57mThe CWE Program: Current State and Road Ahead