fix: do not generate CPEs for msrc-kb packages (#5510)

A msrc-kb package's name is an MSRC product ID and its version a KB
number, so the generic generator produced CPEs such as
cpe:2.3:a:12437:12437:935509:*:*:*:*:*:*:*. A KB is a patch rather than
a product and has no CPE representation; these packages are matched
against MSRC data by name and version. Skip generation for them, as is
already done for ML model packages. The dictionary lookup already
returns nothing for this type.

Signed-off-by: juanjsebgarcia <github@juangarcia.co.uk>

syft/pkg/cataloger/internal/cpegenerate/generate.go

@@ -141,9 +141,16 @@ func FromDictionaryFind(p pkg.Package) ([]cpe.CPE, bool) {
 // generate the minimal set of representative CPEs, which implies that optional fields should not be included
 // (such as target SW).
 func FromPackageAttributes(p pkg.Package) []cpe.CPE {
-	// ML models should not have CPEs as they are not traditional software packages
-	// and don't fit the vulnerability model used for software packages.
-	if p.Type == pkg.ModelPkg {
+	switch p.Type {
+	case pkg.KbPkg:
+		// Microsoft KB packages are patches, not products: the name is an MSRC product ID and the
+		// version a KB number, neither of which maps onto a CPE vendor, product or version. They are
+		// matched against MSRC data by name and version, so a generated CPE is only noise, and one
+		// that NVD-based matching could misread.
+		return nil
+	case pkg.ModelPkg:
+		// ML models should not have CPEs as they are not traditional software packages
+		// and don't fit the vulnerability model used for software packages.
 		return nil
 	}
 

syft/pkg/cataloger/internal/cpegenerate/generate_test.go

@@ -892,6 +892,16 @@ func TestGeneratePackageCPEs(t *testing.T) {
 			},
 			expected: []string{},
 		},
+		{
+			name: "Microsoft KB package should generate no CPEs",
+			p: pkg.Package{
+				Name:     "12437",
+				Version:  "935509",
+				Type:     pkg.KbPkg,
+				Metadata: pkg.MicrosoftKbPatch{ProductID: "12437", Kb: "935509"},
+			},
+			expected: []string{},
+		},
 		{
 			name: "rust package",
 			p: pkg.Package{