fix: spdx sbom cpe bug

[AryanBakliwal]

fixes: #4700

Changed the order of decoding at parse.py#L382

Output

╭─────────────╮
│ CPE SUMMARY │
╰─────────────╯
┏━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┓
┃        ┃          ┃         ┃ Latest       ┃              ┃              ┃              ┃              ┃              ┃              ┃
┃        ┃          ┃         ┃ Upstream     ┃              ┃              ┃              ┃              ┃              ┃              ┃
┃        ┃          ┃         ┃ Stable       ┃ CRITICAL     ┃ HIGH CVEs    ┃ MEDIUM CVEs  ┃ LOW CVEs     ┃ UNKNOWN CVEs ┃ TOTAL CVEs   ┃
┃ Vendor ┃ Product  ┃ Version ┃ Version      ┃ CVEs Count   ┃ Count        ┃ Count        ┃ Count        ┃ Count        ┃ Count        ┃
┡━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━┩
│ arm    │ mbed_tls │ 3.6.0   │ 3.6.2        │ 1            │ 0            │ 1            │ 0            │ 0            │ 2            │
└────────┴──────────┴─────────┴──────────────┴──────────────┴──────────────┴──────────────┴──────────────┴──────────────┴──────────────┘
╭─────────────────╮
│  NewFound CVEs  │
╰─────────────────╯
┏━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━┓
┃ Vendor ┃ Product  ┃ Version ┃ CVE Number     ┃ Source ┃ Severity ┃ Score (CVSS Version) ┃
┡━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━┩
│ arm    │ mbed_tls │ 3.6.0   │ CVE-2024-45157 │ NVD    │ MEDIUM   │ 5.1 (v3)             │
│ arm    │ mbed_tls │ 3.6.0   │ CVE-2024-45159 │ NVD    │ CRITICAL │ 9.8 (v3)             │
└────────┴──────────┴─────────┴────────────────┴────────┴──────────┴──────────────────────┘
┏━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┳━━━━━━┳━━━━━━━━━━┓
┃ Vendor ┃ Product  ┃ Version ┃ Root ┃ Filename ┃
┡━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━╇━━━━━━╇━━━━━━━━━━┩
│ arm    │ mbed_tls │ 3.6.0   │      │          │
└────────┴──────────┴─────────┴──────┴──────────┘
╭───────────────────────────────────────────────╮
│  Products with No Identified Vulnerabilities  │
╰───────────────────────────────────────────────╯
┏━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┓
┃ Vendor ┃ Product ┃ Version ┃
┡━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━┩
└────────┴─────────┴─────────┘

[AryanBakliwal]

@terriko @anthonyharrison PTAL and let me know what you think

[terriko]

This would resolve that bug, but I think @anthonyharrison is correct that it may introduce some not-so-great side effects.

Right now, I'd like us to change things so we return ALL references rather than having a preference order at all. (I know, @anthonyharrison is asserting that we could just prefer purl, but obviously that's what we were doing and it wasn't working as people expected either.)

So you'd need to get rid of the elifs and set this up to return a potential list of tuples, and possibly change anywhere that parse_ext_ref is called to handle an list instead of a single tuple.

[mastersans]

Hey @AryanBakliwal Any Progress on this one?

[AryanBakliwal]

@mastersans I will make the changes discussed and push them soon.

[AryanBakliwal]

@terriko @mastersans I have updated it to return all external references rather than one

output:

$ cve-bin-tool --sbom spdx --sbom-file ~/sbom.spdx
[06:06:42] INFO     cve_bin_tool - CVE Binary Tool v3.4                                                                               cli.py:630
           INFO     cve_bin_tool - This product uses the NVD API but is not endorsed or certified by the NVD.                         cli.py:631
           INFO     cve_bin_tool - For potentially faster NVD downloads, mirrors are available using -n json-mirror                   cli.py:634
           INFO     cve_bin_tool.CVEDB - Using cached CVE data (<24h old). Use -u now to update immediately.                        cvedb.py:325
           INFO     cve_bin_tool.CVEDB - There are 328906 CVE entries in the database                                               cvedb.py:391
           INFO     cve_bin_tool.CVEDB - There are 285342 CVE entries from NVD in the database                                      cvedb.py:393
           INFO     cve_bin_tool.CVEDB - There are 24114 CVE entries from GAD in the database                                       cvedb.py:393
           INFO     cve_bin_tool.CVEDB - There are 19450 CVE entries from REDHAT in the database                                    cvedb.py:393
           INFO     cve_bin_tool - CVE database contains CVEs from National Vulnerability Database (NVD), Open Source Vulnerability   cli.py:921
                    Database (OSV), Gitlab Advisory Database (GAD) and RedHat                                                                   
           INFO     cve_bin_tool - CVE database last updated on 16 March 2025 at 19:19:31                                             cli.py:924
           INFO     cve_bin_tool - The number of products to process from SBOM - 2                                                   cli.py:1140
           INFO     cve_bin_tool.CVEScanner - 2 CVE(s) in arm.mbed_tls version 3.6.0                                          cve_scanner.py:363
           INFO     cve_bin_tool - Overall CVE summary:                                                                              cli.py:1187
           INFO     cve_bin_tool - There are 1 products with known CVEs detected                                                     cli.py:1188
           INFO     cve_bin_tool - Known CVEs in ('arm.mbed_tls', '3.6.0'):                                                          cli.py:1199
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃                                                         CVE BINARY TOOL version: 3.4                                                         ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛

