fix(oracle): Improve handling and reporting of vulnerabilities between normal, FIPS, and ksplice package variants

[bpfoster]

Description

Check the installed version and the fix version to see if they're both for the FIPS package or not.

Before:

┌────────────────┬────────────────┬──────────┬─────────────────────┬──────────────────────────┬─────────────────────────────────────────────────────────────┐
│    Library     │ Vulnerability  │ Severity │  Installed Version  │      Fixed Version       │                            Title                            │
├────────────────┼────────────────┼──────────┼─────────────────────┼──────────────────────────┼─────────────────────────────────────────────────────────────┤
│ gnutls         │ CVE-2021-20231 │ MEDIUM   │ 3.6.14-8.el8_3      │ 10:3.6.16-4.0.1.el8_fips │ gnutls: Use after free in client key_share extension        │
│                │                │          │                     │                          │ https://avd.aquasec.com/nvd/cve-2021-20231                  │
├────────────────┼────────────────┼──────────┼─────────────────────┼──────────────────────────┼─────────────────────────────────────────────────────────────┤
│ gnutls         │ CVE-2021-20232 │ MEDIUM   │ 3.6.14-8.el8_3      │ 10:3.6.16-4.0.1.el8_fips │ gnutls: Use after free in client_send_params in             │
│                │                │          │                     │                          │ lib/ext/pre_shared_key.c                                    │
│                │                │          │                     │                          │ https://avd.aquasec.com/nvd/cve-2021-20232                  │
│                ├────────────────┤          │                     │                          ├─────────────────────────────────────────────────────────────┤
│                │ CVE-2021-3580  │          │                     │                          │ nettle: Remote crash in RSA decryption via manipulated      │
│                │                │          │                     │                          │ ciphertext                                                  │
│                │                │          │                     │                          │ https://avd.aquasec.com/nvd/cve-2021-3580                   │
├────────────────┼────────────────┼──────────┼─────────────────────┼──────────────────────────┼─────────────────────────────────────────────────────────────┤

After:

┌────────────────────────┬────────────────┬──────────┬─────────────────────┬──────────────────────┬──────────────────────────────────────────────────────────────┐
│        Library         │ Vulnerability  │ Severity │  Installed Version  │    Fixed Version     │                            Title                             │
├────────────────────────┼────────────────┼──────────┼─────────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ gnutls                 │ CVE-2021-20231 | MEDIUM   │ 3.6.14-8.el8_3      │ 3.6.16-4.el8         │ gnutls: Use after free in client key_share extension         │
│                        │                │          │                     │                      │ https://avd.aquasec.com/nvd/cve-2021-20231                   │
├────────────────────────┼────────────────┼──────────┼─────────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ gnutls                 │ CVE-2021-20232 │ MEDIUM   │ 3.6.14-8.el8_3      │ 3.6.16-4.el8         │ gnutls: Use after free in client_send_params in              │
│                        │                │          │                     │                      │ lib/ext/pre_shared_key.c                                     │
│                        │                │          │                     │                      │ https://avd.aquasec.com/nvd/cve-2021-20232                   │
│                        ├────────────────┤          │                     │                      ├──────────────────────────────────────────────────────────────┤
│                        │ CVE-2021-3580  │          │                     │                      │ nettle: Remote crash in RSA decryption via manipulated       │
│                        │                │          │                     │                      │ ciphertext                                                   │
│                        │                │          │                     │                      │ https://avd.aquasec.com/nvd/cve-2021-3580                    │
├────────────────────────┼────────────────┼──────────┼─────────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤

Note that this has a dependency on trivy-db PR #221 for correct results (updated database schema) and usage of a newly exported oracleoval.GetPackageFlavor function.

oracleoval.GetPackageFlavor fixes flavor handling in Oracle packages:

• FIPS validated packages handling is added
• ksplice packages handling is fixed. ksplice1 and ksplice2 are not separate flavors. ksplice is the flavor and the number after it is a ksplice userspace code release number.

Related issues

• Close False Positives being reported from Trivy 0.24.2 - oraclelinux:8 image #1967
• DB does not contain all advisories for Oracle Linux trivy-db#220

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[github-actions]

This PR is stale because it has been labeled with inactivity.

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

This PR is stale because it has been labeled with inactivity.