[Git][security-tracker-team/security-tracker][master] 2 commits: check-new-issues: handle CVEs with multiple products

[Emilio Pozuelo Monfort (@pochu)]

Emilio Pozuelo Monfort pushed to branch master at Debian Security Tracker / security-tracker


Commits:
97272228 by Emilio Pozuelo Monfort at 2026-09-28T23:44:11+02:00
check-new-issues: handle CVEs with multiple products

We return NFU if all products are detected as NFU within the same
top-level rule.

Fixes: #57

- - - - -
e45cd3ac by Emilio Pozuelo Monfort at 2026-09-28T23:44:11+02:00
check-new-issues: return early when possible

- - - - -


1 changed file:

- bin/check-new-issues


Changes:

=====================================
bin/check-new-issues
=====================================
@@ -197,30 +197,27 @@ def parse_not_for_us(auto_nfu_file):
     with open(auto_nfu_file) as f:
         return yaml.full_load(f)
 
-def nfu_entry_matches(nfu_entry, cve5):
+def nfu_entry_matches(nfu_entry, cve5, cve5_product=None):
     if 'not' in nfu_entry:
         subentry = nfu_entry['not']
-        return not nfu_entry_matches(subentry, cve5)
+        return not nfu_entry_matches(subentry, cve5, cve5_product)
     elif 'anyOf' in nfu_entry:
-        result = False
         for subentry in nfu_entry['anyOf']:
-            result |= nfu_entry_matches(subentry, cve5)
-        return result
+            if nfu_entry_matches(subentry, cve5, cve5_product):
+                return True
+        return False
     elif 'allOf' in nfu_entry:
-        result = True
         for subentry in nfu_entry['allOf']:
-            result &= nfu_entry_matches(subentry, cve5)
-        return result
+            if not nfu_entry_matches(subentry, cve5, cve5_product):
+                return False
+        return True
 
     cna_name = cve5['containers']['cna']['providerMetadata']['shortName']
     if 'cna' in nfu_entry and nfu_entry['cna'] == cna_name:
         return True
 
-    if 'affected' in cve5['containers']['cna']:
-        products = [ affected['product'] for affected in cve5['containers']['cna']['affected'] if 'product' in affected ]
-        # only mark it if there's a single product, in case the CVE affects various
-        # projects and one of the others applies to us
-        if 'product' in nfu_entry and len(products) == 1 and re.fullmatch(nfu_entry['product'], products[0]):
+    if 'product' in nfu_entry:
+        if cve5_product and re.fullmatch(nfu_entry['product'], cve5_product):
             return True
 
     if 'title' in nfu_entry:
@@ -239,9 +236,20 @@ def auto_nfu(name, nfu_entries):
     debug(f'checking nfu for {name}')
     cve5 = get_cve5(name)
 
+    cve5_products = [ affected['product'] for affected in cve5['containers']['cna']['affected'] if 'product' in affected ]
+
     for nfu_entry in nfu_entries:
-        if nfu_entry_matches(nfu_entry, cve5):
-            return nfu_entry['reason']
+        if len(cve5_products) == 0:
+            if nfu_entry_matches(nfu_entry, cve5):
+                return nfu_entry['reason']
+        else:
+            # in case there are multiple products, we only return NFU if all
+            # of them are NFU
+            ret = True
+            for cve5_product in cve5_products:
+                ret &= nfu_entry_matches(nfu_entry, cve5, cve5_product)
+            if ret:
+                return nfu_entry['reason']
 
     return None
 



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/0688c0debdef7b42c0af31c61f27dfafb34571c2...e45cd3ace66a7506fd2201582bde8c14ac1b76a3

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/0688c0debdef7b42c0af31c61f27dfafb34571c2...e45cd3ace66a7506fd2201582bde8c14ac1b76a3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260928/e003c14c/attachment-0001.htm>