POST: matching vulnerabilities to packages is not easy

This would be a post to explain the issues in https://github.com/aboutcode-org/dejacode/discussions/302#discussioncomment-12995054

Links:
- Initial publication https://github.com/Valentin-Metz/writeup_split
- https://www.openwall.com/lists/oss-security/2024/01/18/2
- Introduced by https://github.com/coreutils/coreutils/commit/40bf1591bb4362fa91e501bcec7c2029c5f65a43#diff-30bc328ab3afa0ab9f17c6e7cf1752d558ae37cf4200e95bbb04c405c2b59518L821
- Initial coreutils patch https://github.com/coreutils/coreutils/commit/c4c5ed8f4.patch
- https://github.com/coreutils/coreutils/blob/3a5c9c5537227eafc38c5657024584cdad63112a/NEWS#L204
- Red Hat https://bugzilla.redhat.com/show_bug.cgi?id=2258948
- CVE.org https://github.com/CVEProject/cvelistV5/blame/main/cves/2024/0xxx/CVE-2024-0684.json
- SUSE https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-0684
- Debian https://security-tracker.debian.org/tracker/CVE-2024-0684 and https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061138
- Ubuntu https://ubuntu.com/security/CVE-2024-0684
- Fedora FC39 and FC40 https://bugzilla.redhat.com/show_bug.cgi?id=2258913 and https://bodhi.fedoraproject.org/updates/FEDORA-2024-6b85e8848f and https://bodhi.fedoraproject.org/updates/FEDORA-2024-7e5ca38c70
- Gentoo https://bugs.gentoo.org/show_bug.cgi?id=CVE-2024-0684
- NVD with history https://nvd.nist.gov/vuln/detail/CVE-2024-0684#VulnChangeHistorySection
https://github.com/coreutils/coreutils/blob/3a5c9c5537227eafc38c5657024584cdad63112a/NEWS#L204

Why does this matter? The upstream report was clear on affected and fixed version. Downstream advisories make the issue less clear and a source of possible confusion.