diff mbox series

[v3,8/8] support/scripts/pkg-stats: Only match CPE vendor and product

Message ID 20230812192842.135682-8-dalang@gmx.at
State Superseded
Headers show
Series [v3,1/8] support/scripts/pkg-stats: fix typos | expand

Commit Message

Daniel Lang Aug. 12, 2023, 7:28 p.m. UTC 
Instead of checking if the whole CPE string is known in the database,
only check if a string with the same vendor and product exists.

Reported-by: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Daniel Lang <dalang@gmx.at>
---
v1 -> v2:
- patch added
---
 support/scripts/pkg-stats | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/support/scripts/pkg-stats b/support/scripts/pkg-stats
index 196cbb660e..06d3d483bf 100755
--- a/support/scripts/pkg-stats
+++ b/support/scripts/pkg-stats
@@ -649,11 +649,12 @@  def check_package_cves(nvd_path, packages):
 
 def check_package_cpes(nvd_path, packages):
     cpe_api = CPE_API(nvd_path)
-    cpes = cpe_api.load_ids()
+    cpe_api.load_ids()
+    cpe_api.generate_partials()
     for p in packages:
         if not p.cpeid:
             continue
-        if p.cpeid in cpes:
+        if cpe_api.find_partial(p.cpeid):
             p.status['cpe'] = ("ok", "verified CPE identifier")
         else:
             p.status['cpe'] = ("error", "CPE version unknown in CPE database")