Merge ~ebarretto/ubuntu-cve-tracker:oval-bugs into ubuntu-cve-tracker:master

[Eduardo Barretto]

Currently we handle `pending (<version>)` status as fixed, because there's a version to compare against, even though that fixed version is still not available to customers.
That usually works fine, but we realized that for kernel, the main "user" of `pending (<version>)` status that creates some issues, where for OCI based OVAL it can get tricky to match the kernel binary name.
Since `pending` status will report vulnerable anyway as the fixed version is not yet public, I'm proposing handling `pending` as vulnerable by default instead of fixing the name match.

A current example can be found today in id `2021448790000000` for OCI CVE-based OVAL for focal.
You can see that the fixed version is: 0:5.4.0-173.191 but the package being retrieved from the cache and trying to match against installed versions is: `^linux-image-(?:unsigned-)?5.3.0-\d+(?:-generic|-generic-lpae|-lowlatency|-snapdragon)(?::\w+|)\s+(.*)$`

That's because we default to getting the earliest version of such package if a version is not found in the cache, but since the kernel has the version in the binary name, that makes things tricky.

We will do a second separate check to see if that is currently happening for any other CVE that is not in `pending` status.

[David Fernandez Gonzalez (litios)]

LGTM!

review: Approve

diff --git a/scripts/oval_lib.py b/scripts/oval_lib.py
index ac55286..48916a8 100755
--- a/scripts/oval_lib.py
+++ b/scripts/oval_lib.py
@@ -254,15 +254,12 @@ class CVEPkgRelEntry:
         elif code == 'pending':
             # pending means that packages have been prepared and are in
             # -proposed or in a ppa somewhere, and should have a version
-            # attached. If there is a version, test for package existence
-            # with that version, otherwise mark as vulnerable
-            if fix_version:
-                status['status'] = 'fixed'
-                status['note'] = " package in {0} is affected. An update containing the fix has been completed and is pending publication{1}".format(release, note_end)
-                status['fix-version'] = fix_version
-            else:
-                status['status'] = 'vulnerable'
-                status['note'] = " package in {0} is affected. An update containing the fix has been completed and is pending publication{1}".format(release, note_end)
+            # attached. If there is a version, we could test for package
+            # existence with that version, but since that could mean
+            # different binary names (e.g. kernel binaries), therefore
+            # it is better to just treat it vulnerable
+            status['status'] = 'vulnerable'
+            status['note'] = " package in {0} is affected. An update containing the fix has been completed and is pending publication{1}".format(release, note_end)
         elif code == 'deferred':
             status['status'] = 'vulnerable'
             status['note'] = " package in {0} is affected, but a decision has been made to defer addressing it{1}".format(release, note_end)