Metacrafter Registry

Datatypes

CPE 2.3 formatted string

ID cpe23

DatatypeNot PIIidentifierDraft

This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).

Name of an IT product in the formatted string binding of Common Platform Enumeration (CPE) 2.3, maintained by NIST: cpe:2.3: followed by eleven colon-separated attributes - part (a for an application, o for an operating system, h for hardware), vendor, product, version, update, edition, language, sw_edition, target_sw, target_hw and other. An asterisk means any value and a hyphen means not applicable. The NVD CPE dictionary and CVE records name affected products this way. The regexp is the one of the CPE 2.3 naming XML schema. The older CPE 2.2 URI form (cpe:/a:...) is not covered.

Categories
Software development
Countries
Global (not tied to a country)
Languages
Common to most languages
Quality
75/100 · missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage
Metacrafter rules
no detection rule yet
Supported by tools
no tool record lists this type yet

Regular expression

^cpe:2\.3:[aho*\-](:(((\?*|\*?)([a-zA-Z0-9\-._]|(\\[\\*?!"#$%&'()+,/:;<=>@\[\]\^`{|}~]))+(\?*|\*?))|[*\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[*\-]))(:(((\?*|\*?)([a-zA-Z0-9\-._]|(\\[\\*?!"#$%&'()+,/:;<=>@\[\]\^`{|}~]))+(\?*|\*?))|[*\-])){4}$

Python re syntax.

Examples

ValueDescription
cpe:2.3:a:apache:log4j:2.14.1:-:*:*:*:*:*:*Apache Log4j 2.14.1 in the NVD CPE dictionary
cpe:2.3:o:linux:linux_kernel:5.10:-:*:*:*:*:*:*Linux kernel 5.10 (operating system)
cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:*Cisco ASA 5505 (hardware)
cpe:2.3:a:microsoft:internet_explorer:8.0.6001:beta:*:*:*:*:*:*Example from Wikipedia
cpe:/a:apache:log4j:2.14.1 invalidCPE 2.2 URI binding
cpe:2.3:a:apache:log4j:2.14.1 invalidAttributes after version are missing

Sources

Use this record