From 8ef3ff2ae56e84b09e69d203ddc1354ab3fc9726 Mon Sep 17 00:00:00 2001
From: Ian Littman <iansltx@gmail.com>
Date: Thu, 20 Mar 2025 09:21:42 -0500
Subject: [PATCH] Fix non-Windows false positive for CVE-2024-6286 (#27325)

For #27193.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [ ] Manual QA for all new/changed functionality
---
 changes/27193-false-positive                     |  1 +
 server/vulnerabilities/nvd/cpe_matching_rules.go |  3 ++-
 server/vulnerabilities/nvd/cve_test.go           | 10 ++++++++++
 3 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 changes/27193-false-positive

diff --git a/changes/27193-false-positive b/changes/27193-false-positive
new file mode 100644
index 0000000000..e407f56ec8
--- /dev/null
+++ b/changes/27193-false-positive
@@ -0,0 +1 @@
+* Fixed false positive for CVE-2024-6286 on non-Windows hosts.
diff --git a/server/vulnerabilities/nvd/cpe_matching_rules.go b/server/vulnerabilities/nvd/cpe_matching_rules.go
index f655b2c8c7..cd515899c4 100644
--- a/server/vulnerabilities/nvd/cpe_matching_rules.go
+++ b/server/vulnerabilities/nvd/cpe_matching_rules.go
@@ -259,10 +259,11 @@ func GetKnownNVDBugRules() (CPEMatchingRules, error) {
 			},
 			IgnoreAll: true,
 		},
-		// CVE-2024-4030 only targets windows operating systems
+		// CVE-2024-4030 and CVE-2024-6286 only target windows operating systems
 		CPEMatchingRule{
 			CVEs: map[string]struct{}{
 				"CVE-2024-4030": {},
+				"CVE-2024-6286": {},
 			},
 			IgnoreIf: func(cpeMeta *wfn.Attributes) bool {
 				return cpeMeta.TargetSW != "windows"
diff --git a/server/vulnerabilities/nvd/cve_test.go b/server/vulnerabilities/nvd/cve_test.go
index e3f1c47252..1466f19c0e 100644
--- a/server/vulnerabilities/nvd/cve_test.go
+++ b/server/vulnerabilities/nvd/cve_test.go
@@ -339,6 +339,16 @@ func TestTranslateCPEToCVE(t *testing.T) {
 			excludedCVEs:      []string{"CVE-2011-5049"}, // OS vulnerability
 			continuesToUpdate: true,
 		},
+		"cpe:2.3:a:citrix:workspace:2309.0:*:*:*:*:macos:*:*": {
+			excludedCVEs:      []string{"CVE-2024-6286"},
+			continuesToUpdate: true,
+		},
+		"cpe:2.3:a:citrix:workspace:2309.0:*:*:*:*:windows:*:*": {
+			includedCVEs: []cve{
+				{ID: "CVE-2024-6286", resolvedInVersion: "2402"},
+			},
+			continuesToUpdate: true,
+		},
 		"cpe:2.3:a:python:python:3.9.6:*:*:*:*:macos:*:*": {
 			excludedCVEs:      []string{"CVE-2024-4030"},
 			continuesToUpdate: true,