Description:
We have observed an inconsistency in repository-to-CPE mapping between RHEL 8 and RHEL 9.

• For RHEL 8:

• • cpe:/a:redhat:enterprise_linux:8::appstream

• • cpe:/o:redhat:enterprise_linux:8::baseos
    → Both are pointing to the E4S repo.

• For RHEL 9:

• • cpe:/a:redhat:enterprise_linux:9::appstream

• • cpe:/o:redhat:enterprise_linux:9::baseos
    → These are not pointing to the E4S repo.

Expected Behavior:
CPE-to-repo mappings should be consistent across RHEL 8 and RHEL 9 unless there is a deliberate difference.

Actual Behavior:

• In RHEL 8, CPEs are mapped to multiple repos, including E4S repos.

• However, advisories such as RHSA-2024:6148 do not list E4S systems under "Affected Products", even though the CSAF data maps CPEs to E4S repos.

• This creates an inconsistency between the advisory metadata and the repository-to-CPE mapping.

Supporting Data:
From repository-to-cpe.json:
 
 
{{cpe:/a:redhat:enterprise_linux:8::appstream
rhel-8-for-aarch64-appstream-debug-rpms
rhel-8-for-aarch64-appstream-rpms
rhel-8-for-aarch64-appstream-source-rpms
rhel-8-for-ppc64le-appstream-debug-rpms
rhel-8-for-ppc64le-appstream-e4s-debug-rpms
rhel-8-for-ppc64le-appstream-e4s-rpms
rhel-8-for-ppc64le-appstream-e4s-source-rpms
rhel-8-for-ppc64le-appstream-rpms
rhel-8-for-ppc64le-appstream-source-rpms
rhel-8-for-s390x-appstream-debug-rpms
rhel-8-for-s390x-appstream-rpms
rhel-8-for-s390x-appstream-source-rpms
rhel-8-for-x86_64-appstream-debug-rpms
rhel-8-for-x86_64-appstream-e4s-debug-rpms
rhel-8-for-x86_64-appstream-e4s-rpms
rhel-8-for-x86_64-appstream-e4s-source-rpms
rhel-8-for-x86_64-appstream-rpms
rhel-8-for-x86_64-appstream-source-rpms}}
Additional References:
Examples of advisories where similar behavior is observed:

• RHSA-2024:6000

• • UI: link

• • CSAF: link

• RHSA-2024:6001

• • UI: link

• • CSAF: link

• RHSA-2024:6018

• • UI: link

• • CSAF: link

Request:
Please confirm whether the mapping of RHEL 8 AppStream/BaseOS CPEs to E4S repos is intentional. If not, should the mapping or advisory data be corrected to ensure consistency?