Adding new products in the CPE database ?

Hello Matt,

I was wondering what was the process to add a new product in the CPE database.

Indeed, I was investigating
https://security-tracker.debian.org/tracker/CVE-2011-3332, which is affecting our "argus" package.

However CVE-2011-3332 affects the Argus product from Iceni, a PDF extracting tool at https://www.iceni.com/legacy.htm.

This is completely different than the Argus package we have, which is
https://openargus.org/.

The NVD CPE database has several Argus products known:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=argus.
From Iceni, from Oracle, from Litronic. But none of them correspond to
the Argus that we have packaged.

So I guess we need to tell the NVD people to add an entry in the CPE database for this other Argus product, so that we can then amend our argus.mk package with the appropriate CPE ID information.

From: Arnout Vandecappelle <[email protected]>
Sent: Tuesday, October 5, 2021 2:01 PM
To: Thomas Petazzoni <[email protected]>; Weber, Matthew L Collins <[email protected]>
Cc: [email protected] <[email protected]>; Yann E. MORIN <[email protected]>
Subject: [External] Re: [Buildroot] Adding new products in the CPE database ?

Quoted 20 lines · Thomas Petazzoni

Hello Matt,

I was wondering what was the process to add a new product in the CPE database.

Indeed, I was investigating

https://urldefense.com/v3/__https://security-tracker.debian.org/tracker/CVE-2011-3332__;!!MvWE!VPRf0gaaOCsnE_JQM6pGz-1aoPEj-5ToeWvMQhYpCm-cI3SkMsp4OAcAY74VaSz9TE70$ , which is
affecting our "argus" package.

However CVE-2011-3332 affects the Argus product from Iceni, a PDF
extracting tool at https://urldefense.com/v3/__https://www.iceni.com/legacy.htm__;!!MvWE!VPRf0gaaOCsnE_JQM6pGz-1aoPEj-5ToeWvMQhYpCm-cI3SkMsp4OAcAY74VaTcLkKg6$ .

This is completely different than the Argus package we have, which is

https://urldefense.com/v3/__https://openargus.org/__;!!MvWE!VPRf0gaaOCsnE_JQM6pGz-1aoPEj-5ToeWvMQhYpCm-cI3SkMsp4OAcAY74VafTb08-R$ .

The NVD CPE database has several Argus products known:

https://urldefense.com/v3/__https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=argus__;!!MvWE!VPRf0gaaOCsnE_JQM6pGz-1aoPEj-5ToeWvMQhYpCm-cI3SkMsp4OAcAY74VaXBFw7T9$ .
  From Iceni, from Oracle, from Litronic. But none of them correspond to
the Argus that we have packaged.

Quoted 3 lines

So I guess we need to tell the NVD people to add an entry in the CPE database for this other Argus product, so that we can then amend our argus.mk package with the appropriate CPE ID information.

  I believe it's simply sending mail to cpe_dictionary at nist.gov. From [1]: