Pentesters at usd HeroLab explain why it is surprisingly difficult to reliably find the known vulnerabilities of a given software version. They compared six tools and databases, among them nvdtools, cve-search, Snyk, VulDB and Rapid7’s database, and none returned exactly the right set of CVEs in every case. The root causes include inconsistent product and version naming, duplicate or deprecated CPE entries (Redis exists under two vendors, Piwik became Matomo), awkward version strings, and an NVD software dictionary that lags behind its vulnerability data. Case studies (like ProFTPD 1.3.3c and ThingsBoard 3.4.1) show how CVEs get missed or wrongly reported because of fuzzy matching or misaligned data. In a follow-up post, they introduce their open-source tool search_vulns, which maps a product name and version to a CPE, treats renamed products as equivalent and builds missing CPEs from existing entries for the product. Turns out “is this version vulnerable?” is not a yes-or-no question.
The Surprising Complexity of Finding Known Vulnerabilities
··1 min