Merge ubuntu-security-tools:umt-upload-cve-detection into ubuntu-security-tools:master

[Mike Salvatore]

When performing a fakesync of netqmail, the changelog entry from debian looked like:

  * Address CVE-2005-1513, CVE-2005-1514, CVE-2005-1515, CVE-2020-3811 and
    CVE-2020-3812 (Closes: #961060)

The current code only finds CVE-2005-1513 and CVE-2020-3812. The other 3 CVEs are not detected. This change enables umt to detect CVEs in changelogs like the above.

diff --git a/build-tools/umt b/build-tools/umt
index fc1382d..653d709 100755
--- a/build-tools/umt
+++ b/build-tools/umt
@@ -2930,10 +2930,9 @@ def parse_changes_file(changes_file):
                 details['distribution'] = line.strip().split()[1]
                 details['pocket'] = 'release'
         else:
-            match = re.search(r'\bCVE-[0-9]{4}-[0-9]+\b', line)
-            if match is not None:
-                cve = match.group(0)
-                details['cves'].add(cve)
+            cves = re.findall(r'\bCVE-[0-9]{4}-[0-9]+\b', line)
+            if cves:
+                details['cves'].update(set(cves))
 
     # Handle epoch
     if ':' in details['version']: