dependency-check / dependency-check/DependencyCheck
Hinting product `.net` does not yield `cpe:2.3:a:microsoft:**.net**`, but only `cpe:2.3:a:microsoft:.**net_framework**`
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
As indicated by @bondarei in an issue about not taking versions from hints into account it was noted that in case a product is hinted as ".net" the resulting CPE is not as expected.
@aikebah Thanks for your fast response! In the second example, the evidence type="product" source="hint analyzer" name="product" value=".net" confidence="HIGHEST" is also ignored, the report contains only cpe:2.3:a:microsoft:.**net_framework**:6.0.15 but I would expect also follow cpe:2.3🅰️microsoft:**.net**:6.0.15
_Originally posted by @bondarei in https://github.com/jeremylong/DependencyCheck/issues/5812#issuecomment-1625451570_
Contributor guide
Assessment
This issue has not been assessed yet.