Vuls動作検証 - JDK

## 目的

JDKのバージョン情報をもとに脆弱性情報を取得してみる。

## 方法

1. CPEを確認していくつかピックアップ
    - Google
    - [NVD \- Search](https://nvd.nist.gov/products/cpe/search)
    - [vulsio/go\-cpe\-dictionary: Build a local copy of CPE\(Common Platform Enumeration\)](https://github.com/vulsio/go-cpe-dictionary#how-to-search-cpe-name-by-application-name)
1. CPE情報をもとに脆弱性情報を取得
    - [NVD \- Search](https://nvd.nist.gov/products/cpe/search)
    - [vulsio/go\-cve\-dictionary: Build a local copy of CVE \(NVD and Japanese JVN\)\. Server mode for easy querying\.](https://github.com/vulsio/go-cve-dictionary#hello-ruby-on-rails-402)

## 17系

[NVD \- Detail \- cpe:2\.3:a:oracle:openjdk:17:\*:\*:\*:\*:\*:\*:\*](https://nvd.nist.gov/products/cpe/detail/1068259?namingFormat=2.2&orderBy=CPEURI&keyword=cpe%3A%2Fa%3Aoracle%3Aopenjdk%3A17&status=FINAL)

`Version 2.3: cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*`
`Version 2.2: cpe:/a:oracle:openjdk:17`

| Version | NVD CVEs | go\-cve\-dictionary |
|:-:|:-:|:-:|
|17|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*) 9|9|

[NVD \- Detail \- cpe:2\.3:a:oracle:jdk:17\.0\.1:\*:\*:\*:\*:\*:\*:\*](https://nvd.nist.gov/products/cpe/detail/1120502?namingFormat=2.2&orderBy=CPEURI&keyword=cpe%3A%2Fa%3Aoracle%3Ajdk%3A17.0.1&status=FINAL)

`Version 2.3: cpe:2.3:a:oracle:jdk:17.0.1:*:*:*:*:*:*:*`
`Version 2.2: cpe:/a:oracle:jdk:17.0.1`

| Version | NVD CVEs | go\-cve\-dictionary |
|:-:|:-:|:-:|
|17.0.1|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:17.0.1:*:*:*:*:*:*:*) 15|15|


## 11系

[NVD \- Detail \- cpe:2\.3:a:oracle:openjdk:11:\*:\*:\*:\*:\*:\*:\*](https://nvd.nist.gov/products/cpe/detail/711976?namingFormat=2.2&orderBy=CPEURI&keyword=cpe%3A%2Fa%3Aoracle%3Aopenjdk%3A11&status=FINAL)

`Version 2.3: cpe:2.3:a:oracle:openjdk:11:*:*:*:*:*:*:*`
`Version 2.2: cpe:/a:oracle:openjdk:11`

[NVD \- Detail \- cpe:2\.3:a:oracle:openjdk:11\.0\.1:\*:\*:\*:\*:\*:\*:\*](https://nvd.nist.gov/products/cpe/detail/711977?namingFormat=2.2&orderBy=CPEURI&keyword=cpe%3A%2Fa%3Aoracle%3Aopenjdk%3A11.0.1&status=FINAL)

`Version 2.3: cpe:2.3:a:oracle:openjdk:11.0.1:*:*:*:*:*:*:*`
`Version 2.2: cpe:/a:oracle:openjdk:11.0.1`

| Version | NVD CVEs | go\-cve\-dictionary |
|:-:|:-:|:-:|
|11|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:11:*:*:*:*:*:*:*) 22|22|
|11.0.1|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:11.0.1:*:*:*:*:*:*:*) 21|21|
|11.0.5|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:11.0.5:*:*:*:*:*:*:*) 21|21|
|11.0.10|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:11.0.10:*:*:*:*:*:*:*) 2|2|
|11.0.14|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:11.0.14:*:*:*:*:*:*:*) 0|0|

| Version | NVD CVEs | go\-cve\-dictionary |
|:-:|:-:|:-:|
|11|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:11:*:*:*:*:*:*:*) 0|0|
|11.0.1|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:11.0.1:*:*:*:*:*:*:*) 3|3|
|11.0.5|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:11.0.5:*:*:*:*:*:*:*) 7|7|
|11.0.10|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:11.0.10:*:*:*:*:*:*:*) 2|2|
|11.0.14|[NVD \- Results](https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.2&keyword=cpe%3A%2Fa%3Aoracle%3Ajdk%3A11.0.14) 0|0|

