Vulnerability Detection of Third Party Package with Custom Name

[GRMrGecko]

Hello,

Wondering how one can inform the vulnerability detection of what CPE to look at for a third party package. The third party package I'm in particular looking to have vulnerabilities detected for is nginx-more, but I am also curious about custom packages where I may name the package something different and need to make the link to the correct CPE.

I see for windows https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/cpe-helper.html exists, but it states it is only used on Windows, so I'm not sure where to go for Linux. The following is output from package list of nginx-more.

{
  "scan": {
     "id": 0,
     "time": "2024-04-15T00:01:20+00:00"
  },
  "priority": " ",
  "section": "System Environment/Daemons",
  "install_time": "1713139175",
  "source": " ",
  "description": "A high performance web server and reverse proxy server",
  "location": " ",
  "name": "nginx-more",
  "version": "1.16.1-4.el7",
  "format": "rpm",
  "vendor": " ",
  "size": 17546061,
  "architecture": "x86_64",
  "agent_id": "001"
}

My guess if cpe-helper worked on Linux, I should just be able to do the following:

{
    "target": "linux",
    "source": {
        "vendor": [
            " "
        ],
        "product": [
            "nginx-more"
        ],
        "version": []
    },
    "translation": {
        "vendor": [
            "f5"
        ],
        "product": [
            "nginx"
        ],
        "version": []
    },
    "action": [
        "replace_vendor",
        "replace_product"
    ]
}

Any assistance in configuring for vulnerability detection would be appreciated.

Thanks!