search

fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
2.92k stars 405 forks source link

CPE for homebrew packages missing `macos` #20463

Open getvictor opened 1 month ago

getvictor commented 1 month ago

Fleet version: <!-- Copy this from the "My account" page in the Fleet UI, or run fleetctl --version -->

Web browser and operating system:

💥  Actual behavior

When running vulnerabilities, Fleet does not add macos system to homebrew packages.

For an app, the CPE (with system) is:

cpe:2.3:a:jetbrains:intellij_idea:2023.3.2:*:*:*:*:macos:*:*

But for homebrew, the CPE (without system) is:

cpe:2.3:a:jetbrains:intellij_idea:2023.3.2.233.13135.103:*:*:*:*:*:*:*

Also, look at other software sources and see if any of them also need to add macos system.

🧑‍💻  Steps to reproduce

Run vulnerability job, and look in software_cpe table in Fleet DB.

🕯️ More info (optional)

N/A

sharon-fdm commented 1 month ago

Hey team! Please add your planning poker estimate with Zenhub @lucasmrod @mostlikelee