Unfixed CVEs from Googles OSV affecting all versions are not found

### Current Behavior

For example UBUNTU-CVE-2021-26318 is not matched to amd64-microcode version 3.20191218.1ubuntu2.2, but this version is mentioned in the osv CVE report:

```
{
"vulns": [
{
"id": "UBUNTU-CVE-2021-26318",
"details": "A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information.",
"modified": "2025-04-23T15:01:25Z",
"published": "2021-10-13T19:15:00Z",
"related": [
"CVE-2021-26318"
],
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-26318"
},
{
"type": "REPORT",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1017"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26318"
}
],
"affected": [
{
"package": {
"name": "amd64-microcode",
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"purl": "pkg:deb/ubuntu/amd64-microcode@3.20180524.1~ubuntu0.14.04.2+really20130710.1ubuntu1?arch=source&distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"versions": [
"1.20120910-3",
"2.20131007.1+really20130710.1",
"3.20180524.1~ubuntu0.14.04.1",
"3.20180524.1~ubuntu0.14.04.2+really20130710.1",
"3.20180524.1~ubuntu0.14.04.2+really20130710.1ubuntu1"
],
"ecosystem_specific": {
"ubuntu_priority": "medium"
},
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26318.json"
}
},
{
"package": {
"name": "amd64-microcode",
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"purl": "pkg:deb/ubuntu/amd64-microcode@3.20191021.1+really3.20180524.1~ubuntu0.16.04.2+esm3?arch=source&distro=esm-infra/xenial"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"versions": [
"2.20141028.1",
"2.20160316.1",
"3.20180524.1~ubuntu0.16.04.1",
"3.20180524.1~ubuntu0.16.04.2",
"3.20191021.1ubuntu0.16.04.1",
"3.20191021.1+really3.20180524.1~ubuntu0.16.04.2",
"3.20191021.1+really3.20180524.1~ubuntu0.16.04.2+esm1",
"3.20191021.1+really3.20180524.1~ubuntu0.16.04.2+esm2",
"3.20191021.1+really3.20180524.1~ubuntu0.16.04.2+esm3"
],
"ecosystem_specific": {
"ubuntu_priority": "medium"
},
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26318.json"
}
},
{
"package": {
"name": "amd64-microcode",
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"purl": "pkg:deb/ubuntu/amd64-microcode@3.20191021.1+really3.20181128.1~ubuntu0.18.04.1+esm3?arch=source&distro=esm-infra/bionic"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"versions": [
"3.20160316.3",
"3.20171205.1",
"3.20180524.1~ubuntu0.18.04.1",
"3.20180524.1~ubuntu0.18.04.2",
"3.20191021.1ubuntu0.18.04.2",
"3.20191021.1+really3.20181128.1~ubuntu0.18.04.1",
"3.20191021.1+really3.20181128.1~ubuntu0.18.04.1+esm1",
"3.20191021.1+really3.20181128.1~ubuntu0.18.04.1+esm2",
"3.20191021.1+really3.20181128.1~ubuntu0.18.04.1+esm3"
],
"ecosystem_specific": {
"ubuntu_priority": "medium"
},
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26318.json"
}
},
{
"package": {
"name": "amd64-microcode",
"ecosystem": "Ubuntu:20.04:LTS",
"purl": "pkg:deb/ubuntu/amd64-microcode@3.20191218.1ubuntu1.3?arch=source&distro=focal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"versions": [
"3.20181128.1ubuntu2",
"3.20191021.1ubuntu1",
"3.20191218.1ubuntu1",
"3.20191218.1ubuntu1.1",
"3.20191218.1ubuntu1.2",
"3.20191218.1ubuntu1.3"
],
"ecosystem_specific": {
"ubuntu_priority": "medium"
},
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26318.json"
}
},
{
"package": {
"name": "amd64-microcode",
"ecosystem": "Ubuntu:22.04:LTS",
"purl": "pkg:deb/ubuntu/amd64-microcode@3.20191218.1ubuntu2.3?arch=source&distro=jammy"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"versions": [
"3.20191218.1ubuntu2",
"3.20191218.1ubuntu2.1",
"3.20191218.1ubuntu2.2",
"3.20191218.1ubuntu2.3"
],
"ecosystem_specific": {
"ubuntu_priority": "medium"
},
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26318.json"
}
},
{
"package": {
"name": "amd64-microcode",
"ecosystem": "Ubuntu:24.10",
"purl": "pkg:deb/ubuntu/amd64-microcode@3.20240116.2+nmu1ubuntu1.1?arch=source&distro=oracular"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"versions": [
"3.20231019.1ubuntu2",
"3.20240116.2+nmu1ubuntu1",
"3.20240116.2+nmu1ubuntu1.1"
],
"ecosystem_specific": {
"ubuntu_priority": "medium"
},
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26318.json"
}
},
{
"package": {
"name": "amd64-microcode",
"ecosystem": "Ubuntu:24.04:LTS",
"purl": "pkg:deb/ubuntu/amd64-microcode@3.20231019.1ubuntu2.1?arch=source&distro=noble"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"versions": [
"3.20230808.1.1ubuntu1",
"3.20231019.1ubuntu1",
"3.20231019.1ubuntu2",
"3.20231019.1ubuntu2.1"
],
"ecosystem_specific": {
"ubuntu_priority": "medium"
},
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26318.json"
}
},
{
"package": {
"name": "amd64-microcode",
"ecosystem": "Ubuntu:25.04",
"purl": "pkg:deb/ubuntu/amd64-microcode@3.20240820.1ubuntu1?arch=source&distro=plucky"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"versions": [
"3.20240116.2+nmu1ubuntu1",
"3.20240116.2+nmu1ubuntu1.1",
"3.20240820.1ubuntu1"
],
"ecosystem_specific": {
"ubuntu_priority": "medium"
},
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26318.json"
}
}
],
"schema_version": "1.6.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
]
}
]
}
```

### Steps to Reproduce

1. Upload a SBOM with amd64-microcode version 3.20191218.1ubuntu2.2. Use: [empty-ubuntu-22.04-aws-v4.sbom.json](https://github.com/user-attachments/files/20185107/empty-ubuntu-22.04-aws-v4.sbom.json)
2. UBUNTU-CVE-2021-26318 is not shown

### Expected Behavior

UBUNTU-CVE-2021-26318 should be shown. Ranges the event "introduced" with "0" and no "fixed" event are present, see in section "Current Behavior", which should be interpreted as all versions affected [](https://ossf.github.io/osv-schema/#unfixed-vulnerability-example ). Also the affected versions are listed.

But since there is a range present, no single versions are parsed (in OsvAdvisoryParser class) and this range is added as VERSIONSTARTINCLUDING=null and VERSIONENDINCLUDING=null/VERSIONSTARTEXCLUDING=null (in OsvDownloadTask).

Already skipping the dedicated versions is a bug (see [](https://ossf.github.io/osv-schema/#evaluation)) since both, the range and the dedicated versions should be added.

The main problem is in class AbstractVulnerableSoftwareAnalysisTask because the infinite range (with VERSIONSTARTINCLUDING=null and VERSIONENDINCLUDING=null/VERSIONSTARTEXCLUDING=null) is interpreted as if there is no version range to check at all.

### Dependency-Track Version

4.13.0

### Dependency-Track Distribution

Container Image

### Database Server

H2

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported