Summary
The VersionMatches filter on the get_product_statuses_for_purl function compares package versions against product stream version ranges (derived from CPE versions), which are incompatible version domains. This causes legitimate vulnerability correlations to be silently dropped.
Example: keycloak-core@18.0.6.redhat-00001 is compared against Quarkus product stream range [2.0.0, 3.0.0) (from CPE cpe:/a:redhat:quarkus:2). Since 18 > 3 in RPM versioning, the filter returns FALSE and drops CVE-2023-1664.
Fix
Remove the VersionMatches filter from the product_status query path in modules/fundamental/src/purl/model/details/purl.rs. The filter at line 154 on the purl_statuses query is correct and stays — it compares package versions against package version ranges.
Precedent: PR #2523 already performed the same removal on the parallel product_status query in modules/fundamental/src/vulnerability/service/mod.rs.
Jira
TC-5403 / TC-5406
Summary
The
VersionMatchesfilter on theget_product_statuses_for_purlfunction compares package versions against product stream version ranges (derived from CPE versions), which are incompatible version domains. This causes legitimate vulnerability correlations to be silently dropped.Example:
keycloak-core@18.0.6.redhat-00001is compared against Quarkus product stream range[2.0.0, 3.0.0)(from CPEcpe:/a:redhat:quarkus:2). Since18 > 3in RPM versioning, the filter returns FALSE and drops CVE-2023-1664.Fix
Remove the
VersionMatchesfilter from the product_status query path inmodules/fundamental/src/purl/model/details/purl.rs. The filter at line 154 on thepurl_statusesquery is correct and stays — it compares package versions against package version ranges.Precedent: PR #2523 already performed the same removal on the parallel product_status query in
modules/fundamental/src/vulnerability/service/mod.rs.Jira
TC-5403 / TC-5406