CPE with wildcard not being matched

[cfi]

I’m not 100% sure if this is really an issue in the manager / gvmd:

@thomasorhym

• CVE-2018-10115 (this shows only cpe:/a:7-zip:7-zip:18.03 as vulnerable product, but on [2]/vuln/detail/CVE-2018-10115 there’s a pattern which matches all versions up to 18.03, correctly so)
• CVE-2018-10172 (this shows only cpe:/a:7-zip:7-zip:18.01::~windows. My 9.20 7zip version is not matched as a consequence. On [2]/vuln/detail/CVE-2018-10172 you can see that there’s a long list of cpe if you click on “Show matching CPEs”, 18.01 is just the latest.

because it seems the SCAP data is incomplete similar to cases like the following in the past:

• Am I reading the CVE for CVE-2022-42889 Wrong?
• CVE scans not matching the expected CVE-2021-23017
• Several CVE not detected for older CPEs: Dropbear SSH