vex: warn and skip unparseable entries in knownAffectedVulnerabilities

The sibling functions fixedVulnerabilities and
knownNotAffectedVulnerabilities already warn-and-skip on PackageName(),
Module(), and cvssVectorFromScore() errors. This function was
inadvertently changed to hard-fail during the iterator migration
(f9fc989), causing a single bad entry in external VEX data to abort the
entire update.

Signed-off-by: J. Victor Martins <jvdm@sdf.org>

Author: jvdm

rhel/vex/parser.go

@@ -708,38 +708,42 @@ func (r *rope[E]) All() iter.Seq[*E] {
 // KnownAffectedVulnerabilities processes the "known_affected" array of products
 // in the VEX object.
 func (c *creator) knownAffectedVulnerabilities(ctx context.Context, v *csaf.Vulnerability, init vulnHook) ([]*claircore.Vulnerability, error) {
+	log := slog.With("link", c.docLink)
 	var backing rope[claircore.Vulnerability]
 	for st, err := range c.Status(ctx, v, csaf.ProductStatusKnownAffected) {
 		if err != nil {
 			return nil, err
 		}
 
-		// This loop never skips returned [status] values, so we can always just
-		// append a new [claircore.Vulnerability].
-		vuln := backing.New()
-
-		if err := init(ctx, vuln); err != nil {
-			return nil, err
-		}
 		pkgName, err := st.PackageName()
 		if err != nil {
-			return nil, err
+			log.WarnContext(ctx, "bad purl", "reason", err, "purl", st.PURL, "missing", "PackageName")
+			continue
 		}
 		modName, err := st.Module()
 		if err != nil {
+			log.WarnContext(ctx, "bad purl", "reason", err, "purl", st.PURL, "missing", "ModuleName")
+			continue
+		}
+		var sev string
+		if sc := st.Score; sc != nil {
+			sev, err = cvssVectorFromScore(sc)
+			if err != nil {
+				log.WarnContext(ctx, "bad score", "reason", err, "found", true)
+				continue
+			}
+		}
+
+		vuln := backing.New()
+		if err := init(ctx, vuln); err != nil {
 			return nil, err
 		}
 		vuln.Package = &claircore.Package{
 			Name:   pkgName,
 			Kind:   types.SourcePackage, // Always source?
 			Module: modName,
 		}
-		if sc := st.Score; sc != nil {
-			vuln.Severity, err = cvssVectorFromScore(sc)
-			if err != nil {
-				return nil, fmt.Errorf("could not parse CVSS score: %w, file: %s", err, c.docLink)
-			}
-		}
+		vuln.Severity = sev
 		if t := st.Threat; t != nil {
 			vuln.NormalizedSeverity = common.NormalizeSeverity(t.Details)
 		}

rhel/vex/parser_test.go

@@ -414,6 +414,12 @@ func TestParse(t *testing.T) {
 			expectedVulns:   269,
 			expectedDeleted: 0,
 		},
+		{
+			name:            "bad_rpmmod_in_known_affected",
+			filenames:       []string{"testdata/cve-2024-24786-bad-rpmmod.json"},
+			expectedVulns:   2,
+			expectedDeleted: 0,
+		},
 	}
 
 	u := &Updater{url: url, client: http.DefaultClient}
@@ -686,4 +692,3 @@ func TestExtractPackageName(t *testing.T) {
 		})
 	}
 }
-