Fix vulnerability report in fleetdm/fleet and properly fix in fleetdm… (#33026)

security/status.md

@@ -25,7 +25,7 @@ Following is the vulnerability report of Fleet and its dependencies.
 #### Statement:
 - **Author:** @lucasmrod
 - **Status:** `fixed`
-- **Products:**: `cpe:2.3:a:fleetdm:fleet:v4.64.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.63.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.62.4:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.58.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.53.2:*:*:*:*:*:*:*`
+- **Products:**: `pkg:golang/github.com/fleetdm/fleet/v4`,`cpe:2.3:a:fleetdm:fleet:v4.64.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.63.2:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.62.4:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.58.1:*:*:*:*:*:*:*`,`cpe:2.3:a:fleetdm:fleet:v4.53.2:*:*:*:*:*:*:*`
 - **Timestamp:** 2025-05-12 16:30:30
 
 #### Statement:
@@ -145,7 +145,7 @@ Following is the vulnerability report of Fleet and its dependencies.
 - **Author:** @lucasmrod
 - **Status:** `not_affected`
 - **Status notes:** This vulnerability affected fleet, not fleetctl, adding it here to avoid false positives.
-- **Products:**: `fleetctl`,`pkg:github.com/fleetdm/fleet/v4`
+- **Products:**: `fleetctl`,`pkg:golang/github.com/fleetdm/fleet/v4`
 - **Justification:** `component_not_present`
 - **Timestamp:** 2025-09-12 09:25:41
 

security/vex/fleet/CVE-2025-27509.vex.json

@@ -482,6 +482,9 @@
       },
       "timestamp": "2025-05-12T16:30:30.682721-03:00",
       "products": [
+        {
+          "@id": "pkg:golang/github.com/fleetdm/fleet/v4"
+        },
         {
           "@id": "cpe:2.3:a:fleetdm:fleet:v4.64.2:*:*:*:*:*:*:*"
         },

security/vex/fleetctl/CVE-2025-27509.vex.json

@@ -15,7 +15,7 @@
           "@id": "fleetctl"
         },
         {
-          "@id": "pkg:github.com/fleetdm/fleet/v4"
+          "@id": "pkg:golang/github.com/fleetdm/fleet/v4"
         }
       ],
       "status": "not_affected",