A vulnerability database should not be about vulnerabilities!
summary
Argues that vulnerability databases must be package-first not CVE-first, and demonstrates a concrete implementation: use PackageURL identifiers and a universal range format called vers to enumerate exact vulnerable package versions instead of fuzzy ranges. Shows the curl/NVD contradiction as evidence, describes a live service (VulnerableCode + PE DB) that stores concrete package URLs, enumerates impacted versions per advisory, and offers a VirusTotal-like comparison engine that aggregates and highlights contradictions across databases.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:50Problems with databases
- 3:38Upstream maintainers know best
- 5:04Packages as first-class
- 7:34Package URLs standard
- 9:19Storing vulnerable packages
- 10:49Universal version ranges
- 11:52Advisories to packages
- 13:19Comparison engine
- 14:22Summary
related talks
32mA Vulnerability Database Should Not Be About Vulnerabilities!
01h 00mNon-Vulnerable Dependency Resolution
57mA Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases Struggle
30mThe National Vulnerability Database (NVD) – Where It Is and Where It’s Going
33mWhere is my Code Vulnerable: Matching CVEs and Source Code
28mTowards a Minimum Viable Enumeration of Vulnerabilities
45mVulntology - A Methodology to Characterize Vulnerabilities While Providing A Granular & Intuitive...
24mPurl and Vers: The Mostly Universal Package URL & Version Ranges Identifiers for Dependencies &...