iTerm2 app false negative vulnerability

[rebeccaui]

Fleet version: 4.59.0

Web browser and operating system: macOS 15.2

---

💥  Actual behavior

Vulnerabilities are listed for the homebrew version of iterm2, but no vulnerabilities are listed for the iTerm 2.app version from the website.
It could be that the CPE Fleet generates for the .app version of iTerm does not match the CPE provided by VulnCheck.
CVE-2024-38395 is one of the vulnerabilities that should be showing up.

Left side is iTerm 2.app (App) with no vulnerabilities reported.
Right side is iterm2 (homebrew) with vulnerabilities reported.

🧑‍💻  Steps to reproduce

1. Download/install iTerm2 from its website (iterm2.com).
2. Note that no vulnerabilites appear.

🕯️ More info (optional)

N/A

[JoStableford]

Linked to Unthread ticket:

Discrepancy in vulnerability reporting for iTerm2 versions #4024

[sharon-fdm]

@mostlikelee, fyi.