feat: enable os vulns to have version range

[willmurphyscode]

The Mariner distro feed will start including version ranges in the OVAL XML. Update models and grype-db transformer to be able to handle this in version 5.

This is the other half of anchore/vunnel#585

[wagoodman]

it looks like there is new special casing for ALASKERNEL, but I don't see how that relates to this (maybe I'm missing something)?

[willmurphyscode]

ALASKERNEL generates it's own version range from a hard-coded lower bound for a given kernel:

grype-db/pkg/process/v5/transformers/os/transform.go

Line 200 in dcc9d3f

if strings.HasPrefix(vulnerabilityID, "ALASKERNEL-") {

this special casing is to avoid skipping that if vunnel ends up emitting a version range.

[wagoodman]

Is there an existing test that covers this? if not, can you add a new test for this?

[willmurphyscode]

These tests cover the behavior:

grype-db/pkg/process/v5/transformers/os/transform_test.go

Lines 780 to 880 in dcc9d3f

	{
	ID: "ALASKERNEL-5.4-2022-007",
	PackageName: "kernel-headers",
	PackageQualifiers: []qualifier.Qualifier{rpmmodularity.Qualifier{
	Kind: "rpm-modularity",
	Module: "",
	}},
	VersionConstraint: ">= 5.4, < 5.4.144-69.257.amzn2",
	VersionFormat: "rpm",
	Namespace: "amazon:distro:amazonlinux:2",
	RelatedVulnerabilities: []grypeDB.VulnerabilityReference{
	{
	ID: "CVE-2021-3753",
	Namespace: "nvd:cpe",
	},
	{
	ID: "CVE-2021-40490",
	Namespace: "nvd:cpe",
	},
	},
	Fix: grypeDB.Fix{
	Versions: []string{"5.4.144-69.257.amzn2"},
	State: grypeDB.FixedState,
	},
	},
	{
	ID: "ALASKERNEL-5.4-2022-007",
	PackageName: "kernel",
	PackageQualifiers: []qualifier.Qualifier{rpmmodularity.Qualifier{
	Kind: "rpm-modularity",
	Module: "",
	}},
	VersionConstraint: ">= 5.4, < 5.4.144-69.257.amzn2",
	VersionFormat: "rpm",
	Namespace: "amazon:distro:amazonlinux:2",
	RelatedVulnerabilities: []grypeDB.VulnerabilityReference{
	{
	ID: "CVE-2021-3753",
	Namespace: "nvd:cpe",
	},
	{
	ID: "CVE-2021-40490",
	Namespace: "nvd:cpe",
	},
	},
	Fix: grypeDB.Fix{
	Versions: []string{"5.4.144-69.257.amzn2"},
	State: grypeDB.FixedState,
	},
	},
	{
	ID: "ALASKERNEL-5.10-2022-005",
	PackageName: "kernel-headers",
	PackageQualifiers: []qualifier.Qualifier{rpmmodularity.Qualifier{
	Kind: "rpm-modularity",
	Module: "",
	}},
	VersionConstraint: ">= 5.10, < 5.10.62-55.141.amzn2",
	VersionFormat: "rpm",
	Namespace: "amazon:distro:amazonlinux:2",
	RelatedVulnerabilities: []grypeDB.VulnerabilityReference{
	{
	ID: "CVE-2021-3753",
	Namespace: "nvd:cpe",
	},
	{
	ID: "CVE-2021-40490",
	Namespace: "nvd:cpe",
	},
	},
	Fix: grypeDB.Fix{
	Versions: []string{"5.10.62-55.141.amzn2"},
	State: grypeDB.FixedState,
	},
	},
	{
	ID: "ALASKERNEL-5.10-2022-005",
	PackageName: "kernel",
	PackageQualifiers: []qualifier.Qualifier{rpmmodularity.Qualifier{
	Kind: "rpm-modularity",
	Module: "",
	}},
	VersionConstraint: ">= 5.10, < 5.10.62-55.141.amzn2",
	VersionFormat: "rpm",
	Namespace: "amazon:distro:amazonlinux:2",
	RelatedVulnerabilities: []grypeDB.VulnerabilityReference{
	{
	ID: "CVE-2021-3753",
	Namespace: "nvd:cpe",
	},
	{
	ID: "CVE-2021-40490",
	Namespace: "nvd:cpe",
	},
	},
	Fix: grypeDB.Fix{
	Versions: []string{"5.10.62-55.141.amzn2"},
	State: grypeDB.FixedState,
	},
	},
	},

But they pass without the hard-coded prefix check, but that's because there's no vulnerable range on the test fixtures:

grype-db/pkg/process/v5/transformers/os/test-fixtures/amazon-multiple-kernel-advisories.json

Line 33 in dcc9d3f

"Version": "4.14.246-187.474.amzn2"

I think there's also no vulnerable range on the upstream data; it just felt like counting on a coincidence to leave out the ALASKERNEL- prefix check.

Then again, if upstream vunnel starts shipping version ranges on ALASKERNEL- vulnerabilities, why shouldn't grype-db believe vunnel? I think it might make sense to remove the check here.