**Related issue:** Resolves#35148
## What was added
| CVE | Rule | Reason |
|-----|------|--------|
| **CVE-2017-17522** | `IgnoreAll` | DISPUTED by Python maintainers; not
exploitable (`webbrowser.py` uses `subprocess.Popen` with
`shell=False`). Broad NVD CPE matched modern Python. |
| **CVE-2023-36632** | `IgnoreAll` | NVD-DISPUTED — Python states it's
"neither a vulnerability nor a bug" (intentional `RecursionError` in
`email.utils.parseaddr`). |
| **CVE-2024-3219** | `IgnoreIf target_sw != "windows"` | Only affects
platforms lacking AF_UNIX (Windows). Linux/macOS unaffected, but
NVD/VulnCheck CPE uses `target_sw=*`. |
**Files touched:**
- `cpe_matching_rules.go` — three new rules
- `cpe_matching_rule_test.go` — assertions covering all three (incl.
Windows-vs-macOS/Linux distinction for CVE-2024-3219)
- `changes/35148-python-cve-false-positives` — changelog
**Correctness note:** `target_sw` derives from software *source*
(`apps`/`homebrew_packages` → `macos`, `programs` → `windows`), so the
CVE-2024-3219 rule suppresses on macOS while preserving the genuine
Windows
positive.
## What was skipped, and why
| CVE | Why skipped |
|-----|-------------|
| **CVE-2024-12718** | Conflicting evidence: getvictor confirmed it's a
**true positive** (3.9.22 < fixed 3.9.23), contradicting the customer's
"only 3.12+ affected" reasoning. Needs a product/security ruling, not a
code change. |
| **CVE-2025-1795** | Likely a VulnCheck patch-level miss (customer says
3.10.17 has the backported fix). Needs the actual VulnCheck version
range to fix safely. |
| **CVE-2023-32681** | Affects `python:requests` and is **correctly
matched**; the customer dismissed it on deployment grounds ("corporate
servers only"). Not a detection bug. |
| **CVE-2007-4559** | Real tarfile path-traversal (CVSS 9.8, **not
disputed**); the customer labeled it "Other issue," not a false
positive. Suppressing it would hide a genuine vulnerability. |
Dante Catalfamo
e90bcfeaae