Quantcast

CPE 2.3 release

classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

CPE 2.3 release

Deepak Asawa

Hi,

 

Is CPE 2.3 dictionary already official. Because it can be found in archive(http://static.nvd.nist.gov/feeds/xml/cpe/dictionary) but following link mentions as TBD;

 

http://scap.nist.gov/revision/1.2/index.html#

 

 

Even though we find CPE 2.3 dictionary in archive(http://static.nvd.nist.gov/feeds/xml/cpe/dictionary), I see that there is no nvd-id in any cpe-item.

 

And also Official CPE Dictionary, site still points to CPE 2.2

 

Please do let me know if you have any idea.

 

Thanks,

Deepak Asawa

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: CPE 2.3 release

Booth, Harold

We are working on deploying the process to generate the CPE 2.3 dictionary on a nightly basis with the next update to the NVD. We are in the final stages of testing and hope to have the process deployed soon. The official CPE dictionary is currently being produced in 2.2 format, but once the deployment occurs both formats will begin to be produced.

 

The CPE 2.3 dictionary in the archive is an old one provided as an example. Please feel to look at it as an example of what will be produced in the end, but it is currently not being updated. If there are any errors with the file, please let us know ([hidden email]) and we will work to resolve those.

 

Finally, the nvd-id was never part of the standard CPE Dictionary format but instead was an extension that was created by the NVD that, at the time, we thought was necessary. We now think it may be confusing and unnecessary along with the status attribute. If you or anyone else needs the nvd-id, or status attributes we can produce two versions of the file, and I would be interested in understanding how you are using the nvd-id and/or status attributes. (Note: I thought the topic of the nvd-id and status attributes had been brought up before, but after a quick search I couldn’t find any discussion, so this may be the first time it has been brought up on the list. If someone will be inconvenienced by the removal of these attributes we will produce two versions of the files.)

 

Regards,

 

-Harold

 

From: Deepak Asawa [mailto:[hidden email]]
Sent: Friday, June 29, 2012 11:29 AM
To: [hidden email]
Subject: [CPE-DISCUSSION-LIST] CPE 2.3 release

 

Hi,

 

Is CPE 2.3 dictionary already official. Because it can be found in archive(http://static.nvd.nist.gov/feeds/xml/cpe/dictionary) but following link mentions as TBD;

 

http://scap.nist.gov/revision/1.2/index.html#

 

 

Even though we find CPE 2.3 dictionary in archive(http://static.nvd.nist.gov/feeds/xml/cpe/dictionary), I see that there is no nvd-id in any cpe-item.

 

And also Official CPE Dictionary, site still points to CPE 2.2

 

Please do let me know if you have any idea.

 

Thanks,

Deepak Asawa

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: CPE 2.3 release

Deepak Asawa

Harold,

 

Thank you very much for your reply.

 

We do not use nvd-id but since it was missing in 2.3 CPE dictionary which was in Archive, I thought it was not included because 2.3 CPE dictionary is not yet official.

 

Thanks,

Deepak Asawa

 

From: Booth, Harold [mailto:[hidden email]]
Sent: 03 July 2012 18:41
To: [hidden email]
Subject: Re: [CPE-DISCUSSION-LIST] CPE 2.3 release

 

We are working on deploying the process to generate the CPE 2.3 dictionary on a nightly basis with the next update to the NVD. We are in the final stages of testing and hope to have the process deployed soon. The official CPE dictionary is currently being produced in 2.2 format, but once the deployment occurs both formats will begin to be produced.

 

The CPE 2.3 dictionary in the archive is an old one provided as an example. Please feel to look at it as an example of what will be produced in the end, but it is currently not being updated. If there are any errors with the file, please let us know ([hidden email]) and we will work to resolve those.

 

Finally, the nvd-id was never part of the standard CPE Dictionary format but instead was an extension that was created by the NVD that, at the time, we thought was necessary. We now think it may be confusing and unnecessary along with the status attribute. If you or anyone else needs the nvd-id, or status attributes we can produce two versions of the file, and I would be interested in understanding how you are using the nvd-id and/or status attributes. (Note: I thought the topic of the nvd-id and status attributes had been brought up before, but after a quick search I couldn’t find any discussion, so this may be the first time it has been brought up on the list. If someone will be inconvenienced by the removal of these attributes we will produce two versions of the files.)

 

Regards,

 

-Harold

 

From: Deepak Asawa [[hidden email]]
Sent: Friday, June 29, 2012 11:29 AM
To: [hidden email]
Subject: [CPE-DISCUSSION-LIST] CPE 2.3 release

 

Hi,

 

Is CPE 2.3 dictionary already official. Because it can be found in archive(http://static.nvd.nist.gov/feeds/xml/cpe/dictionary) but following link mentions as TBD;

 

http://scap.nist.gov/revision/1.2/index.html#

 

 

Even though we find CPE 2.3 dictionary in archive(http://static.nvd.nist.gov/feeds/xml/cpe/dictionary), I see that there is no nvd-id in any cpe-item.

 

And also Official CPE Dictionary, site still points to CPE 2.2

 

Please do let me know if you have any idea.

 

Thanks,

Deepak Asawa

Loading...