3

I'm trying to understand the Common Product Enumeration standard published by Mitre. In the Version field, I've found references to "*" or ANY meaning "Any Version."

However, when I search the CPE Dictionary, I find a dash in that field. Does that mean "No Version" or possibly "All Versions?"

Cargo23
  • 131
  • 3

1 Answers1

5

According the the standard (https://cpe.mitre.org/files/cpe-specification_2.2.pdf), it should mean NA:

"It is often necessary to use a CPE Name when identifying a specific release of a given platform.
If attempting to create a CPE Name for this, and a specific co mponent is not applicable to the given platform, then the term '-' should be used. Note that use of the '-' term is different than leaving the component blank, even though in practice both options might identify with the same set of platform types. For example, an application may not have different editions. A CPE Name for such an application may use the '-' term for the edition component."

cpe:/a:acme:product:1.0:update2:-:en-us

From the usage, it certainly appears to mean null, more often than not.

Jason
  • 71
  • 6
  • Good find. I was exclusively looking at the CPE 2.3 docs, which doesn't have this text in it. It would seem that they eliminated the dash from the specification but are still allowing it in v2.3 CPE's. – Cargo23 Jun 27 '17 at 13:26