Wrong CPE for dnsmasq about syft

[edhinard]

Trying to reproduce with an openwrt container:

1. Fetch the image

docker import http://downloads.openwrt.org/attitude_adjustment/12.09/x86/generic/openwrt-x86-generic-rootfs.tar.gz openwrt-x86-generic-rootfs

2. List the CPE

$ /opt/syft -q scan docker:openwrt-x86-generic-rootfs -o json= | jq '.artifacts[] | select(.name=="dnsmasq") | .cpes'
[
  "cpe:2.3:a:dnsmasq:dnsmasq:2.62-2:*:*:*:*:*:*:*"
]
[
  "cpe:2.3:a:dnsmasq:dnsmasq:2.62-2:*:*:*:*:*:*:*"
]

3. no CVE found for dnsmasq

$ /opt/syft -q scan docker:openwrt-x86-generic-rootfs -o json= | /opt/grype sbom:-
NAME          INSTALLED  FIXED-IN  TYPE  VULNERABILITY  SEVERITY 
libcrypto1.1  1.1.1w-r1            apk   CVE-2024-0727  Medium    
libssl1.1     1.1.1w-r1            apk   CVE-2024-0727  Medium

Expecting CVE-2022-0934 and CVE-2023-28450 that are in grype DB

[kzantow]

I've done a little bit of research about this, and added a draft PR that updates the CPE to include the right vendor for apk and dpkg. HOWEVER, there's still another issue that prevents any vulnerabilities from showing up for the openwrt dnsmasq: this is identified as a Debian package, so Grype only uses Debian matchers. We will hopefully be able to identify these as not official Debian packages (see: #2657) which should fix the issue there. The change does work for the alpine docker image.