Clean up OVAL-sourced vulnerabilities reported on Amazon Linux 2 hosts prior to v4.56 (#30078)

Fixed #21947.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality

server/datastore/mysql/migrations/tables/20250616193950_DeleteOvalVulnerabilitiesOnAmazonLinuxHosts.go

@@ -0,0 +1,29 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20250616193950, Down_20250616193950)
+}
+
+func Up_20250616193950(tx *sql.Tx) error {
+	// source 2 is OVAL; as of v4.56.0 Fleet switched from (incorrect) RHEL 6 OVAL
+	// as a source for Amazon Linux 2 vuln data to ALAS via goval-dictionary, so
+	// OVAL vulns need to be purged for Amazon Linux packages
+	_, err := tx.Exec(`
+	 DELETE software_cve FROM software_cve JOIN software ON
+	        software.id = software_cve.software_id AND software.vendor = 'amazon linux' AND software_cve.source = 2
+	`)
+	if err != nil {
+		return fmt.Errorf("failed to clear Amazon Linux OVAL false-positives: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20250616193950(tx *sql.Tx) error {
+	return nil
+}

server/datastore/mysql/migrations/tables/20250616193950_DeleteOvalVulnerabilitiesOnAmazonLinuxHosts_test.go

@@ -0,0 +1,42 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20250616193950(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	amznSwID := execNoErrLastID(t, db, "INSERT INTO software (name, version, source, `release`, arch, vendor, checksum) VALUES (?, ?, ?, ?, ?, ?, ?)",
+		"libcom_err", "1.42.9", "rpm_packages", "19.amzn2.0.1", "x86_64", "Amazon Linux", "foo")
+
+	rhelSwID := execNoErrLastID(t, db, "INSERT INTO software (name, version, source, `release`, arch, checksum) VALUES (?, ?, ?, ?, ?, ?)",
+		"libcom_err", "1.42.9", "rpm_packages", "19.rhel2.0.1", "x86_64", "bar")
+
+	// false positive; OVAL on Amazon Linux
+	execNoErr(t, db, `INSERT INTO software_cve (cve, source, software_id)
+    	VALUES (?, ?, ?)`, "CVE-2019-5094", 2, amznSwID)
+
+	// true positive; Goval-Dictionary on Amazon Linux
+	execNoErr(t, db, `INSERT INTO software_cve (cve, source, software_id)
+    	VALUES (?, ?, ?)`, "CVE-2025-1337", 6, amznSwID)
+
+	// true positive; OVAL on RHEL
+	execNoErr(t, db, `INSERT INTO software_cve (cve, source, software_id)
+    	VALUES (?, ?, ?)`, "CVE-2019-5094", 2, rhelSwID)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	var cveID string
+
+	err := db.Get(&cveID, `SELECT cve FROM software_cve cve JOIN software sw ON cve.software_id = sw.id WHERE sw.id = ? ORDER BY cve ASC`, amznSwID)
+	require.NoError(t, err)
+	require.Equal(t, "CVE-2025-1337", cveID)
+
+	err = db.Get(&cveID, `SELECT cve FROM software_cve cve JOIN software sw ON cve.software_id = sw.id WHERE sw.id = ? ORDER BY cve ASC`, rhelSwID)
+	require.NoError(t, err)
+	require.Equal(t, "CVE-2019-5094", cveID)
+}