feat!(detector): detect oracle and alpine with vuls2

[MaineK00n]

If this Pull Request is work in progress, Add a prefix of “[WIP]” in the title.

What did you implement:

detect oracle and alpine with vuls2

In this PR, for kernel-related packages, if the major version of the package in the vulnerability information differs from the major version of the currently running kernel being scanned, the vulnerability information is now ignored.

https://github.com/future-architect/vuls/pull/541/files#diff-c38ba8400657a4caf68a8813319549c02e254e9ccb12099f6d3dba39bbf81ddeR291-R302

Additionally, with this PR, Oracle has also been changed to behave in this way.

https://github.com/future-architect/vuls/pull/1227/files#diff-c38ba8400657a4caf68a8813319549c02e254e9ccb12099f6d3dba39bbf81ddeR325

However, this issue occurs because, in RedHat OVALv1, although RHSA-2017:0372 has been deleted, its definition remains. So, this behavior should not be applied to Oracle and others.

For example, in Oracle Linux 7, kernel-uek has major versions 4 and 5, so if you have version 4 installed, all vulnerabilities fixed in version 5 will be ignored.

[vagrant@oracle7 ~]$ yum --showduplicates list available kernel-uek
Loaded plugins: ulninfo
Available Packages
kernel-uek.x86_64                                                                              4.1.12-124.42.3.el7uek                                                                                     ol7_UEKR4
...
kernel-uek.x86_64                                                                              5.4.17-2136.338.4.2.el7uek                                                                                 ol7_UEKR6

Also, for RedHat (including CentOS), while this advisory itself should be rejected, the overall detection should not behave in this way.

Therefore, this change will be removed.

The differences in detection results before and after, described below, are due to this change.

Type of change

• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How Has This Been Tested?

setup

$ curl -sL --create-dirs --output results/2025-06-17T10-41-24+0900/oracle.json https://github.com/vulsio/integration/blob/91fd64ab506efedf8ca9745ef1a692c3554f6414/data/results/oracle.json
$ curl -sL --create-dirs --output results/2025-06-17T10-41-24+0900/alpine_319.json https://github.com/vulsio/integration/blob/91fd64ab506efedf8ca9745ef1a692c3554f6414/data/results/alpine_319.json

$ cat << EOS > config.toml
version = "v2"

[cveDict]
type = "sqlite3"

[ovalDict]
type = "sqlite3"

[gost]
type = "sqlite3"

[exploit]
type = "sqlite3"

[metasploit]
type = "sqlite3"

[kevuln]
type = "sqlite3"

[cti]
type = "sqlite3"

[vuls2]
repository = "ghcr.io/vulsio/vuls-nightly-db:0"

[default]

[servers]

EOS

before

$ goval-dictionary fetch oracle 7
$ goval-dictionary fetch alpine 3.19

$ vuls report --refresh-cve --format-one-line-text 2025-06-17T10-41-24+0900
[Jun 17 10:47:35]  INFO [localhost] vuls-0.32.0-6accfb855ea1523c5a70b79c30c5430fd3b7a1a5-2025-05-16T07:24:16Z
...
One Line Summary
================
alpine_319	Total: 17 (Critical:0 High:0 Medium:0 Low:0 ?:17)   	17/17 Fixed  	18 installed 	0 poc	0 exploits	0 kevs	uscert: 0, jpcert: 0 alerts
oracle    	Total: 816 (Critical:1 High:777 Medium:37 Low:1 ?:0)	816/816 Fixed	322 installed	0 poc	0 exploits	0 kevs	uscert: 0, jpcert: 0 alerts

after

$ vuls report --refresh-cve --format-one-line-text 2025-06-17T10-41-24+0900
[Jun 17 10:49:30]  INFO [localhost] vuls-v0.32.0-build-20250617_103531_718a8e1
...
One Line Summary
================
alpine_319	Total: 17 (Critical:0 High:0 Medium:0 Low:0 ?:17)    	17/17 Fixed  	18 installed 	0 poc	0 exploits	0 kevs	uscert: 0, jpcert: 0 alerts
oracle    	Total: 864 (Critical:1 High:797 Medium:46 Low:1 ?:19)	864/864 Fixed	322 installed	0 poc	0 exploits	0 kevs	uscert: 0, jpcert: 0 alerts

Checklist:

You don't have to satisfy all of the following.

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: YES

Reference

[shino]

🍻