fix: vuln correlation fixes

etc/test-data/cyclonedx/TC-5630/CVE-2026-12151.json

@@ -0,0 +1,75 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.1",
+    "cveMetadata": {
+        "cveId": "CVE-2026-12151",
+        "assignerOrgId": "00000000-0000-0000-0000-000000000000",
+        "state": "PUBLISHED",
+        "assignerShortName": "synthetic-test",
+        "dateReserved": "2026-01-01T00:00:00.000Z",
+        "datePublished": "2026-01-02T00:00:00.000Z",
+        "dateUpdated": "2026-01-03T00:00:00.000Z"
+    },
+    "containers": {
+        "cna": {
+            "affected": [
+                {
+                    "vendor": "redhat",
+                    "product": "hummingbird",
+                    "cpes": [
+                        "cpe:2.3:a:redhat:hummingbird:1:*:*:*:*:*:*:*"
+                    ],
+                    "defaultStatus": "affected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "SYNTHETIC TEST RECORD (not a real CVE): invented vulnerability used to exercise CPE-only (purl-less) node matching in trustify's test suite (TC-5630). Do not treat as real vulnerability data."
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "baseScore": 9.8,
+                        "baseSeverity": "CRITICAL",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH"
+                    }
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-000 Synthetic test weakness",
+                            "cweId": "CWE-000",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "providerMetadata": {
+                "orgId": "00000000-0000-0000-0000-000000000000",
+                "shortName": "synthetic-test",
+                "dateUpdated": "2026-01-03T00:00:00.000Z"
+            },
+            "references": [
+                {
+                    "url": "https://example.invalid/synthetic/CVE-2026-12151"
+                }
+            ],
+            "title": "Synthetic test record for purl-less CPE node matching"
+        }
+    }
+}
+

etc/test-data/cyclonedx/TC-5630/S3_wrongproduct_hummingbird_curl/README.md

@@ -0,0 +1,34 @@
+# S3 — Wrong-product / CPE-context not checked (TC-5171), hummingbird
+
+**Component:** `pkg:rpm/redhat/curl@7.61.1-34.el8_10.11` (RHEL 8 OS)
+**SBOM:** `sbom_curl_el8.cdx.json`
+
+## The bug (same root cause as S4: CPE context not checked)
+`hummingbird` (`cpe:/a:redhat:hummingbird:1`) is a real, *separate* Red Hat product that bundles
+curl. The engine attaches hummingbird advisories to the RHEL-8 OS curl by name, ignoring that the
+context CPE product is `hummingbird`, not `enterprise_linux`.
+
+## Two flavors here (hummingbird bundles the same libs as el8, so overlap is high)
+| CVE | el8-OS curl (VEX) | hummingbird | Verdict | Flavor |
+|---|---|---|---|---|
+| CVE-2025-10966 | known_not_affected | fixed | **not_affected** | **CLEAN** — whole CVE false (only hummingbird matches) |
+| CVE-2025-10148 | affected + not_affected (mixed) | fixed | affected via el8, but **hummingbird context is spurious** | duplicate-row |
+| CVE-2025-13034 | known_affected | fixed | affected via el8, but **hummingbird context is spurious** | duplicate-row |
+
+- **CLEAN:** el8 curl is `not_affected`; the CVE only appears because of the hummingbird row → should not appear at all.
+- **duplicate-row:** el8 curl is genuinely affected, so the CVE belongs — but reporting it under a
+  `hummingbird:1` context is a wrong-product mis-attribution (should be `enterprise_linux:8`).
+
+> Note: for a *whole-CVE-false* TC-5171 reproducer, **S4 (satellite / python3-chardet) is stronger** —
+> Satellite ships packages el8-OS doesn't track, so el8 is entirely absent. hummingbird overlaps el8's
+> core libraries, so most of its matches are duplicate rows rather than fully-false CVEs.
+
+## Files
+- `sbom_curl_el8.cdx.json` — upload.
+- `vex/` — the 3 canonical CSAF/VEX docs. `vex_extra/` — more curl/openssl/gnutls/python hummingbird CVEs.
+- `cve/` — CVE Project records.
+
+## Reproduce
+1. Ingest `vex/*.json`; 2. upload the SBOM; 3. `GET /sbom/{id}/advisory`.
+   BUG: curl shown `affected` under `cpe:/a:redhat:hummingbird:1`. Correct: CVE-2025-10966 absent; the
+   other two shown only under `enterprise_linux:8`, never hummingbird.

etc/test-data/cyclonedx/TC-5630/S3_wrongproduct_hummingbird_curl/cve/CVE-2025-10148.json

@@ -0,0 +1 @@
+{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-10148","assignerOrgId":"2499f714-1537-4658-8207-48ae4bb9eae9","state":"PUBLISHED","assignerShortName":"curl","dateReserved":"2025-09-09T03:45:41.908Z","datePublished":"2025-09-12T05:10:37.469Z","dateUpdated":"2025-11-18T20:05:32.822Z"},"containers":{"cna":{"title":"predictable WebSocket mask","descriptions":[{"lang":"en","value":"curl's websocket code did not update the 32 bit mask pattern for each new\n outgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."}],"providerMetadata":{"orgId":"2499f714-1537-4658-8207-48ae4bb9eae9","shortName":"curl","dateUpdated":"2025-09-12T05:10:37.469Z"},"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-340 Generation of Predictable Numbers or Identifiers"}]}],"affected":[{"vendor":"curl","product":"curl","versions":[{"version":"8.15.0","status":"affected","lessThanOrEqual":"8.15.0","versionType":"semver"},{"version":"8.14.1","status":"affected","lessThanOrEqual":"8.14.1","versionType":"semver"},{"version":"8.14.0","status":"affected","lessThanOrEqual":"8.14.0","versionType":"semver"},{"version":"8.13.0","status":"affected","lessThanOrEqual":"8.13.0","versionType":"semver"},{"version":"8.12.1","status":"affected","lessThanOrEqual":"8.12.1","versionType":"semver"},{"version":"8.12.0","status":"affected","lessThanOrEqual":"8.12.0","versionType":"semver"},{"version":"8.11.1","status":"affected","lessThanOrEqual":"8.11.1","versionType":"semver"},{"version":"8.11.0","status":"affected","lessThanOrEqual":"8.11.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"references":[{"url":"https://curl.se/docs/CVE-2025-10148.json","name":"json"},{"url":"https://curl.se/docs/CVE-2025-10148.html","name":"www"},{"url":"https://hackerone.com/reports/3330839","name":"issue"}],"credits":[{"lang":"en","value":"Calvin Ruocco (Vector Informatik GmbH)","type":"finder"},{"lang":"en","value":"Daniel Stenberg","type":"remediation developer"}]},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-09-12T17:16:46.486840Z","id":"CVE-2025-10148","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-09-12T17:17:12.815Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/09/10/2"},{"url":"http://www.openwall.com/lists/oss-security/2025/09/10/3"},{"url":"http://www.openwall.com/lists/oss-security/2025/09/10/4"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-18T20:05:32.822Z"}}]}}

etc/test-data/cyclonedx/TC-5630/S3_wrongproduct_hummingbird_curl/cve/CVE-2025-10966.json

@@ -0,0 +1 @@
+{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-10966","assignerOrgId":"2499f714-1537-4658-8207-48ae4bb9eae9","state":"PUBLISHED","assignerShortName":"curl","dateReserved":"2025-09-25T10:15:10.502Z","datePublished":"2025-11-07T07:26:30.351Z","dateUpdated":"2026-06-02T12:59:51.873Z"},"containers":{"cna":{"title":"missing SFTP host verification with wolfSSH","descriptions":[{"lang":"en","value":"curl's code for managing SSH connections when SFTP was done using the wolfSSH\npowered backend was flawed and missed host verification mechanisms.\n\nThis prevents curl from detecting MITM attackers and more."}],"providerMetadata":{"orgId":"2499f714-1537-4658-8207-48ae4bb9eae9","shortName":"curl","dateUpdated":"2025-11-07T07:26:30.351Z"},"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-322 Key Exchange without Entity Authentication"}]}],"affected":[{"vendor":"curl","product":"curl","versions":[{"version":"8.16.0","status":"affected","lessThanOrEqual":"8.16.0","versionType":"semver"},{"version":"8.15.0","status":"affected","lessThanOrEqual":"8.15.0","versionType":"semver"},{"version":"8.14.1","status":"affected","lessThanOrEqual":"8.14.1","versionType":"semver"},{"version":"8.14.0","status":"affected","lessThanOrEqual":"8.14.0","versionType":"semver"},{"version":"8.13.0","status":"affected","lessThanOrEqual":"8.13.0","versionType":"semver"},{"version":"8.12.1","status":"affected","lessThanOrEqual":"8.12.1","versionType":"semver"},{"version":"8.12.0","status":"affected","lessThanOrEqual":"8.12.0","versionType":"semver"},{"version":"8.11.1","status":"affected","lessThanOrEqual":"8.11.1","versionType":"semver"},{"version":"8.11.0","status":"affected","lessThanOrEqual":"8.11.0","versionType":"semver"},{"version":"8.10.1","status":"affected","lessThanOrEqual":"8.10.1","versionType":"semver"},{"version":"8.10.0","status":"affected","lessThanOrEqual":"8.10.0","versionType":"semver"},{"version":"8.9.1","status":"affected","lessThanOrEqual":"8.9.1","versionType":"semver"},{"version":"8.9.0","status":"affected","lessThanOrEqual":"8.9.0","versionType":"semver"},{"version":"8.8.0","status":"affected","lessThanOrEqual":"8.8.0","versionType":"semver"},{"version":"8.7.1","status":"affected","lessThanOrEqual":"8.7.1","versionType":"semver"},{"version":"8.7.0","status":"affected","lessThanOrEqual":"8.7.0","versionType":"semver"},{"version":"8.6.0","status":"affected","lessThanOrEqual":"8.6.0","versionType":"semver"},{"version":"8.5.0","status":"affected","lessThanOrEqual":"8.5.0","versionType":"semver"},{"version":"8.4.0","status":"affected","lessThanOrEqual":"8.4.0","versionType":"semver"},{"version":"8.3.0","status":"affected","lessThanOrEqual":"8.3.0","versionType":"semver"},{"version":"8.2.1","status":"affected","lessThanOrEqual":"8.2.1","versionType":"semver"},{"version":"8.2.0","status":"affected","lessThanOrEqual":"8.2.0","versionType":"semver"},{"version":"8.1.2","status":"affected","lessThanOrEqual":"8.1.2","versionType":"semver"},{"version":"8.1.1","status":"affected","lessThanOrEqual":"8.1.1","versionType":"semver"},{"version":"8.1.0","status":"affected","lessThanOrEqual":"8.1.0","versionType":"semver"},{"version":"8.0.1","status":"affected","lessThanOrEqual":"8.0.1","versionType":"semver"},{"version":"8.0.0","status":"affected","lessThanOrEqual":"8.0.0","versionType":"semver"},{"version":"7.88.1","status":"affected","lessThanOrEqual":"7.88.1","versionType":"semver"},{"version":"7.88.0","status":"affected","lessThanOrEqual":"7.88.0","versionType":"semver"},{"version":"7.87.0","status":"affected","lessThanOrEqual":"7.87.0","versionType":"semver"},{"version":"7.86.0","status":"affected","lessThanOrEqual":"7.86.0","versionType":"semver"},{"version":"7.85.0","status":"affected","lessThanOrEqual":"7.85.0","versionType":"semver"},{"version":"7.84.0","status":"affected","lessThanOrEqual":"7.84.0","versionType":"semver"},{"version":"7.83.1","status":"affected","lessThanOrEqual":"7.83.1","versionType":"semver"},{"version":"7.83.0","status":"affected","lessThanOrEqual":"7.83.0","versionType":"semver"},{"version":"7.82.0","status":"affected","lessThanOrEqual":"7.82.0","versionType":"semver"},{"version":"7.81.0","status":"affected","lessThanOrEqual":"7.81.0","versionType":"semver"},{"version":"7.80.0","status":"affected","lessThanOrEqual":"7.80.0","versionType":"semver"},{"version":"7.79.1","status":"affected","lessThanOrEqual":"7.79.1","versionType":"semver"},{"version":"7.79.0","status":"affected","lessThanOrEqual":"7.79.0","versionType":"semver"},{"version":"7.78.0","status":"affected","lessThanOrEqual":"7.78.0","versionType":"semver"},{"version":"7.77.0","status":"affected","lessThanOrEqual":"7.77.0","versionType":"semver"},{"version":"7.76.1","status":"affected","lessThanOrEqual":"7.76.1","versionType":"semver"},{"version":"7.76.0","status":"affected","lessThanOrEqual":"7.76.0","versionType":"semver"},{"version":"7.75.0","status":"affected","lessThanOrEqual":"7.75.0","versionType":"semver"},{"version":"7.74.0","status":"affected","lessThanOrEqual":"7.74.0","versionType":"semver"},{"version":"7.73.0","status":"affected","lessThanOrEqual":"7.73.0","versionType":"semver"},{"version":"7.72.0","status":"affected","lessThanOrEqual":"7.72.0","versionType":"semver"},{"version":"7.71.1","status":"affected","lessThanOrEqual":"7.71.1","versionType":"semver"},{"version":"7.71.0","status":"affected","lessThanOrEqual":"7.71.0","versionType":"semver"},{"version":"7.70.0","status":"affected","lessThanOrEqual":"7.70.0","versionType":"semver"},{"version":"7.69.1","status":"affected","lessThanOrEqual":"7.69.1","versionType":"semver"},{"version":"7.69.0","status":"affected","lessThanOrEqual":"7.69.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"references":[{"url":"https://curl.se/docs/CVE-2025-10966.json","name":"json"},{"url":"https://curl.se/docs/CVE-2025-10966.html","name":"www"},{"url":"https://hackerone.com/reports/3355218","name":"issue"}],"credits":[{"lang":"en","value":"Stanislav Fort (Aisle Research)","type":"finder"},{"lang":"en","value":"Daniel Stenberg","type":"remediation developer"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/11/05/2"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-07T08:05:50.150Z"}},{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-11-10T20:26:03.531168Z","id":"CVE-2025-10966","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-11-10T20:26:07.282Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-06-02T12:59:51.873Z"},"affected":[{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","versions":[{"status":"affected","version":"0","lessThan":"V4.0","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}]}]}}

