Fixed false negative CVE for pgAdmin 4.

changes/37957-pgadmin-vulnerability

@@ -0,0 +1 @@
+Fixed false negative CVE for pgAdmin 4.

server/vulnerabilities/nvd/cpe_translations.json

@@ -718,5 +718,16 @@
     "filter": {
       "target_sw": ["intellij"]
     }
+  },
+  {
+    "software": {
+      "name": ["/(?i)^pgadmin ?4/"],
+      "source": ["programs", "homebrew_packages"]
+    },
+    "filter": {
+      "product": ["pgadmin", "pgadmin_4"],
+      "vendor": ["pgadmin"],
+      "target_sw": ["postgresql"]
+    }
   }
 ]

server/vulnerabilities/nvd/cve.go

@@ -598,6 +598,24 @@ func expandCPEAliases(cpeItem *wfn.Attributes) []*wfn.Attributes {
 		}
 	}
 
+	// pgAdmin CVEs in NVD use target_sw=postgresql and product=pgadmin_4, but Fleet generates
+	// CPEs with platform-based target_sw (macos, windows) and may use different product
+	// names (pgadmin, pgadmin4). Add aliases with target_sw=postgresql and product name
+	// variations to match NVD's criteria.
+	// See https://github.com/fleetdm/fleet/issues/37957.
+	for _, cpeItem := range cpeItems {
+		if cpeItem.Vendor == "pgadmin" &&
+			(cpeItem.Product == "pgadmin_4" || cpeItem.Product == "pgadmin" || cpeItem.Product == "pgadmin4") {
+			// Add aliases with product name variations and target_sw=postgresql
+			for _, productName := range []string{"pgadmin", "pgadmin_4", "pgadmin4"} {
+				newItem := *cpeItem
+				newItem.Product = productName
+				newItem.TargetSW = "postgresql"
+				cpeItems = append(cpeItems, &newItem)
+			}
+		}
+	}
+
 	// Python pre-release versions can have the pre-release part in the version field or in the
 	// update field (the technically correct place). We generate the "correct" CPEs (with the
 	// pre-release part in the update field), so we have to create an alias here with the

server/vulnerabilities/nvd/cve_test.go

@@ -1115,6 +1115,36 @@ func TestExpandCPEAliases(t *testing.T) {
 	python3130RC1Alias.Version = "3.13.0rc1"
 	python3130RC1Alias.Update = ""
 
+	pgadminMacOS := &wfn.Attributes{
+		Vendor:   "pgadmin",
+		Product:  "pgadmin",
+		Version:  "9.10",
+		TargetSW: "macos",
+	}
+	pgadminMacOSAliasPgadmin := *pgadminMacOS
+	pgadminMacOSAliasPgadmin.TargetSW = "postgresql"
+	pgadminMacOSAliasPgadmin_4 := *pgadminMacOS
+	pgadminMacOSAliasPgadmin_4.Product = "pgadmin_4"
+	pgadminMacOSAliasPgadmin_4.TargetSW = "postgresql"
+	pgadminMacOSAliasPgadmin4 := *pgadminMacOS
+	pgadminMacOSAliasPgadmin4.Product = "pgadmin4"
+	pgadminMacOSAliasPgadmin4.TargetSW = "postgresql"
+
+	pgadminWindows := &wfn.Attributes{
+		Vendor:   "pgadmin",
+		Product:  "pgadmin_4",
+		Version:  "9.10",
+		TargetSW: "windows",
+	}
+	pgadminWindowsAliasPgadmin := *pgadminWindows
+	pgadminWindowsAliasPgadmin.Product = "pgadmin"
+	pgadminWindowsAliasPgadmin.TargetSW = "postgresql"
+	pgadminWindowsAliasPgadmin_4 := *pgadminWindows
+	pgadminWindowsAliasPgadmin_4.TargetSW = "postgresql"
+	pgadminWindowsAliasPgadmin4 := *pgadminWindows
+	pgadminWindowsAliasPgadmin4.Product = "pgadmin4"
+	pgadminWindowsAliasPgadmin4.TargetSW = "postgresql"
+
 	for _, tc := range []struct {
 		name            string
 		cpeItem         *wfn.Attributes
@@ -1155,6 +1185,26 @@ func TestExpandCPEAliases(t *testing.T) {
 			cpeItem:         python3130RC1,
 			expectedAliases: []*wfn.Attributes{python3130RC1, &python3130RC1Alias},
 		},
+		{
+			name:    "pgadmin on macos",
+			cpeItem: pgadminMacOS,
+			expectedAliases: []*wfn.Attributes{
+				pgadminMacOS,
+				&pgadminMacOSAliasPgadmin,
+				&pgadminMacOSAliasPgadmin_4,
+				&pgadminMacOSAliasPgadmin4,
+			},
+		},
+		{
+			name:    "pgadmin on windows",
+			cpeItem: pgadminWindows,
+			expectedAliases: []*wfn.Attributes{
+				pgadminWindows,
+				&pgadminWindowsAliasPgadmin,
+				&pgadminWindowsAliasPgadmin_4,
+				&pgadminWindowsAliasPgadmin4,
+			},
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			aliases := expandCPEAliases(tc.cpeItem)