Closes#43328
## Summary
- On Ubuntu/Debian/RHEL, `pythonPackageFilter` in osquery.go prepends
`python3-` to Python package names (e.g., `geopandas` becomes
`python3-geopandas`) to match OVAL definitions
- However, the CPE database uses the bare package name (e.g.,
`geopandas`, not `python3-geopandas`), so CPE matching fails and no
vulnerabilities are reported
- This fix adds the stripped name (without `python3-` prefix) as an
additional product variation during CPE lookup, so both
`python3-geopandas` and `geopandas` are tried
- The original prefixed name is preserved so packages genuinely named
`python3-*` on PyPI (e.g., `python3-openid`, `python3-saml`) still match
correctly on non-Ubuntu platforms
## How I reproduced
Used the `nvdvuln` tool to simulate CPE matching:
**Before fix** (on main branch):
```
$ go run --tags=fts5 tools/nvd/nvdvuln/nvdvuln.go \
--software_name python3-geopandas \
--software_source python_packages \
--software_version 1.0.1
Translating software to CPE...
Unable to match a CPE for the software...
```
**After fix:**
```
$ go run --tags=fts5 tools/nvd/nvdvuln/nvdvuln.go \
--software_name python3-geopandas \
--software_source python_packages \
--software_version 1.0.1
Translating software to CPE...
Matched CPE: 0: cpe:2.3:a:geopandas:geopandas:1.0.1:*:*:*:*:python:*:*
Translating CPEs to CVEs...
CVEs found for python3-geopandas (1.0.1): CVE-2025-69662
```
Also verified with `python3-django` (version 3.2.12) -- correctly finds
CVE-2024-24680 and other CVEs.
## How I tested
- Unit tests: added test cases for `productVariations` covering:
- `python3-geopandas` (source: `python_packages`) -> produces both
`python3-geopandas` and `geopandas` variations
- `python3-django` (source: `python_packages`) -> produces both
`python3-django` and `django` variations
- `requests` (source: `python_packages`, no prefix) -> no extra
variations added
- Manual: ran `nvdvuln` tool for both packages from the issue, confirmed
CPE match and CVE detection
- Lint: `make lint-go-incremental` passes clean
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved vulnerability detection for Python packages on Ubuntu/Debian
by handling package names with or without the `python3-` prefix.
* Added additional matching variations derived from sanitized names,
ensuring both full and stripped forms are considered.
* Ensured existing non-Python package matching behavior remains
unchanged.
* **Tests**
* Expanded NVD sanitization and product variation test coverage for
`python_packages` scenarios (including cases with and without the
`python3-` prefix).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
