From 5ec416cb24f0cea1a2ece3dbbc35d919e5834169 Mon Sep 17 00:00:00 2001 From: Juan Date: Mon, 2 Nov 2026 20:52:38 +0000 Subject: [PATCH] fix: do not generate CPEs for msrc-kb packages (#5510) A msrc-kb package's name is an MSRC product ID and its version a KB number, so the generic generator produced CPEs such as cpe:2.3:a:12437:12437:935509:*:*:*:*:*:*:*. A KB is a patch rather than a product and has no CPE representation; these packages are matched against MSRC data by name and version. Skip generation for them, as is already done for ML model packages. The dictionary lookup already returns nothing for this type. Signed-off-by: juanjsebgarcia --- syft/pkg/cataloger/internal/cpegenerate/generate.go | 13 ++++++++++--- .../cataloger/internal/cpegenerate/generate_test.go | 10 ++++++++++ 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/syft/pkg/cataloger/internal/cpegenerate/generate.go b/syft/pkg/cataloger/internal/cpegenerate/generate.go index 8f500ba6e..ae03cabe7 100644 --- a/syft/pkg/cataloger/internal/cpegenerate/generate.go +++ b/syft/pkg/cataloger/internal/cpegenerate/generate.go @@ -141,9 +141,16 @@ func FromDictionaryFind(p pkg.Package) ([]cpe.CPE, bool) { // generate the minimal set of representative CPEs, which implies that optional fields should not be included // (such as target SW). func FromPackageAttributes(p pkg.Package) []cpe.CPE { - // ML models should not have CPEs as they are not traditional software packages - // and don't fit the vulnerability model used for software packages. - if p.Type == pkg.ModelPkg { + switch p.Type { + case pkg.KbPkg: + // Microsoft KB packages are patches, not products: the name is an MSRC product ID and the + // version a KB number, neither of which maps onto a CPE vendor, product or version. They are + // matched against MSRC data by name and version, so a generated CPE is only noise, and one + // that NVD-based matching could misread. + return nil + case pkg.ModelPkg: + // ML models should not have CPEs as they are not traditional software packages + // and don't fit the vulnerability model used for software packages. return nil } diff --git a/syft/pkg/cataloger/internal/cpegenerate/generate_test.go b/syft/pkg/cataloger/internal/cpegenerate/generate_test.go index ae03d205b..4b849a709 100644 --- a/syft/pkg/cataloger/internal/cpegenerate/generate_test.go +++ b/syft/pkg/cataloger/internal/cpegenerate/generate_test.go @@ -892,6 +892,16 @@ func TestGeneratePackageCPEs(t *testing.T) { }, expected: []string{}, }, + { + name: "Microsoft KB package should generate no CPEs", + p: pkg.Package{ + Name: "12437", + Version: "935509", + Type: pkg.KbPkg, + Metadata: pkg.MicrosoftKbPatch{ProductID: "12437", Kb: "935509"}, + }, + expected: []string{}, + }, { name: "rust package", p: pkg.Package{