-
Ticket
-
Resolution: Done
-
Major
-
None
-
None
-
None
-
False
-
-
False
-
Very Likely
-
0
Description:
While looking at the following document and reading the provided VEX, I came across what appeared to be an unfixed RPM Package, but the PURL did not contain the arch.
- https://redhatproductsecurity.github.io/security-data-guidelines/csaf-vex/#unfixed-product-versions-vex-only-examples
- https://redhatproductsecurity.github.io/security-data-guidelines/purl/#identifying-rpm-packages
Here is an excerpt from the state I saw when I checked it. (2025-06-17T06:00:00+09:00)
{
"document": {
...
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-4948.json"
}
],
"title": "libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup",
"tracking": {
"current_release_date": "2025-06-09T09:56:21+00:00",
"generator": {
"date": "2025-06-09T09:56:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.1"
}
},
"id": "CVE-2025-4948",
"initial_release_date": "2025-05-19T00:00:00+00:00",
"revision_history": [
{
"date": "2025-05-19T00:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-06-03T13:42:53+00:00",
"number": "2",
"summary": "Current version"
},
{
"date": "2025-06-09T09:56:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux 6",
"product": {
"name": "Red Hat Enterprise Linux 6",
"product_id": "red_hat_enterprise_linux_6",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux 6"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux 7",
"product": {
"name": "Red Hat Enterprise Linux 7",
"product_id": "red_hat_enterprise_linux_7",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux 7"
},
...
{
"category": "product_version",
"name": "libsoup",
"product": {
"name": "libsoup",
"product_id": "libsoup",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup"
}
}
},
...
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
...
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup as a component of Red Hat Enterprise Linux 6",
"product_id": "red_hat_enterprise_linux_6:libsoup"
},
"product_reference": "libsoup",
"relates_to_product_reference": "red_hat_enterprise_linux_6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup as a component of Red Hat Enterprise Linux 7",
"product_id": "red_hat_enterprise_linux_7:libsoup"
},
"product_reference": "libsoup",
"relates_to_product_reference": "red_hat_enterprise_linux_7"
}
]
},
"vulnerabilities": [
{
...
"cve": "CVE-2025-4948",
...
"product_status": {
...
"known_affected": [
"red_hat_enterprise_linux_6:libsoup",
"red_hat_enterprise_linux_7:libsoup"
]
},
...
"remediations": [
...
{
"category": "no_fix_planned",
"details": "Out of support scope",
"product_ids": [
"red_hat_enterprise_linux_6:libsoup"
]
},
{
"category": "none_available",
"details": "Affected",
"product_ids": [
"red_hat_enterprise_linux_7:libsoup"
]
}
],
...
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-4948.json
I was expecting `"product_id": "libsoup"` to have `arch=src` in the PURL.
Is the omission of arch intentional?
Incidentally, arch was also omitted in the rsync for CVE-2016-9840 in the past.
However, now `arch=src` has been added.
- before
{
"category": "product_version",
"name": "rsync",
"product": {
"name": "rsync",
"product_id": "rsync",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync"
}
}
}
- after
{
"category": "product_version",
"name": "rsync",
"product": {
"name": "rsync",
"product_id": "rsync",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync?arch=src"
}
}
}
https://security.access.redhat.com/data/csaf/v2/vex/2016/cve-2016-9840.json
