CVE-2024-52308 - Fleet not detecting GitHub / gh CLI CVE

[nonpunctual]

Fleet version:
Fleet 4.58.0 • Go go1.23.1

Web browser and operating system:
N/A

💥  Actual behavior

CVE-2024-52308 - GHSA-p2h2-3vg9-4p87

THis CVE affects the Github CLI - the binary name is gh

FleetDM seems not able to detect it probably because the CPE cpe:2.3:a:github:cli:*:*:*:*:*:*:*:*, calls the app cli and not gh?

Github calls it gh in their documentation.

🧑‍💻  Steps to reproduce

Look for CVE-2024-52308 in Fleet vulnerability data.

N/A

[nonpunctual]

Do we have queries we use for testing that parse CPEs that we can share? Thanks.

[ksykulev]

@nonpunctual This looks like some code that parses CPEs: https://github.com/fleetdm/fleet/blob/main/server/vulnerabilities/nvd/tools/wfn/fsb.go#L45-L81 and the associated tests https://github.com/fleetdm/fleet/blob/main/server/vulnerabilities/nvd/tools/wfn/fsb_test.go#L22

[nonpunctual]

Customer also posted this PR related to this issue: github/advisory-database#5027