From 8407aefc73c9da4c01c5d045b50110cee4345cec Mon Sep 17 00:00:00 2001
From: Jahziel Villasana-Espinoza <jahziel@fleetdm.com>
Date: Thu, 16 Jan 2025 20:17:10 -0500
Subject: [PATCH] fix: add translation for iterm2 (#25477)

> For #25130

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
---
 changes/25130-iterm-false-neg                    |  1 +
 server/vulnerabilities/nvd/cpe_translations.json | 12 +++++++++++-
 server/vulnerabilities/nvd/cve_test.go           |  3 +++
 3 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 changes/25130-iterm-false-neg

diff --git a/changes/25130-iterm-false-neg b/changes/25130-iterm-false-neg
new file mode 100644
index 0000000000..f144429237
--- /dev/null
+++ b/changes/25130-iterm-false-neg
@@ -0,0 +1 @@
+- Fixed a false negative vulnerability reporting for iTerm2 (available to all recent Fleet releases as of January 17th via a vulnerability feed update)
\ No newline at end of file
diff --git a/server/vulnerabilities/nvd/cpe_translations.json b/server/vulnerabilities/nvd/cpe_translations.json
index d5a90b97a3..b388140b92 100644
--- a/server/vulnerabilities/nvd/cpe_translations.json
+++ b/server/vulnerabilities/nvd/cpe_translations.json
@@ -545,5 +545,15 @@
       "product": ["cli"],
       "vendor": ["github"]
     }
+  },
+  {
+    "software": {
+      "bundle_identifier": ["/^com\\.googlecode\\.iterm2/"],
+      "source": ["apps"]
+    },
+    "filter": {
+      "product": ["iterm2"],
+      "vendor": ["iterm2"]
+    }
   }
-]
\ No newline at end of file
+]
diff --git a/server/vulnerabilities/nvd/cve_test.go b/server/vulnerabilities/nvd/cve_test.go
index 60fe0547ad..d5c070afe7 100644
--- a/server/vulnerabilities/nvd/cve_test.go
+++ b/server/vulnerabilities/nvd/cve_test.go
@@ -375,6 +375,9 @@ func TestTranslateCPEToCVE(t *testing.T) {
 			excludedCVEs:      []string{"CVE-2024-37051"},
 			continuesToUpdate: true,
 		},
+		"cpe:2.3:a:iterm2:iterm2:3.5.2:*:*:*:*:*:*:*": {
+			includedCVEs: []cve{{ID: "CVE-2024-38395", resolvedInVersion: ""}},
+		},
 	}
 
 	cveOSTests := []struct {