boostorg / boostorg/boost

NIST CPEs missing for boost versions above 1.69.0

Open
#958 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
8.6k
Forks
1.9k
Avg merge
39m
Merged PRs (30d)
2

Description

We have a product that uses the boost:1.76.0 Third-Party package. We would like to use its NIST CPE (Common Platform Enumeration), however, the CPEs are missing from the NIST CPE Dictionary for all versions newer than boost:1.69.0.

The following are a list of errors in the CPE Dictionary that should also be corrected for boost.

- All boost download URLS have changed
- from: [http://downloads.sourceforge.net/project/boost/boost/](http://downloads.sourceforge.net/project/boost/boost/)
- to: [https://sourceforge.net/projects/boost/files/boost/](https://sourceforge.net/projects/boost/files/boost/)

- Download URL for boost:1.76.0 is:
- https://sourceforge.net/projects/boost/files/boost/1.76.0/

- Reference: https://services.nvd.nist.gov/rest/json/cpes/2.0?keywordSearch=boost&keywordExactMatch
- CPEs for Boost are missing after 1.69.0

I have sent an email to cpe_dictionary@nist.gov to notify them of the CPE Dictionary errors for boost versions above 1.69.0. However, the email should probably come from the repository owners to get this fixed.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.