fix: improve handling of triage data

cve_bin_tool/cve_scanner.py

@@ -16,7 +16,7 @@
 from cve_bin_tool.input_engine import TriageData
 from cve_bin_tool.log import LOGGER
 from cve_bin_tool.theme import cve_theme
-from cve_bin_tool.util import CVE, CVEData, ProductInfo, VersionInfo
+from cve_bin_tool.util import CVE, CVEData, ProductInfo, Remarks, VersionInfo
 from cve_bin_tool.version_compare import Version
 
 
@@ -180,8 +180,13 @@ def get_cves(self, product_info: ProductInfo, triage_data: TriageData):
                     end_excluding=version_end_excluding,
                 )
 
-        # Go through and get all the severities
+        product_info_data: CVEData | None = self.all_cve_data.get(product_info)
+        prev_cves: List[CVE] = (
+            product_info_data.get("cves", []) if product_info_data is not None else []  # type: ignore
+        )
         cves: List[CVE] = []
+
+        # Go through and get all the severities
         if cve_list:
             finished = False
             max_cves = 500
@@ -223,15 +228,26 @@ def get_cves(self, product_info: ProductInfo, triage_data: TriageData):
                     if duplicate_found:
                         continue
 
+                    # Check if we already found this CVE with a previous scan.
+                    # In that case we need to check where to get our triage info
+                    # from.
+                    # TODO: turn the list of CVEs into a set to avoid needing
+                    # the linear-time lookup.
+                    prev_cve = next(
+                        (
+                            cve
+                            for cve in prev_cves
+                            if cve.cve_number == row["cve_number"]
+                        ),
+                        None,
+                    )
+
                     triage = triage_data.get(row["cve_number"]) or triage_data.get(
                         "default"
                     )
-                    # Only scan cves if triage is not None.
-                    # Triage will only be None if triage_data don't have default attribute.
-                    # NOTE: Triage can be empty dictionary so checking `if triage:` won't suffice.
-                    if triage is not None:
+                    if prev_cve is None:
                         row_dict = dict(row)
-                        row_dict.update(triage)
+
                         # print(row_dict)
                         row_dict["severity"] = row_dict["severity"] or row["severity"]
                         # Checking for exploits
@@ -274,7 +290,38 @@ def get_cves(self, product_info: ProductInfo, triage_data: TriageData):
                                 f'metrics found in CVE {row_dict["cve_number"]}  is {row_dict["metric"]}'
                             )
                         cve = CVE(**row_dict)
-                        cves.append(cve)
+                    else:
+                        cve = prev_cve
+
+                    # We assume that only one source has the triage info.
+                    # We try to figure out here which one.
+                    # If we have useful info in the triage data we received,
+                    # then we use it.
+                    if triage is not None and (
+                        # Either the new cve does not have triage data,
+                        # or it is trivial (newly found cve)
+                        not cve.remarks or cve.remarks == Remarks.NewFound
+                    ):
+                        for key in [
+                            "remarks",
+                            "comments",
+                            "response",
+                            "justification",
+                            "severity",
+                        ]:
+                            data = triage.get(key)
+                            if data:
+                                if (
+                                    key == "severity"
+                                    and self.check_exploits
+                                    and row_dict["cve_number"] in self.exploits_list
+                                ):
+                                    data += "-EXPLOIT"
+
+                                self.logger.debug(f"Setting field {key} to: {data}")
+                                cve = cve._replace(**{key: data})
+
+                    cves.append(cve)
 
             if cves:
                 self.products_with_cve += 1

cve_bin_tool/util.py

@@ -1,7 +1,8 @@
 # Copyright (C) 2021 Intel Corporation
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-""" Utility classes for the CVE Binary Tool """
+"""Utility classes for the CVE Binary Tool"""
+
 from __future__ import annotations
 
 import fnmatch
@@ -165,6 +166,24 @@ class ProductInfo(NamedTuple):
     location: str
     purl: str | None = None
 
+    def __identity_members(self):
+        """The members that will be used for eq and hash implementations.
+        We do not include location here since it can take on different values
+        depending on where the product info is coming from and we want to be
+        able to properly identify products that are actually the same.
+        """
+        # TODO: what is the meaning of the location field exactly?
+        return (self.vendor, self.product, self.version)
+
+    def __eq__(self, other):
+        if type(other) is type(self):
+            return self.__identity_members() == other.__identity_members()
+        else:
+            return False
+
+    def __hash__(self):
+        return hash(self.__identity_members())
+
 
 class ScanInfo(NamedTuple):
     """