fix dpkg epoch zero-vs-auto bug

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

Author: wagoodman

grype/matcher/dpkg/matcher_ubuntu_esm_test.go

@@ -316,10 +316,6 @@ func TestUbuntuESM_MultipleCVEsPerPackage(t *testing.T) {
 // always-vulnerable "None" row, so the constraint check never resolves it (the RHEL EUS path has the same gap). This
 // test intentionally asserts the correct behavior so it stays red until fix-version comparison honors the strategy.
 func TestUbuntuESM_MissingEpochStrategy(t *testing.T) {
-	t.Skip("known gap: ESM/EUS fix-version comparison ignores MissingEpochStrategy (neededFixes -> version.Is and " +
-		"search.ByFixedVersion use plain Compare). Assertions below encode the correct behavior; remove this skip once " +
-		"fix-version comparison honors the strategy.")
-
 	const (
 		cve = "CVE-2025-61985"
 		// installed at the same build as the fix "1:8.2p1-4ubuntu0.13+esm1" but with no epoch prefix
@@ -344,7 +340,10 @@ func TestUbuntuESM_MissingEpochStrategy(t *testing.T) {
 
 				findings := db.Match(t, matcher, p)
 				if tt.expectResolve {
+					// installed is the fixed build: no match, and a "Distro Not Vulnerable" ignore is emitted instead
 					findings.SkipCompleteness().DoesNotHaveAnyVulnerabilities(cve)
+					findings.Ignores().
+						SelectRelatedPackageIgnore(IgnoreReasonDistroNotVulnerable, cve)
 				} else {
 					findings.SkipCompleteness().SelectMatch(cve)
 				}

grype/matcher/rpm/rhel_eus_test.go

@@ -1053,6 +1053,41 @@ func TestRedhatEUSMatches_LowerReachableFixResolvesDespiteHigherFix(t *testing.T
 		})
 }
 
+// TestRedhatEUSMatches_MissingEpochStrategy documents that the rpm EUS binary path deliberately does NOT behave like
+// the dpkg ESM path for a missing epoch - so RHEL EUS does not share the deb epoch bug (see the dpkg twin
+// TestUbuntuESM_MissingEpochStrategy).
+//
+// nginx on 9.4+eus is fixed at "1:1.20.1-14.el9_4" (non-zero epoch); the installed build is the same but omits the
+// epoch. Unlike dpkg, the rpm binary matcher fills a missing epoch with an explicit 0 (matchPackage ->
+// addEpochIfApplicable), because per RedHat a binary rpm with no epoch genuinely IS epoch 0. That makes the install
+// "0:1.20.1-14.el9_4", which is a real, older version lineage than the epoch-1 fix, so the package is correctly
+// reported vulnerable under BOTH strategies - auto never fires because the epoch is explicit (not missing) by the
+// time comparison happens. (auto only matters on the rpm source/upstream path, which drops epochs on purpose.)
+func TestRedhatEUSMatches_MissingEpochStrategy(t *testing.T) {
+	const (
+		cve = "CVE-2024-7347"
+		// same build as the fix "1:1.20.1-14.el9_4" but with no epoch prefix; the binary matcher normalizes this to 0:
+		installedNoEpoch = "1.20.1-14.el9_4"
+	)
+
+	// both strategies report vulnerable: the missing epoch is normalized to an explicit 0, so 0:... < 1:... regardless
+	for _, strategy := range []version.MissingEpochStrategy{version.MissingEpochStrategyZero, version.MissingEpochStrategyAuto} {
+		t.Run(string(strategy), func(t *testing.T) {
+			dbtest.DBs(t, "rhel9-eus").
+				SelectOnly(cve).
+				Run(func(t *testing.T, db *dbtest.DB) {
+					matcher := NewRpmMatcher(MatcherConfig{MissingEpochStrategy: strategy})
+					p := dbtest.NewPackage("nginx", installedNoEpoch, syftPkg.RpmPkg).
+						WithDistro(newEUSDistro("9.4")).
+						Build()
+
+					findings := db.Match(t, matcher, p)
+					findings.SkipCompleteness().SelectMatch(cve)
+				})
+		})
+	}
+}
+
 // newEUSDistro creates a properly initialized RHEL EUS distro using distro.New().
 // This ensures MajorVersion()/MinorVersion() work correctly.
 // Pass version like "9.4" (the "+eus" channel suffix is added automatically).

grype/matcher/rpm/testdata/rhel9-eus/db.yaml

@@ -16,3 +16,5 @@ extractions:
         - rhel:8/cve-2016-9840
         - rhel:8/cve-2020-7788
         - rhel:8.4+eus/cve-2020-7788
+        - rhel:9/cve-2024-7347
+        - rhel:9.4+eus/cve-2024-7347

grype/matcher/rpm/testdata/rhel9-eus/rhel/results/rhel@9.4+eus/cve-2024-7347.json

@@ -0,0 +1,36 @@
+{
+  "identifier": "rhel:9.4+eus/cve-2024-7347",
+  "item": {
+    "Vulnerability": {
+      "Description": "nginx: synthetic EUS fixture record fixed on rhel:9.4+eus at a non-zero epoch (1:). Paired with the rhel:9 \"None\" base record to exercise MissingEpochStrategy on the EUS fix-comparison path.",
+      "FixedIn": [
+        {
+          "Available": {
+            "date": "2026-04-22",
+            "kind": "first-observed"
+          },
+          "Module": null,
+          "Name": "nginx",
+          "NamespaceName": "rhel:9.4+eus",
+          "VendorAdvisory": {
+            "AdvisorySummary": [
+              {
+                "ID": "RHSA-2026:0001",
+                "Link": "https://access.redhat.com/errata/RHSA-2026:0001"
+              }
+            ],
+            "NoAdvisory": false
+          },
+          "Version": "1:1.20.1-14.el9_4",
+          "VersionFormat": "rpm"
+        }
+      ],
+      "Link": "https://access.redhat.com/security/cve/CVE-2024-7347",
+      "Metadata": {},
+      "Name": "CVE-2024-7347",
+      "NamespaceName": "rhel:9.4+eus",
+      "Severity": "Medium"
+    }
+  },
+  "schema": "https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.1.0.json"
+}

grype/matcher/rpm/testdata/rhel9-eus/rhel/results/rhel@9/cve-2024-7347.json

@@ -0,0 +1,27 @@
+{
+  "identifier": "rhel:9/cve-2024-7347",
+  "item": {
+    "Vulnerability": {
+      "Description": "nginx: synthetic EUS fixture record for a package that carries a non-zero rpm epoch. The base rhel:9 pocket has no fix (Version \"None\"); the fix is only published on 9.4+eus. Used to exercise MissingEpochStrategy on the EUS fix-comparison path (auto vs zero) when the installed version omits the epoch the fix carries.",
+      "FixedIn": [
+        {
+          "Module": null,
+          "Name": "nginx",
+          "NamespaceName": "rhel:9",
+          "VendorAdvisory": {
+            "AdvisorySummary": [],
+            "NoAdvisory": false
+          },
+          "Version": "None",
+          "VersionFormat": "rpm"
+        }
+      ],
+      "Link": "https://access.redhat.com/security/cve/CVE-2024-7347",
+      "Metadata": {},
+      "Name": "CVE-2024-7347",
+      "NamespaceName": "rhel:9",
+      "Severity": "Medium"
+    }
+  },
+  "schema": "https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.1.0.json"
+}

grype/search/version_constraint.go

@@ -69,12 +69,14 @@ func ByFixedVersion(v version.Version) vulnerability.Criteria {
 				return false, "", nil
 			}
 			for _, fixVersion := range vuln.Fix.Versions {
-				cmp, e := version.New(fixVersion, v.Format).Compare(&v)
+				// compare with v (the package) as the receiver so its embedded ComparisonConfig (e.g. missing-epoch
+				// strategy) is honored; cmp >= 0 means the installed version is at or past the fix, so it is fixed.
+				cmp, e := v.Compare(version.New(fixVersion, v.Format))
 				if e != nil {
 					err = e
 				}
-				if cmp <= 0 {
-					// fix version is less than or equal to the provided version, so is considered fixed
+				if cmp >= 0 {
+					// installed version is greater than or equal to the fix version, so is considered fixed
 					return true, fmt.Sprintf("fix version %v is less than %v", v, fixVersion), err
 				}
 			}

grype/version/version.go

@@ -90,6 +90,21 @@ func (v Version) String() string {
 	return fmt.Sprintf("%s (%s)", v.Raw, v.Format)
 }
 
+// compareUsing runs the comparison honoring v's embedded ComparisonConfig for formats that support it
+// (currently rpm/deb missing-epoch handling), falling back to a plain comparison otherwise. v is always the
+// package side, other the constraint/fix side, matching CompareWithConfig's asymmetric auto-epoch semantics.
+func (v Version) compareUsing(comparator Comparator, other *Version) (int, error) {
+	if v.Config.MissingEpochStrategy != "" {
+		switch c := comparator.(type) {
+		case rpmVersion:
+			return c.CompareWithConfig(other, v.Config)
+		case debVersion:
+			return c.CompareWithConfig(other, v.Config)
+		}
+	}
+	return comparator.Compare(other)
+}
+
 // Compare compares this version to another version.
 // This returns -1, 0, or 1 if this version is smaller,
 // equal, or larger than the other version, respectively.
@@ -102,7 +117,7 @@ func (v Version) Compare(other *Version) (int, error) {
 	comparator, err := v.getComparator(v.Format)
 	if err == nil {
 		// if the package version, v was able to compare without error, return the result
-		result, err = comparator.Compare(other)
+		result, err = v.compareUsing(comparator, other)
 		if err == nil {
 			// no error returned for package version or db version, return the result
 			return result, nil
@@ -113,7 +128,7 @@ func (v Version) Compare(other *Version) (int, error) {
 		originalErr := err
 		comparator, err = v.getComparator(other.Format)
 		if err == nil {
-			result, err = comparator.Compare(other)
+			result, err = v.compareUsing(comparator, other)
 			if err == nil {
 				return result, nil
 			}
@@ -138,7 +153,7 @@ func (v *Version) Is(op Operator, other *Version) (bool, error) {
 		return false, fmt.Errorf("unable to get comparator for %s: %w", v.Format, err)
 	}
 
-	result, err := comparator.Compare(other)
+	result, err := v.compareUsing(comparator, other)
 	if err != nil {
 		return false, fmt.Errorf("unable to compare versions %s and %s: %w", v, other, err)
 	}

grype/version/version_test.go

@@ -361,3 +361,58 @@ func TestVersion_Is_AllOperators(t *testing.T) {
 		})
 	}
 }
+
+// TestVersion_Compare_HonorsEmbeddedConfig verifies that Version.Compare and Version.Is route through the
+// config-aware comparison when the receiver carries a MissingEpochStrategy (deb/rpm), rather than silently
+// ignoring it. The classic case: an installed version missing the epoch that the constraint/fix carries.
+func TestVersion_Compare_HonorsEmbeddedConfig(t *testing.T) {
+	tests := []struct {
+		name     string
+		format   Format
+		pkg      string // receiver (package), missing epoch
+		other    string // fix/constraint, carries epoch
+		strategy MissingEpochStrategy
+		wantCmp  int
+	}{
+		{
+			name:     "deb auto adopts constraint epoch - equal builds compare equal",
+			format:   DebFormat,
+			pkg:      "8.2p1-4ubuntu0.13+esm1",
+			other:    "1:8.2p1-4ubuntu0.13+esm1",
+			strategy: MissingEpochStrategyAuto,
+			wantCmp:  0,
+		},
+		{
+			name:     "deb zero treats missing epoch as 0 - lower than epoch 1",
+			format:   DebFormat,
+			pkg:      "8.2p1-4ubuntu0.13+esm1",
+			other:    "1:8.2p1-4ubuntu0.13+esm1",
+			strategy: MissingEpochStrategyZero,
+			wantCmp:  -1,
+		},
+		{
+			name:     "rpm auto adopts constraint epoch - equal builds compare equal",
+			format:   RpmFormat,
+			pkg:      "5.14.0-427.68.1.el9_4",
+			other:    "1:5.14.0-427.68.1.el9_4",
+			strategy: MissingEpochStrategyAuto,
+			wantCmp:  0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pkgV := NewWithConfig(tt.pkg, tt.format, ComparisonConfig{MissingEpochStrategy: tt.strategy})
+			other := New(tt.other, tt.format)
+
+			cmp, err := pkgV.Compare(other)
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantCmp, cmp, "Compare")
+
+			// Is must agree with Compare (spot-check the equality operator)
+			isEq, err := pkgV.Is(EQ, other)
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantCmp == 0, isEq, "Is(EQ)")
+		})
+	}
+}