Some BulletinKBs are mismatched with AffectedProduct in definitions.zip.

[renzhexigua]

Some relationships between the BulletinKB and AffectedProduct are mismatched.

For example, KB5022728-related records in the latest version (2023-03-09) https://github.com/bitsadmin/wesng/commit/9a212d7cdf7d7e11874b6c78ebc7c81cf4e58717 show that it patches not only Windows 10 Version 21H2 but also 22H2.

"20230214","CVE-2023-21722","5022728",".NET Framework Denial of Service Vulnerability","Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for 32-bit Systems","Microsoft","Important","Denial of Service","",
"20230214","CVE-2023-21722","5022728",".NET Framework Denial of Service Vulnerability","Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for ARM64-based Systems","Microsoft","Important","Denial of Service","",
"20230214","CVE-2023-21722","5022728",".NET Framework Denial of Service Vulnerability","Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for x64-based Systems","Microsoft","Important","Denial of Service","",

"20230214","CVE-2023-21722","5022728",".NET Framework Denial of Service Vulnerability","Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 22H2 for ARM64-based Systems","Microsoft","Important","Denial of Service","",
"20230214","CVE-2023-21722","5022728",".NET Framework Denial of Service Vulnerability","Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 22H2 for 32-bit Systems","Microsoft","Important","Denial of Service","",
"20230214","CVE-2023-21722","5022728",".NET Framework Denial of Service Vulnerability","Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 22H2 for x64-based Systems","Microsoft","Important","Denial of Service","",

But the fact is:

• KB5022728 for 21H2
• KB5022729 for 22H2

You can also check out the MSRC Security Update Guide about CVE-2023-21722.

At the same time, some records are also duplicated:

L348961 & L348968
"20230214","CVE-2023-21722","5022728",".NET Framework Denial of Service Vulnerability","Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for 32-bit Systems","Microsoft","Important","Denial of Service","",

L348962 & L348969
"20230214","CVE-2023-21722","5022728",".NET Framework Denial of Service Vulnerability","Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for ARM64-based Systems","Microsoft","Important","Denial of Service","",