Skip to content

Commit 0695321

Browse files
Fix issue with lib4sbom
lib4sbom always set cpe as version 2.3 even if it's 2.2. For now, we check that CPE begins with "cpe:2.3" before parsing it anthonyharrison/lib4sbom#28
1 parent c2a35cd commit 0695321

File tree

1 file changed

+8
-6
lines changed

1 file changed

+8
-6
lines changed

cve_bin_tool/sbom_manager/__init__.py

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ def __init__(
4444
# Connect to the database
4545
self.cvedb = CVEDB(version_check=False)
4646

47-
def _extract_info_from_cpe(self, cpe: str):
47+
def _extract_info_from_cpe23(self, cpe: str):
4848
cpe_parser = CpeParser()
4949
result = cpe_parser.parser(cpe)
5050
return result["product"], result["version"]
@@ -133,11 +133,13 @@ def parse_sbom(self):
133133
modules.append([purl_info["name"], purl_info["version"]])
134134
extra_id_found = True
135135
elif ref[1] == "cpe23Type":
136-
package_name, package_version = self._extract_info_from_cpe(
137-
ref[2]
138-
)
139-
modules.append([package_name, package_version])
140-
extra_id_found = True
136+
# https://github.com/anthonyharrison/lib4sbom/issues/28
137+
if ref[2].startswith("cpe:2.3"):
138+
package_name, package_version = self._extract_info_from_cpe23(
139+
ref[2]
140+
)
141+
modules.append([package_name, package_version])
142+
extra_id_found = True
141143
if not extra_id_found:
142144
if package.get("version") is not None:
143145
modules.append([package["name"], package["version"]])

0 commit comments

Comments
 (0)