CVE related normalization

[AMDmi3]

Introducting vulnerabilities support revealed some inconsistencies which should be fixed in order to be able to properly match package versions to CPE versions attached to CVE entries. Some emails or bug reports are being sent out, and some normalization rules may need to be changed here when I get replies.

• https://repology.org/project/cfitsio/information (3.480 widely used in packages vs 3.48 from CVE and upstream, email sent, probably need to be normalized to 3.48).
• https://repology.org/project/gajim/information (1.1.99.1 vs. 1.2-beta1, https://dev.gajim.org/gajim/gajim/-/issues/10111)
• https://repology.org/project/neomutt/information (YYYYMMDD vs. YYYY-MM-DD) - NVD fixed, upstream uncooperative regarding fixing ambiguous versioning (Ambiguous versioning scheme neomutt/neomutt#2338)
• https://repology.org/project/dokuwiki/information (???)
• https://repology.org/project/libredwg/information (0.9.3 vs. 0.93 - CVE NVD fixed)
• https://repology.org/project/dia/information (garbage)
• https://repology.org/project/unzip/information (missing components?)
• https://repology.org/project/portaudio/information (garbage)
• https://repology.org/project/munin/cves?version=2.0.61 (too broad CVE version range, NVD fixed)
• https://repology.org/project/serendipity/cves?version=2.3.5 incorrect CVE affecting unrelated software (serendipity plugin). 📧 to NVD sent.
• https://repology.org/project/widelands/information (blame upstream braindead versioning scheme)
• https://repology.org/project/go/cves?version=1.14.2 (unbounded dates in vulns, 📧 sent)
• https://repology.org/project/puppet/cves?version=6.15.0 (fixed by ignoring enterprise editions).
• https://repology.org/project/iputils/information (bad upstream versioning scheme, incorrect scheme in CVEs, upstream issue
• https://repology.org/project/binaryen/information (two upstream schemes, upstream issue)
• https://repology.org/project/krb5/cves (5 is used as part of the vesrsion in NVD)
• https://repology.org/projects/?search=google%25earth (need merging, bindings, edition support in repology)
• https://repology.org/project/veracrypt/information (version scheme problems)
• https://repology.org/project/nvidia-current/information (need merge in repology)
• https://repology.org/project/js:jquery/related (need merge of node:)
• https://repology.org/project/openstack-keystone/cves?version=17.0.0 (old scheme used dates, NVD 📧 sent)
• https://repology.org/project/metamail/cves (unrelated CVEs in NVD?)
• https://repology.org/project/brave/information (???)
• https://repology.org/project/usrsctp/information (no upstream versions since 2016, upstream issue Please (re)introduce versioned releases sctplab/usrsctp#477)

[AMDmi3]

NVD answered by mails regarding neomutt and golang, neomutt versions were already fixed. It seems that they are open to contributions, so incorrect data in NVD will be fixed eventually.