Incorrect CPE for Edge on Windows
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 962
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
What happened:
I scaned a Windows 11 IoT x64 in a VM.
syft scan dir:"C:\" -o cyclonedx-json=D:\vw11iot-cdx.json
and scaned it on Ubuntu with grype also imported to dependency-track, which both show no vulnerabilities of edge.
What you expected to happen:
Generated CPE is:
cpe:2.3:a:Microsoft_Edge:Microsoft_Edge:122.0.2365.106:*:*:*:*:*:*:*
as stated in nvd.nist.gov should be:
cpe:2.3:a:microsoft:edge_chromium:122.0.2365.106:*:*:*:-:*:*:*
Steps to reproduce the issue:
Anything else we need to know?:
Similar to #4275
Environment:
- Output of
syft version:
PS C:\WINDOWS\system32> syft --version
syft 1.38.0
- OS (e.g:
cat /etc/os-releaseor similar):
Windows 11 IoT Enterprise LTSC, 24H2
Thanks :-)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the report with the provided syft scan command on Windows 11 IoT and inspect the generated CPE for Microsoft Edge version 122.0.2365.106. Compare it with the NVD CPE and review related issue #4275; the work is done when the generated CPE matches the expected identifier and vulnerability consumers can recognize Edge.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100