Broken matching for CVE-2021-32743

We have an installation and are trying to get vulnerabilities for icinga, version 2.12.3; component definition is:

<component type="application">
    <name>icinga</name>
    <version>2.12.3</version>
    <cpe>cpe:2.3:a:icinga:icinga:2.12.3:*:*:*:*:*:*:*</cpe>
</component>

which should match against https://nvd.nist.gov/vuln/detail/CVE-2021-32743 - but for some reason, it does not. Changing the cpe string to match all versions lists a lot of old vulnerabilities - but still not the one mentioned above. The vulnerability version information from the NVD json is:

"configurations" : {
   "CVE_data_version" : "4.0",
   "nodes" : [ {
     "operator" : "OR",
     "children" : [ ],
     "cpe_match" : [ {
       "vulnerable" : true,
       "cpe23Uri" : "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*",
       "versionStartIncluding" : "2.4.0",
       "versionEndExcluding" : "2.11.10",
       "cpe_name" : [ ]
     }, {
       "vulnerable" : true,
       "cpe23Uri" : "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*",
       "versionStartIncluding" : "2.12.0",
       "versionEndExcluding" : "2.12.5",
       "cpe_name" : [ ]
     } ]
   } ]
 },

[stevespringett]

@savek-cc I’ve been able to replicate the issue. Will need to investigate to see if its an issue with DT or with the data from the NVD.

[github-actions[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.