dependency-check / dependency-check/DependencyCheck

Hinting product `.net` does not yield `cpe:2.3:a:microsoft:**.net**`, but only `cpe:2.3:a:microsoft:.**net_framework**`

Open
#5,817 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

As indicated by @bondarei in an issue about not taking versions from hints into account it was noted that in case a product is hinted as ".net" the resulting CPE is not as expected.

@aikebah Thanks for your fast response! In the second example, the evidence type="product" source="hint analyzer" name="product" value=".net" confidence="HIGHEST" is also ignored, the report contains only cpe:2.3:a:microsoft:.**net_framework**:6.0.15 but I would expect also follow cpe:2.3🅰️microsoft:**.net**:6.0.15

_Originally posted by @bondarei in https://github.com/jeremylong/DependencyCheck/issues/5812#issuecomment-1625451570_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.