fix: skip processing of duplicate products

don't add duplicate affected packages to extended response

vmaas/vulnerabilities.go

@@ -186,7 +186,14 @@ func evaluate(c *Cache, opts *options, request *Request) (*VulnerabilitiesCvesDe
 
 func evaluateUnpatchedCves(c *Cache, products []ProductsPackage, cves *VulnerabilitiesCvesDetails) {
 	for _, pp := range products {
+		seenProducts := make(map[CSAFProduct]bool, len(pp.ProductsUnfixed))
 		for _, product := range pp.ProductsUnfixed {
+			if seenProducts[product] {
+				// duplicate product in pp.ProductsUnfixed
+				// skip processing of already processed product
+				continue
+			}
+			seenProducts[product] = true
 			module := product.ModuleStream
 			cn := CpeIDNameID{CpeID: product.CpeID, NameID: product.PackageNameID}
 			csafCves := c.CSAFCVEs[cn][product]
@@ -210,7 +217,14 @@ func evaluateUnpatchedCves(c *Cache, products []ProductsPackage, cves *Vulnerabi
 func evaluateManualCves(c *Cache, products []ProductsPackage, cves *VulnerabilitiesCvesDetails) {
 	for _, pp := range products {
 		pp := pp // make copy because &pp is used
+		seenProducts := make(map[CSAFProduct]bool, len(pp.ProductsFixed))
 		for _, product := range pp.ProductsFixed {
+			if seenProducts[product] {
+				// duplicate product in pp.ProductsFixed
+				// skip processing of already processed product
+				continue
+			}
+			seenProducts[product] = true
 			updateNevra := pkgID2Nevra(c, product.PackageID)
 			if !isApplicable(c, &updateNevra, &pp.Package.Nevra) {
 				continue
@@ -766,7 +780,21 @@ func updateCves(cves map[string]VulnerabilityDetail, cve string, pkg Package, er
 			affectedPackage.ModuleStreamPtrs.Module = &module.Module
 			affectedPackage.ModuleStreamPtrs.Stream = &module.Stream
 		}
-		vulnDetail.Affected = append(vulnDetail.Affected, affectedPackage)
+		add2response := true
+		for _, a := range vulnDetail.Affected {
+			if a.Cpe == affectedPackage.Cpe && a.EVRA == affectedPackage.EVRA && a.Name == affectedPackage.Name {
+				if a.ModuleStreamPtrs.Module == nil && a.ModuleStreamPtrs.Stream == nil && module == nil {
+					add2response = false
+				}
+				if a.ModuleStreamPtrs.Module != nil && a.ModuleStreamPtrs.Stream != nil && module != nil &&
+					*a.ModuleStreamPtrs.Module == module.Module && *a.ModuleStreamPtrs.Stream == module.Stream {
+					add2response = false
+				}
+			}
+		}
+		if add2response {
+			vulnDetail.Affected = append(vulnDetail.Affected, affectedPackage)
+		}
 	}
 	cves[cve] = vulnDetail
 }