Detecting lack of CVE in openssh

[chenjianquan7]

FACT version

4.2

Environment

already update nvd use python install in cve_lookup
i am scan openssh 7.4p1, but leak CVE-2023-51767, (through 9.6)

Steps to reproduce

w

Observed Behavior

w

Expeced Behavior

w

Installation logs

install.log

PASTE HERE

Backend logs

fact_main_backend.log

PASTE HERE

Frontend logs

fact_main_frontend.log

PASTE HERE

Other information

No response

[jstucke]

I debugged this a bit and it turns out this has two reasons:

• the signature for OpenSSH was incomplete and the version was not matched in some cases
• CPE entries without version constraints are not shown by default (because of many false positives)

These two PRs should fix this issue:

• improved OpenSSH regex #1291
• added config option to allow CVE matches without version constraints #1292