database: cvelist: check for vendor when using packageName

CHANGELOG.md

@@ -5,6 +5,10 @@
 
 ### Fixed
 
+- **Fixed** CVE matching in `cvelistV5` using `packageName` by also considering the
+  `vendor` field to avoid name collisions across vendors ([#16](
+  https://github.com/bootlin/sbom-cve-check/issues/16))
+
 ## v1.2.0
 
 ### Added or Changed

src/sbom_cve_check/database/db_cvelist.py

@@ -220,7 +220,8 @@ def _iterate_applicable_comp_ids(self) -> Generator[CompId, None, None]:
 
                 pkg_name = affected.get("packageName")
                 if pkg_name:
-                    yield CompId(name=pkg_name)
+                    vendor_name = affected.get("vendor")
+                    yield CompId(name=pkg_name, vendor=vendor_name)
 
             # Process cpeMatch blocks
             for cpe_match in self._iterate_cpe_matches(c):

tests/test_analysis.py

@@ -204,3 +204,99 @@ def test_analysis_03(tmp_dir: pathlib.Path) -> None:
     generate_and_check_exports(
         tmp_dir, ["--sbom-path", str(sbom_path)], [exp_build], True
     )
+
+def test_analysis_package_name_collision(tmp_dir: pathlib.Path) -> None:
+    """
+    Test that a CVE from cvelistV5 without CPEs but with a packageName and a vendor
+    matches correctly with package with the same name.
+    1. Same name, same vendor => match
+    2. Same name, different vendor => no match
+    3. Same name, no vendor => match
+
+    Using CVE-2025-31049 (about PHP package dash from themeton).
+    https://github.com/bootlin/sbom-cve-check/issues/16
+    """
+    sbom = Spdx3SbomBuilder()
+    build = sbom.add_recipe("dash_t")
+    sbom.add_packages(
+        build,
+        [
+            SwPackage(
+                name="dash_t",
+                cpes=["cpe:2.3:*:themeton:dash:0.5.12:*:*:*:*:*:*:*"],
+                pkg_version="0.5.12",
+            ),
+        ],
+    )
+    build = sbom.add_recipe("dash_d")
+    sbom.add_packages(
+        build,
+        [
+            SwPackage(
+                name="dash_d",
+                cpes=["cpe:2.3:*:dash:dash:0.5.12:*:*:*:*:*:*:*"],
+                pkg_version="0.5.12",
+            )
+        ],
+    )
+    build = sbom.add_recipe("dash_none")
+    sbom.add_packages(
+        build,
+        [
+            SwPackage(
+                name="dash_none",
+                cpes=["cpe:2.3:*:*:dash:0.5.12:*:*:*:*:*:*:*"],
+                pkg_version="0.5.12",
+            )
+        ],
+    )
+
+    sbom_path = tmp_dir.joinpath("sbom.spdx.json")
+    sbom.write_to_jsonld(sbom_path)
+
+    exp_build = [
+        ExportBuild(
+            build_name="dash_t",
+            vers_ids=CompVersIds(
+                ids=[CompId(vendor="themeton", name="dash")], version="0.5.12"
+            ),
+            cves=[
+                ExportCve(
+                    cve_id="CVE-2025-31049",
+                    status=VexStatus.AFFECTED,
+                    notes="version-in-range",
+                    cvss_scor_31=9.8,
+                    cvss_vect_31="CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                ),
+            ],
+            unexpected_cves=[],
+        ),
+        ExportBuild(
+                build_name="dash_d",
+                vers_ids=CompVersIds(
+                    ids=[CompId(vendor="dash", name="dash")], version="0.5.12"
+                ),
+                cves=[],
+                unexpected_cves=["CVE-2025-31049"],
+        ),
+        ExportBuild(
+            build_name="dash_none",
+            vers_ids=CompVersIds(
+                ids=[CompId(name="dash")], version="0.5.12"
+            ),
+            cves=[
+                ExportCve(
+                    cve_id="CVE-2025-31049",
+                    status=VexStatus.AFFECTED,
+                    notes="version-in-range",
+                    cvss_scor_31=9.8,
+                    cvss_vect_31="CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                ),
+            ],
+            unexpected_cves=[],
+        ),
+    ]
+
+    generate_and_check_exports(
+        tmp_dir, ["--sbom-path", str(sbom_path)], exp_build, True
+    )