etc/test-data/cyclonedx/TC-5630/S3_wrongproduct_hummingbird_curl/cve/CVE-2025-13034.json

@@ -0,0 +1 @@
+{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-13034","assignerOrgId":"2499f714-1537-4658-8207-48ae4bb9eae9","state":"PUBLISHED","assignerShortName":"curl","dateReserved":"2025-11-11T16:52:22.121Z","datePublished":"2026-01-08T10:00:25.773Z","dateUpdated":"2026-01-08T14:58:20.565Z"},"containers":{"cna":{"title":"No QUIC certificate pinning with GnuTLS","descriptions":[{"lang":"en","value":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool,curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."}],"providerMetadata":{"orgId":"2499f714-1537-4658-8207-48ae4bb9eae9","shortName":"curl","dateUpdated":"2026-01-08T10:00:25.773Z"},"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-295 Improper Certificate Validation"}]}],"affected":[{"vendor":"curl","product":"curl","versions":[{"version":"8.17.0","status":"affected","lessThanOrEqual":"8.17.0","versionType":"semver"},{"version":"8.16.0","status":"affected","lessThanOrEqual":"8.16.0","versionType":"semver"},{"version":"8.15.0","status":"affected","lessThanOrEqual":"8.15.0","versionType":"semver"},{"version":"8.14.1","status":"affected","lessThanOrEqual":"8.14.1","versionType":"semver"},{"version":"8.14.0","status":"affected","lessThanOrEqual":"8.14.0","versionType":"semver"},{"version":"8.13.0","status":"affected","lessThanOrEqual":"8.13.0","versionType":"semver"},{"version":"8.12.1","status":"affected","lessThanOrEqual":"8.12.1","versionType":"semver"},{"version":"8.12.0","status":"affected","lessThanOrEqual":"8.12.0","versionType":"semver"},{"version":"8.11.1","status":"affected","lessThanOrEqual":"8.11.1","versionType":"semver"},{"version":"8.11.0","status":"affected","lessThanOrEqual":"8.11.0","versionType":"semver"},{"version":"8.10.1","status":"affected","lessThanOrEqual":"8.10.1","versionType":"semver"},{"version":"8.10.0","status":"affected","lessThanOrEqual":"8.10.0","versionType":"semver"},{"version":"8.9.1","status":"affected","lessThanOrEqual":"8.9.1","versionType":"semver"},{"version":"8.9.0","status":"affected","lessThanOrEqual":"8.9.0","versionType":"semver"},{"version":"8.8.0","status":"affected","lessThanOrEqual":"8.8.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"references":[{"url":"https://curl.se/docs/CVE-2025-13034.json","name":"json"},{"url":"https://curl.se/docs/CVE-2025-13034.html","name":"www"}],"credits":[{"lang":"en","value":"Stanislav Fort (Aisle Research)","type":"finder"},{"lang":"en","value":"Daniel Stenberg","type":"remediation developer"}]},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-295","lang":"en","description":"CWE-295 Improper Certificate Validation"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-01-08T14:56:11.206224Z","id":"CVE-2025-13034","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-01-08T14:58:20.565Z"}}]}}