From 5e34d4f6a49454cabc109f4849f5fb32d2945e3d Mon Sep 17 00:00:00 2001 From: Sahil Lenka Date: Thu, 1 Oct 2026 11:44:51 +0530 Subject: [PATCH] fix: skip affected packages for "Not affected" Arch Linux AVGs The Arch importer never looked at the AVG status, so records marked "Not affected" were imported as affecting the listed packages. For example AVG-2737 showed gnome-remote-desktop 42.1-1 as affected. Keep the advisory so its aliases and references are still recorded, but do not attach any affected packages to it. Signed-off-by: Sahil Lenka --- .../v2_importers/archlinux_importer.py | 6 +++++- .../v2_importers/test_archlinux_importer_v2.py | 17 +++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/vulnerabilities/pipelines/v2_importers/archlinux_importer.py b/vulnerabilities/pipelines/v2_importers/archlinux_importer.py index 35f620e77..4c9953c6d 100644 --- a/vulnerabilities/pipelines/v2_importers/archlinux_importer.py +++ b/vulnerabilities/pipelines/v2_importers/archlinux_importer.py @@ -65,7 +65,11 @@ def parse_advisory(self, record) -> AdvisoryDataV2: summary = record.get("type", "") summary = "" if summary == "unknown" else summary - for name in record["packages"]: + packages = record["packages"] + if record.get("status") == "Not affected": + packages = [] + + for name in packages: affected = record.get("affected") fixed = record.get("fixed") diff --git a/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py b/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py index 20a578a31..85d0bbef1 100644 --- a/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py +++ b/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py @@ -28,3 +28,20 @@ def test_to_archlinux_advisories_v2(self): pipeline.response = data result = [adv.to_dict() for adv in pipeline.collect_advisories()] util_tests.check_results_against_json(result, expected_file) + + def test_not_affected_avg_has_no_affected_packages(self): + record = { + "name": "AVG-2737", + "packages": ["gnome-remote-desktop"], + "status": "Not affected", + "severity": "Unknown", + "type": "unknown", + "affected": "42.1-1", + "fixed": "42.1.1-1", + "ticket": None, + "issues": ["CVE-2022-1736"], + "advisories": [], + } + advisory = ArchLinuxImporterPipeline().parse_advisory(record) + self.assertEqual(advisory.affected_packages, []) + self.assertEqual(advisory.aliases, ["CVE-2022-1736"])