NVDImporter not populating affected packages

[Hritik14]

Import

(venv) ; ./manage.py import vulnerabilities.importers.nvd.NVDImporter

Importing data using vulnerabilities.importers.nvd.NVDImporter
Successfully imported data using vulnerabilities.importers.nvd.NVDImporter

Data

vulnerablecode> SELECT affected_packages, count(*) FROM vulnerabilities_advisory WHER
 E created_by = 'vulnerabilities.importers.nvd.NVDImporter' GROUP BY affected_package
 s;
+-------------------+--------+
| affected_packages | count  |
|-------------------+--------|
| []                | 213166 |
+-------------------+--------+
SELECT 1
Time: 0.240s

Something is wrong

[Hritik14]

NVD returns CPE and not purl, thus unable to populate affected_packages

Related:

• Missing CPEs #942
• Refine CPE to PURL and PURL to CPE #943
• Add initial draft spec for version ranges univers#11 (comment)
• Add new PURL type: 'cpe' package-url/purl-spec#138