Sharon KatzandClaude Opus 4.6
a1531e6752
Closes #43328 ## Summary - On Ubuntu/Debian/RHEL, `pythonPackageFilter` in osquery.go prepends `python3-` to Python package names (e.g., `geopandas` becomes `python3-geopandas`) to match OVAL definitions - However, the CPE database uses the bare package name (e.g., `geopandas`, not `python3-geopandas`), so CPE matching fails and no vulnerabilities are reported - This fix adds the stripped name (without `python3-` prefix) as an additional product variation during CPE lookup, so both `python3-geopandas` and `geopandas` are tried - The original prefixed name is preserved so packages genuinely named `python3-*` on PyPI (e.g., `python3-openid`, `python3-saml`) still match correctly on non-Ubuntu platforms ## How I reproduced Used the `nvdvuln` tool to simulate CPE matching: **Before fix** (on main branch): ``` $ go run --tags=fts5 tools/nvd/nvdvuln/nvdvuln.go \ --software_name python3-geopandas \ --software_source python_packages \ --software_version 1.0.1 Translating software to CPE... Unable to match a CPE for the software... ``` **After fix:** ``` $ go run --tags=fts5 tools/nvd/nvdvuln/nvdvuln.go \ --software_name python3-geopandas \ --software_source python_packages \ --software_version 1.0.1 Translating software to CPE... Matched CPE: 0: cpe:2.3:a:geopandas:geopandas:1.0.1:*:*:*:*:python:*:* Translating CPEs to CVEs... CVEs found for python3-geopandas (1.0.1): CVE-2025-69662 ``` Also verified with `python3-django` (version 3.2.12) -- correctly finds CVE-2024-24680 and other CVEs. ## How I tested - Unit tests: added test cases for `productVariations` covering: - `python3-geopandas` (source: `python_packages`) -> produces both `python3-geopandas` and `geopandas` variations - `python3-django` (source: `python_packages`) -> produces both `python3-django` and `django` variations - `requests` (source: `python_packages`, no prefix) -> no extra variations added - Manual: ran `nvdvuln` tool for both packages from the issue, confirmed CPE match and CVE detection - Lint: `make lint-go-incremental` passes clean 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved vulnerability detection for Python packages on Ubuntu/Debian by handling package names with or without the `python3-` prefix. * Added additional matching variations derived from sanitized names, ensuring both full and stripped forms are considered. * Ensured existing non-Python package matching behavior remains unchanged. * **Tests** * Expanded NVD sanitization and product variation test coverage for `python_packages` scenarios (including cases with and without the `python3-` prefix). <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2 lines
138 B
Plaintext
2 lines
138 B
Plaintext
- Fixed vulnerability detection for Python packages on Ubuntu/Debian devices by stripping the "python3-" name prefix during CPE matching.
|