diff --git a/rhel/vex/parser.go b/rhel/vex/parser.go index 17609e594..8667f73fe 100644 --- a/rhel/vex/parser.go +++ b/rhel/vex/parser.go @@ -100,7 +100,13 @@ func (u *Updater) DeltaParse(ctx context.Context, contents io.ReadCloser) ([]*cl } } vulns := []*claircore.Vulnerability{} - for _, vs := range out { + for n, vs := range out { + if len(vs) == 0 { + // If there are no vulns for this CVE make sure we signal that + // it is deleted in case it once had vulns. + deleted = append(deleted, n) + continue + } vulns = append(vulns, vs...) } diff --git a/rhel/vex/parser_test.go b/rhel/vex/parser_test.go index c3845b87b..c1b7614dd 100644 --- a/rhel/vex/parser_test.go +++ b/rhel/vex/parser_test.go @@ -307,10 +307,10 @@ func TestParse(t *testing.T) { expectedDeleted int }{ { - name: "six_advisories_two_deletions", + name: "six_advisories_four_deletions", filename: "testdata/example_vex.jsonl", expectedVulns: 546, - expectedDeleted: 2, + expectedDeleted: 4, }, { name: "cve-2022-1705", diff --git a/rhel/vex/updater.go b/rhel/vex/updater.go index 5d1079b14..635070c11 100644 --- a/rhel/vex/updater.go +++ b/rhel/vex/updater.go @@ -33,7 +33,7 @@ const ( deletionsFile = "deletions.csv" lookBackToYear = 2014 repoKey = "rhel-cpe-repository" - updaterVersion = "2" + updaterVersion = "3" ) // Factory creates an Updater to process all of the Red Hat VEX data.