diff --git a/vulnerabilities/pipelines/v2_importers/archlinux_importer.py b/vulnerabilities/pipelines/v2_importers/archlinux_importer.py index 35f620e77..4c9953c6d 100644 --- a/vulnerabilities/pipelines/v2_importers/archlinux_importer.py +++ b/vulnerabilities/pipelines/v2_importers/archlinux_importer.py @@ -65,7 +65,11 @@ def parse_advisory(self, record) -> AdvisoryDataV2: summary = record.get("type", "") summary = "" if summary == "unknown" else summary - for name in record["packages"]: + packages = record["packages"] + if record.get("status") == "Not affected": + packages = [] + + for name in packages: affected = record.get("affected") fixed = record.get("fixed") diff --git a/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py b/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py index 20a578a31..85d0bbef1 100644 --- a/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py +++ b/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py @@ -28,3 +28,20 @@ def test_to_archlinux_advisories_v2(self): pipeline.response = data result = [adv.to_dict() for adv in pipeline.collect_advisories()] util_tests.check_results_against_json(result, expected_file) + + def test_not_affected_avg_has_no_affected_packages(self): + record = { + "name": "AVG-2737", + "packages": ["gnome-remote-desktop"], + "status": "Not affected", + "severity": "Unknown", + "type": "unknown", + "affected": "42.1-1", + "fixed": "42.1.1-1", + "ticket": None, + "issues": ["CVE-2022-1736"], + "advisories": [], + } + advisory = ArchLinuxImporterPipeline().parse_advisory(record) + self.assertEqual(advisory.affected_packages, []) + self.assertEqual(advisory.aliases, ["CVE-2022-1736"])