## 8系

[NVD \- Detail \- cpe:2\.3:a:oracle:openjdk:8:\-:\*:\*:\*:\*:\*:\*](https://nvd.nist.gov/products/cpe/detail/711941?namingFormat=2.2&orderBy=CPEURI&keyword=cpe%3A%2Fa%3Aoracle%3Aopenjdk%3A8&status=FINAL)

`Version 2.3: cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*`
`Version 2.2: cpe:/a:oracle:openjdk:8:-`

[NVD \- Detail \- cpe:2\.3:a:oracle:openjdk:8:update5:\*:\*:\*:\*:\*:\*](https://nvd.nist.gov/products/cpe/detail/839374?namingFormat=2.2&orderBy=CPEURI&keyword=cpe%3A%2Fa%3Aoracle%3Aopenjdk%3A8&status=FINAL)

`Version 2.3: cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*`
`Version 2.2: cpe:/a:oracle:openjdk:8:update5`

| Version | NVD CVEs | go\-cve\-dictionary |
|:-:|:-:|:-:|
|8_5|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*) 15|15|
|8_11|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*) 15|15|
|8_20|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*) 22|22|
|8_31|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*) 15|15|
|8_40|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*) 22|22|
|8_51|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*) 15|15|
|8_60|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*) 20|22|
|8_71|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*) 15|15|
|8_91|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*) 15|15|
|8_101|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*) 15|15|
|8_151|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*) 15|15|
|8_201|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*) 15|15|
|8_252|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*) 2|2|
|8_301|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*) 15|15|

[NVD \- Detail \- cpe:2\.3:a:oracle:jdk:1\.8\.0:\-:\*:\*:\*:\*:\*:\*](https://nvd.nist.gov/products/cpe/detail/711913?namingFormat=2.2&orderBy=CPEURI&keyword=cpe%3A%2Fa%3Aoracle%3Ajdk%3A1.8.0&status=FINAL)

`Version 2.3: cpe:2.3:a:oracle:jdk:1.8.0:-:*:*:*:*:*:*`
`Version 2.2: cpe:/a:oracle:jdk:1.8.0:-`

[NVD \- Detail \- cpe:2\.3:a:oracle:jdk:1\.8\.0:update5:\*:\*:\*:\*:\*:\*](https://nvd.nist.gov/products/cpe/detail/797969?namingFormat=2.2&orderBy=CPEURI&keyword=cpe%3A%2Fa%3Aoracle%3Ajdk%3A1.8.0&status=FINAL)

`Version 2.3: cpe:2.3:a:oracle:jdk:1.8.0:update5:*:*:*:*:*:*`
`Version 2.2: cpe:/a:oracle:jdk:1.8.0:update5`

| Version | NVD CVEs | go\-cve\-dictionary |
|:-:|:-:|:-:|
|8_5|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update5:*:*:*:*:*:*) 52|52|
|8_11|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update11:*:*:*:*:*:*) 34|34|
|8_20|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update20:*:*:*:*:*:*) 44|44|
|8_31|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update31:*:*:*:*:*:*) 34|34|
|8_40|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update40:*:*:*:*:*:*) 47|47|
|8_51|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update51:*:*:*:*:*:*)|52|52
|8_60|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update60:*:*:*:*:*:*) 58|58|
|8_71|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update71:*:*:*:*:*:*) 34|34|
|8_91|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update91:*:*:*:*:*:*) 42|42|
|8_101|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update101:*:*:*:*:*:*) 39|39|
|8_151|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*) 34|34|
|8_201|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update201:*:*:*:*:*:*) 36|36|
|8_251|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update_251:*:*:*:*:*:*) 43|34|
|8_252|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update_252:*:*:*:*:*:*) 34|34|
|8_311|[NVD \- Results](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:oracle:jdk:1.8.0:update311:*:*:*:*:*:*) 48|48|

## 確認

- openjdkとjdkで件数が全然合わなかったりと不安が残る
- OracleJDK有料化 + OepnJDKオープン化のタイミングでメインで使うCPEがOpenJDKになっているのかもしれないけど考えたくもないので未確認

続き : [Vuls動作検証 \- JDK その2 \- Qiita](https://qiita.com/witchcraze/items/2d21f8ae03b9034ac424)