From 8fcf5ee760501ccad45bddd6fa054f48eb67bf34 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Wed, 7 May 2014 07:05:37 -0400 Subject: [PATCH] fixed bug causing vulnerabilities to be missed Former-commit-id: e625225c6be3be1b471fab48c6eda0a616febfb9 --- .../java/org/owasp/dependencycheck/data/nvdcve/CveDB.java | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java index aabc8b708..131a28299 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java @@ -46,6 +46,7 @@ import org.owasp.dependencycheck.utils.Pair; * @author Jeremy Long */ public class CveDB { + /** * The logger. */ @@ -733,8 +734,10 @@ public class CveDB { final boolean isStruts = "apache".equals(vendor) && "struts".equals(product); final DependencyVersion v = parseDependencyVersion(cpeId); final boolean prevAffected = previous != null && !previous.isEmpty(); - if (identifiedVersion == null || "-".equals(identifiedVersion.toString())) { - if (v == null || "-".equals(v.toString())) { + if (v == null || "-".equals(v.toString())) { //all versions + affected = true; + } else if (identifiedVersion == null || "-".equals(identifiedVersion.toString())) { + if (prevAffected) { affected = true; } } else if (identifiedVersion.equals(v) || (prevAffected && identifiedVersion.compareTo(v) < 0)) {