NVD JSON feeds, tags meaning and their purpose

user_8317457 0
Viewed 2042

I started moving on from NVD XML feeds to JSON feeds (as XML will no longer be supported from October 2019). Now I am having difficulty understanding the tags and their purpose for use.

For example:

  1. What purpose does "operator" tag inside "configuration" have?

  2. "affects" tag list out all the vulnerable libraries associated to that CVE-ID, then what is the use of "configuration" tag? Because the information specified inside them just seems a repeat from affects tag except the cpeId which could have also been specified inside the affects tag.

I tried searching the NVD website for any such related document but could not find any. The JSON schema does not mention the details or purpose (as expected).

Please point out if any document is created about it.

owasp security
2 Answers

1. What purpose does "operator" tag inside "configuration" have?

Well there is a defined purpose of "operator" in each CVE configuration. Here it is i am trying to explain.

If a CVE configuration's nodes[...] array contains operator 'AND' then it must have at least two or more children representing a combination of logical AND between the children in order to qualify as vulnerable.

Let us see an example: For "CVE-2018-4926", i take this snippet:

  "configurations": {
    "CVE_data_version": "4.0",
    "nodes": [
      {
        "operator": "AND",
        "children": [
          {
            "operator": "OR",
            "cpe_match": [
              {
                "vulnerable": true,
                "cpe23Uri": "cpe:2.3:a:adobe:digital_editions:*:*:*:*:*:*:*:*",
                "versionEndIncluding": "4.5.7"
              }
            ]
          },
          {
            "operator": "OR",
            "cpe_match": [
              {
                "vulnerable": false,
                "cpe23Uri": "cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*"
              },
              {
                "vulnerable": false,
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*"
              },
              {
                "vulnerable": false,
                "cpe23Uri": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*"
              },
              {
                "vulnerable": false,
                "cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*"
              }
            ]
          }
        ]
      }
    ]
 }

Here in the above configuration, AND operator has two children. Notice the the :a: is for application and :o: is for operating system in cpe23Uri. example, 

"cpe23Uri": "cpe:2.3:a:adobe:digital_editions:*:*:*:*:*:*:*:*",

AND

cpe23Uri": "cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*"

Now in order to qualify the application "adobe:digital_editions" version ending at 4.5.7 as vulnerable, the operating systems must be :o:apple:iphone_os OR :o:apple:mac_os_x: OR o:google:android: OR cpe:2.3:o:microsoft:windows.

We can rephrase this as:

The adobe digital_editions application version ending at 4.5.7 is vulnerable for above mentioned OS.

What is take away :

The AND operator in configuration will always come with two things with following possibilities : 1. application and operating system 2. hardware :h: and operation system

If the configuration is without children, then any of cpe23Uri with hold to qualify the OS or application as vulnerable as shown in following two examples.

Example 1: for OR operator for applications

"configurations" : {
      "CVE_data_version" : "4.0",
      "nodes" : [ {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:oracle:flexcube_private_banking:2.0.0:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:oracle:flexcube_private_banking:2.0.1:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:oracle:flexcube_private_banking:2.2.0:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:oracle:flexcube_private_banking:12.0.1:*:*:*:*:*:*:*"
        } ]
      } ]
    },

Example 2: for OR operator for operating system

    "configurations" : {
      "CVE_data_version" : "4.0",
      "nodes" : [ {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*"
        } ]
      } ]
    },

I hope it will clarify a bit now. If not, i am available for any questions in this regard.

Good luck!

user_87723760
  1. Configuration tag specifies the specific configuration/environment that caused the vulnerability. Operator, based on seeing many different usage of it, is meant to describe the different product versions. For example, the below is a copy of nodes key under configurations key of CVE-2003-0001.
"nodes" : [ {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:freebsd:freebsd:4.2:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:freebsd:freebsd:4.3:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:freebsd:freebsd:4.4:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:freebsd:freebsd:4.5:*:*:*:*:*:*:*"
        }, ...]

The operator here means that the vulnerability can appear in any on the cpe23Uri(s) mentioned. 1. "affects" listed the vendor name, product name and version details. Yes, it was redundant given that configurations was mentioned. CPE 2.3 is meant to identify each software product with help from the industry as well. Given the redundancy, you'll observe that the NVD has changed is schema in September 2019.

Lastly, in the name of field descriptions, the details can be found in the provided schema (agree, it is not enough). https://csrc.nist.gov/schema/nvd/feed/1.1/nvd_cve_feed_json_1.1.schema (v1.1) https://csrc.nist.gov/schema/nvd/feed/1.0/nvd_cve_feed_json_1.0.schema (v1.0)

user_123529770
Related