feat(ubuntu): Expose Ubuntu fix status.

docs/docs/configuration/filtering.md

@@ -184,6 +184,7 @@ Some statuses are supported in limited distributions.
 |:----------:|:-----:|:--------:|:-------------------:|:------------:|:------------:|:-----------:|
 |   Debian   |   ✓   |    ✓     |                     |              |      ✓       |      ✓      |
 |    RHEL    |   ✓   |    ✓     |          ✓          |      ✓       |      ✓       |      ✓      |
+|   Ubuntu   |   ✓   |          |                     |      ✓       |      ✓       |             |
 | Other OSes |   ✓   |    ✓     |                     |              |              |             |
 
 

docs/docs/coverage/os/ubuntu.md

@@ -44,10 +44,10 @@ Trivy supports the following [vulnerability statuses] for Ubuntu.
 |       Status        | Supported |
 | :-----------------: | :-------: |
 |        Fixed        |     ✓     |
-|      Affected       |     ✓     |
+|      Affected       |           |
 | Under Investigation |           |
-|    Will Not Fix     |           |
-|    Fix Deferred     |           |
+|    Will Not Fix     |     ✓     |
+|    Fix Deferred     |     ✓     |
 |     End of Life     |           |
 
 ## License

integration/standalone_tar_test.go

@@ -214,6 +214,14 @@ func TestTar(t *testing.T) {
 			},
 			golden: "testdata/debian-stretch.json.golden",
 		},
+		{
+			name: "ubuntu 16.04",
+			args: args{
+				Format: types.FormatJSON,
+				Input:  "testdata/fixtures/images/ubuntu-1604.tar.gz",
+			},
+			golden: "testdata/ubuntu-1804.json.golden",
+		},
 		{
 			name: "ubuntu 18.04",
 			args: args{

integration/testdata/fixtures/db/data-source.yaml

@@ -139,6 +139,11 @@
         ID: "ubuntu"
         Name: "Ubuntu CVE Tracker"
         URL: "https://git.launchpad.net/ubuntu-cve-tracker"
+    - key: ubuntu 21.10
+      value:
+        ID: "ubuntu"
+        Name: "Ubuntu CVE Tracker"
+        URL: "https://git.launchpad.net/ubuntu-cve-tracker"
     - key: CBL-Mariner 1.0
       value:
         ID:   "cbl-mariner"

integration/testdata/fixtures/db/ubuntu.yaml

@@ -12,6 +12,13 @@
         - key: CVE-2019-5094
           value:
             FixedVersion: 1.44.1-1ubuntu1.2
+- bucket: ubuntu 16.04
+  pairs:
+    - bucket: libspring-java
+      pairs:
+        - key: CVE-2022-22965
+          value:
+            Status: fix_deferred
 - bucket: ubuntu 22.04
   pairs:
     - bucket: bash

pkg/detector/ospkg/ubuntu/testdata/fixtures/ubuntu.yaml

@@ -15,6 +15,7 @@
         - key: CVE-2019-9243
           value:
             FixedVersion: ""
+            Status: 6 #this is the code for deferred
         - key: CVE-2016-4476
           value:
             FixedVersion: "2.4-0ubuntu10"

pkg/detector/ospkg/ubuntu/ubuntu.go

@@ -103,6 +103,7 @@ func (s *Scanner) Detect(ctx context.Context, osVer string, _ *ftypes.Repository
 				PkgName:          pkg.Name,
 				InstalledVersion: utils.FormatVersion(pkg),
 				FixedVersion:     adv.FixedVersion,
+				Status:           adv.Status,
 				PkgIdentifier:    pkg.Identifier,
 				Layer:            pkg.Layer,
 				Custom:           adv.Custom,

pkg/detector/ospkg/ubuntu/ubuntu_test.go

@@ -57,6 +57,7 @@ func TestScanner_Detect(t *testing.T) {
 					VulnerabilityID:  "CVE-2019-9243",
 					InstalledVersion: "2.9",
 					FixedVersion:     "",
+					Status:           dbTypes.StatusFixDeferred,
 					Layer: ftypes.Layer{
 						DiffID: "sha256:932da51564135c98a49a34a193d6cd363d8fa4184d957fde16c9d8527b3f3b02",
 					},
@@ -108,6 +109,7 @@ func TestScanner_Detect(t *testing.T) {
 					VulnerabilityID:  "CVE-2019-9243",
 					InstalledVersion: "2.9",
 					FixedVersion:     "",
+					Status:           dbTypes.StatusFixDeferred,
 					Layer: ftypes.Layer{
 						DiffID: "sha256:932da51564135c98a49a34a193d6cd363d8fa4184d957fde16c9d8527b3f3b02",
 					},