 • Report Generated: 2025-03-17  06:06:42                                                                                                       
 • Time of last update of CVE Data: 2025-03-16  19:19:31                                                                                        
╭─────────────╮
│ CVE SUMMARY │
╰─────────────╯
┏━━━━━━━━━━┳━━━━━━━┓
┃ Severity ┃ Count ┃
┡━━━━━━━━━━╇━━━━━━━┩
│ CRITICAL │ 1     │
│ HIGH     │ 0     │
│ MEDIUM   │ 1     │
│ LOW      │ 0     │
│ UNKNOWN  │ 0     │
└──────────┴───────┘
[06:06:43] ERROR    cve_bin_tool - An error occurred while fetching https://release-monitoring.org/api/v2/packages/?distribution=CPE util.py:351
                    NVD NIST&name=cpe:2.3:a:arm:mbed_tls: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by                
                    peer'))                                                                                                                     
╭─────────────╮
│ CPE SUMMARY │
╰─────────────╯
┏━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┓
┃        ┃          ┃         ┃ Latest        ┃               ┃               ┃               ┃               ┃                ┃               ┃
┃        ┃          ┃         ┃ Upstream      ┃               ┃               ┃               ┃               ┃                ┃               ┃
┃        ┃          ┃         ┃ Stable        ┃ CRITICAL CVEs ┃ HIGH CVEs     ┃ MEDIUM CVEs   ┃ LOW CVEs      ┃ UNKNOWN CVEs   ┃ TOTAL CVEs    ┃
┃ Vendor ┃ Product  ┃ Version ┃ Version       ┃ Count         ┃ Count         ┃ Count         ┃ Count         ┃ Count          ┃ Count         ┃
┡━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━┩
│ arm    │ mbed_tls │ 3.6.0   │ UNKNOWN       │ 1             │ 0             │ 1             │ 0             │ 0              │ 2             │
└────────┴──────────┴─────────┴───────────────┴───────────────┴───────────────┴───────────────┴───────────────┴────────────────┴───────────────┘
╭─────────────────╮
│  NewFound CVEs  │
╰─────────────────╯
┏━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━┓
┃ Vendor ┃ Product  ┃ Version ┃ CVE Number     ┃ Source ┃ Severity ┃ Score (CVSS Version) ┃
┡━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━┩
│ arm    │ mbed_tls │ 3.6.0   │ CVE-2024-45157 │ NVD    │ MEDIUM   │ 5.1 (v3)             │
│ arm    │ mbed_tls │ 3.6.0   │ CVE-2024-45159 │ NVD    │ CRITICAL │ 9.8 (v3)             │
└────────┴──────────┴─────────┴────────────────┴────────┴──────────┴──────────────────────┘
┏━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┳━━━━━━┳━━━━━━━━━━┓
┃ Vendor ┃ Product  ┃ Version ┃ Root ┃ Filename ┃
┡━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━╇━━━━━━╇━━━━━━━━━━┩
│ arm    │ mbed_tls │ 3.6.0   │      │          │
└────────┴──────────┴─────────┴──────┴──────────┘
╭───────────────────────────────────────────────╮
│  Products with No Identified Vulnerabilities  │
╰───────────────────────────────────────────────╯
┏━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━┓
┃ Vendor  ┃ Product      ┃ Version ┃
┡━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━┩
│ UNKNOWN │ mbedtls-deps │ V3.6.0  │
└─────────┴──────────────┴─────────┘

[mastersans]

Looks good to me. I'll have @terriko also have a second look, otherwise will get it merged.

[terriko]

I'm updating the branch and re-running the tests for safety, but I'll set this to merge when that's done since @mastersans has already reviewed it.

fixed

[sultanqasim]

This change completely broke parsing of SBOMs that lack external references, such as the SPDX SBOMs generated by this tool itself. Looking at the commit, it's obvious why. This commit just removed handling of all SBOM entries for packages that lack external references.