Fix non-Windows false positive for CVE-2024-6286 (#27325)

For #27193.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [ ] Manual QA for all new/changed functionality

changes/27193-false-positive

@@ -0,0 +1 @@
+* Fixed false positive for CVE-2024-6286 on non-Windows hosts.

server/vulnerabilities/nvd/cpe_matching_rules.go

@@ -259,10 +259,11 @@ func GetKnownNVDBugRules() (CPEMatchingRules, error) {
 			},
 			IgnoreAll: true,
 		},
-		// CVE-2024-4030 only targets windows operating systems
+		// CVE-2024-4030 and CVE-2024-6286 only target windows operating systems
 		CPEMatchingRule{
 			CVEs: map[string]struct{}{
 				"CVE-2024-4030": {},
+				"CVE-2024-6286": {},
 			},
 			IgnoreIf: func(cpeMeta *wfn.Attributes) bool {
 				return cpeMeta.TargetSW != "windows"

server/vulnerabilities/nvd/cve_test.go

@@ -339,6 +339,16 @@ func TestTranslateCPEToCVE(t *testing.T) {
 			excludedCVEs:      []string{"CVE-2011-5049"}, // OS vulnerability
 			continuesToUpdate: true,
 		},
+		"cpe:2.3:a:citrix:workspace:2309.0:*:*:*:*:macos:*:*": {
+			excludedCVEs:      []string{"CVE-2024-6286"},
+			continuesToUpdate: true,
+		},
+		"cpe:2.3:a:citrix:workspace:2309.0:*:*:*:*:windows:*:*": {
+			includedCVEs: []cve{
+				{ID: "CVE-2024-6286", resolvedInVersion: "2402"},
+			},
+			continuesToUpdate: true,
+		},
 		"cpe:2.3:a:python:python:3.9.6:*:*:*:*:macos:*:*": {
 			excludedCVEs:      []string{"CVE-2024-4030"},
 			continuesToUpdate: true,