Lot's of incorrect linkings from CWE to CVE

[shaileshmeivel]

I wanted to get the list of all the CVE's linked for a particular CWE, so I referred to the Linking Threat Tactics paper itself for a CWE and took CWE-787 as an example and queried it( In the paper it was mentioned that CWE-787 has a total of 1150 CVE's linked to it approximately)

I knew that I would be getting more CVE's linked to it because of the addition of new vulnerability for that particular weakness but there were actually 132999 CVE's linked to CWE-787. So when I randomly checked if the following CVE's where linked to CWE-787( for that I actually took the respective id's of the CVE's and googled them and checked with the NVD website) , in the list of 132999 the first 1000 - 1500 where ALMOST linked to CWE-787 but after that only 2/10 or something like that were linked to CWE-787, and after that they were linked to some other CWE's

So I queried BRON as follows:
First got the CWE _id for CWE-787

Then used _id to get all the CVE's linked to it

and this was the result

(There were too many duplicates over here, so I filtered them by using return distinct v._to)

So when I randomly took the below CVE _id

took the corresponding CVE number and googled it

So this particular one was linked with CWE-476

I even tried checking if CWE-476 and CWE-787 were linked together in the CweCwe collection, but unfortunately they were not.

So this is just an example for one particular CWE. I tried the above methods on 8-9 CWE's and all of them produced the same results

[jiangdie666]

It should be the cve data source version, you can download the latest cve data package, integrate its associated cwe, and update the data of cwecve.

[shaileshmeivel]

I actually tried all of these on the public version of BRON available at http://bron.alfa.csail.mit.edu:8529/. When I downloaded BRON I had some other issue(#41) that's why I used the public version

[jiangdie666]

I think you can look at the specific code in the parse_cve_file function in the file parse_cve.py within your local, docker to see if there is a problem.

[hembergerik]

We have tried to address this issue with the v4 release https://github.com/ALFA-group/BRON/tree/v4

[shaileshmeivel]

Is the public version of BRON updated with v4?

[hembergerik]

Yes, it should be