feat: CVE query wildcard vendor entries

[m-1-k-3]

Description

Hi cve-bin-tool team. We currently evaluate the integration of cve-bin-tool into EMBA. In EMBA we query the CVE data via grep queries. These include sometimes regular expressions for vendor entries. like cpe:${CPE_VERSION}:[aoh]:.*${lVERSION_SEARCHx}" "${NVD_DIR}"
The simplest possibility to integrate csv-bin-tool I have found is via csv import like python3 ./cve_bin_tool/cli.py -i ~/Downloads/test.csv --offline

In such a case we could prepare test.csv with some entries like linux_kernel,linux,2.6.23

But in the mentioned use-case of linux_kernel,,2.6.23 this approach fails. Is there already a mechanism to perform queries with wildcard vendors that I have missed? Probably we could enter some key-word as vendor to bypass the vendor search?

Why?

cve-bin-tool is much faster in CVE queries as the current EMBA approach. Probably we could integrate it into EMBA as the main CVE query engine.

Environment context (optional)

Currently it is for evaluating a possible integration into EMBA. In the future it could be integrated as the central CVE engine for EMBA. EMBA is providing a Kali Linux based docker base image where we could integrate cve-bin-tool.

[terriko]

I don't think we have a wildcard search option when scanning .csv files, but the code is available and used elsewhere so it probably wouldn't be hard to add it. The reason it's not available is mostly that no one has asked before.

How would you want it to work? We could probably have it search any time a vendor isn't specified and I don't think that would be too surprising to existing users, or we could have it search only when something specific (e.g. "*" or "unknown") is specified in the vendor field so that people with existing scans won't be likely to affected by a bunch of searches (which would definitely slow things down for them, though how much would depend on how many rows in the .csv will trigger a search).

[m-1-k-3]

Hi @terriko,
for me both mechanisms would work ... nevertheless, a keyword like "unknown" is probably quite clear and should not have too many side effects for existing users and existing binary search definitions.

[terriko]

A note about the hackathon label: I've flagged a bunch of issues for folk participating in the Open Source Ecosyststems Hackathon March 3-7. Please leave these issues to hackathon participants. if they're not claimed after, say, March 10th, they're fair game to other people (including GSoC participants).