CVE Record Format - Purl and CPE Workshop
summary
CVE Record Format 5.2.0 adds PURL support while 5.1.1 added CPE; PURLs are represented as the package URL object in the CVE JSON and must omit the version (versions go into the existing affected array and CVE Services validate this), and PURL 1.0.02 is ECMA-recognized; CPEs are included almost verbatim from NVD as the CPE applicability structure (nodes, CPE match, logical operators) so records can express complex OS/hardware/version logic; Vulnogram auto-fills CPEs but recommends using NIST’s dictionary or requesting additions.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:14CVE record format overview
- 3:44What is Purl
- 8:05Adding Purl to CVE records
- 9:29Why include Purl
- 11:34Introduction to CPE and its history
- 14:06CPE applicability language
- 15:30Why include CPE
- 17:58Terminology differences
- 20:10NVD site examples
- 22:18CPE in CVE examples
- 24:03Advanced CPE examples
- 28:19Real CVE CPE examples
- 30:30Include CPE today
- 33:16Vulnogram for CPE
- 34:18References
- 35:24Q&A on Purl and CPE
- 40:44Q&A on firmware identifiers
- 42:52Q&A on match criteria
- 45:01Closing remarks
related talks
46mCVE Record Format - Past, Present, and Future
29mQuick Start Session For Using CPE Within the CVE Record Format
50mSoftware Identity in the Vulnerability Management Ecosystem
01h 51mOpen Interchange on CPE - Purl Between Communities of Interest and the CVE and NVD Programs
38mThe Enriched CVE Record: Redefining Completeness and Quality for Greater Impact
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
30mCPE Metadata: Know IT ALL
26mWhere Do We Aim? A Look at the State of Vulnerable Software Identification and Its Future