Fix CPE matching for python3-prefixed packages on Ubuntu/Debian

changes/43328-python3-prefix-cpe

@@ -0,0 +1 @@
+- Fixed vulnerability detection for Python packages on Ubuntu/Debian devices by stripping the "python3-" name prefix during CPE matching.

server/vulnerabilities/nvd/sanitize.go

@@ -92,6 +92,13 @@ func sanitizeSoftwareName(s *fleet.Software) string {
 	r := strings.ToLower(s.Name)
 	r = strings.TrimSuffix(r, ".app")
 
+	// Strip "python3-" prefix from python_packages names for CPE matching.
+	// On Ubuntu/Debian, pythonPackageFilter prepends "python3-" to match OVAL definitions,
+	// but the CPE database uses the bare package name (e.g. "geopandas" not "python3-geopandas").
+	if s.Source == "python_packages" {
+		r = strings.TrimPrefix(r, "python3-")
+	}
+
 	// Remove vendor, for 'apps' the vendor name is usually after the top level domain part.
 	r = strings.ReplaceAll(r, strings.ToLower(s.Vendor), "")
 	bundleParts := strings.Split(s.BundleIdentifier, ".")

server/vulnerabilities/nvd/sanitize_test.go

@@ -162,6 +162,14 @@
 			vendorVariations:  []string{"microsoft", "ms-python"},
 			productVariations: []string{"python", "ms-python.python"},
 		},
+		{
+			software:          fleet.Software{Name: "python3-geopandas", Version: "1.0.1", Source: "python_packages"},
+			productVariations: []string{"geopandas"},
+		},
+		{
+			software:          fleet.Software{Name: "python3-django", Version: "3.2.12", Source: "python_packages"},
+			productVariations: []string{"django"},
+		},
 	}
 
 	for _, tc := range variationsTestCases {
@@ -378,6 +386,54 @@
 			require.Equal(t, tc.expected, actual)
 		}
 	})
+
+	t.Run("strips python3- prefix from python_packages", func(t *testing.T) {
+		testCases := []struct {
+			software fleet.Software
+			expected string
+		}{
+			{
+				software: fleet.Software{
+					Name:    "python3-geopandas",
+					Version: "1.0.1",
+					Source:  "python_packages",
+				},
+				expected: "geopandas",
+			},
+			{
+				software: fleet.Software{
+					Name:    "python3-django",
+					Version: "3.2.12",
+					Source:  "python_packages",
+				},
+				expected: "django",
+			},
+			{
+				// python_packages without the prefix should not be affected
+				software: fleet.Software{
+					Name:    "requests",
+					Version: "2.28.0",
+					Source:  "python_packages",
+				},
+				expected: "requests",
+			},
+			{
+				// deb_packages with python3- prefix should NOT be stripped
+				software: fleet.Software{
+					Name:    "python3-geopandas",
+					Version: "1.0.1",
+					Source:  "deb_packages",
+				},
+				expected: "python3-geopandas",
+			},
+		}
+
+		for _, tc := range testCases {
+			tc := tc
+			actual := sanitizeSoftwareName(&tc.software)
+			require.Equal(t, tc.expected, actual)
+		}
+	})
 }
 
 func TestParseUpdateFromVersion(t *testing.T) {