Add leniancy to the version matching for debian to account for versio…

[jsulinski]

…ns without the "+" when package maintainers aren't using them.

#327

[ghost]

Should be leniantStopLineFound := false?

[jsulinski]

Thanks, fixed.

[kotakanbe]

Applying this P / R may report a false positive of the detected vulnerability.

https://readme.phys.ethz.ch/documentation/debian_version_numbers/

+nmu: Non-maintainer upload (NMU) of a native package

    123+nmu3 = Third non-maintainer upload based on package version 123

Note: The versions of dpkg and changelog do not match

Example:

• dpkg

admin@ip-172-31-7-15:~$ dpkg-query -W tar
tar     1.27.1-2+b1

• changelog

$ aptitude changelog tar | grep '\(urgency\|CVE\)'
tar (1.27.1-2+deb8u1) jessie-security; urgency=high
  * CVE-2016-6321: Bypassing the extract path name.
tar (1.27.1-2) unstable; urgency=low

In the current implementation, since it is detected by version complete match in changelog, Vuls does not detect it when the version of dpkg is not match the version in changelog.

For this reason, there is no false positive in this case.

After applying this P / R, since it matches the string before +, there is a possibility that false positive may occur.

[jsulinski]

That is correct, which is why adding a configuration options for lenient version matching, and adding information to the output about lenient version matching are important.

Keep in mind that this is only checked when version matching fails -- so the options are to either report no vulnerabilities when infact vulnerabilities may exist, or report potential false positives. I'd rather opt for the latter, personally.

Alternatively, we can work with the package maintainers to resolve this issue directly and not add complexity to the vuls code. This may be a better option.

[kotakanbe]

I think that it is better to indicate in the JSON and Reporting that this vulnerability is not detected by accurate version matching.
I will implement this function. I will Merge this P/R after implementation.

[kotakanbe]

I will merge this P/R since additional implementation is complete.
#350