Common Platform Enumeration (CPE) is a structured
naming scheme
In computing, a naming scheme is a system for assigning and managing names of objects connected into computer networks. It typically consists of a namespace and processes for assigning, storing, and resolving names.
Naming schemes in computing
Se ...
for information technology systems, software, and packages. Based upon the generic syntax for
Uniform Resource Identifier
A Uniform Resource Identifier (URI), formerly Universal Resource Identifier, is a unique sequence of characters that identifies an abstract or physical resource, such as resources on a webpage, mail address, phone number, books, real-world obje ...
s (URI), CPE includes a formal name format, a method for checking names against a system, and a description format for binding text and tests to a name.
[ ]
The CPE Product Dictionary provides an agreed upon list of official CPE names. The dictionary is provided in
XML format and is available to the general public. The CPE Dictionary is hosted and maintained at
NIST
The National Institute of Standards and Technology (NIST) is an agency of the United States Department of Commerce whose mission is to promote American innovation and industrial competitiveness. NIST's activities are organized into physical s ...
, may be used by nongovernmental organizations on a voluntary basis, and is not subject to copyright in the United States.
CPE identifiers are commonly used to search for
Common Vulnerabilities and Exposures
The Common Vulnerabilities and Exposures (CVE) system, originally Common Vulnerability Enumeration, provides a reference method for publicly known information security, information-security vulnerability (computing), vulnerabilities and exposures ...
(CVEs) that affect the identified product.
Scheme format
CPE 2.3 follows this format, maintained by NIST:
cpe_version
The version of the CPE definition. The latest CPE definition version is 2.3.
part
May have 1 of 3 values:
#
a for Applications
#
h for Hardware
#
o for Operating Systems
It is sometimes referred to as
type.
vendor
Values for this attribute SHOULD describe or identify the person or organization that manufactured or
created the product. Values for this attribute SHOULD be selected from an attribute-specific valid-values
list, which MAY be defined by other specifications that utilize this specification. Any character string
meeting the requirements for WFNs (cf. 5.3.2) MAY be specified as the value of the attribute.
product
The name of the system/package/component.
product and
vendor are sometimes identical. It can not contain spaces, slashes, or most special characters. An underscore should be used in place of whitespace characters.
version
The version of the system/package/component.
update
This is used for update or
service pack
In computing, a service pack comprises a collection of updates, fixes, or enhancements to a software program delivered in the form of a single installable package. Companies often release a service pack when the number of individual patches to a ...
information. Sometimes referred to as "point releases" or minor versions. The technical difference between
version and
update will be different for certain vendors and products. Common examples include
beta,
update4,
SP1, and
ga (for General Availability), but it is most often left blank.
edition
A further granularity describing the build of the system/package/component, beyond
version.
language
A valid language tag as defined by
IETF
The Internet Engineering Task Force (IETF) is a standards organization for the Internet standard, Internet and is responsible for the technical standards that make up the Internet protocol suite (TCP/IP). It has no formal membership roster ...
RFCbr>
5646entitled "Tags for Identifying Languages". Examples include:
en-us for US English, and
zh-tw for
Taiwanese Mandarin
Taiwanese Mandarin, frequently referred to as ''Guoyu'' () or ''Huayu'' (), is the variety of Mandarin Chinese spoken in Taiwan. A large majority of the Taiwanese population is fluent in Mandarin, though many also speak a variety of Min Chinese ...
.
Examples
Here,
* is used as a
wildcard character
In software, a wildcard character is a kind of placeholder represented by a single character (computing), character, such as an asterisk (), which can be interpreted as a number of literal characters or an empty string. It is often used in file ...
:
cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:-:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:internet_explorer:8.0.6001:beta:*:*:*:*:*:*
References
{{reflist
External links
CPE SpecificationOfficial CPE DictionaryWhat’s in a Name? A Look at the Software Identification Ecosystem
Naming conventions