fix(detector/cpe): do not overwrite distro advisories

[MaineK00n]

If this Pull Request is work in progress, Add a prefix of “[WIP]” in the title.

What did you implement:

There was a bug where when a vulnerability was detected on a CPE and that vulnerability had already been detected by another method, the information in DistroAdvisories was overwritten, resulting in the loss of the information from the previous detection.
For example, JVNDB-2024-000098 and JVNDB-2024-005553, both of which are related to CVE-2024-7263.

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

setup

$ go-cve-dictionary fetch jvn 2024
$ cat config.toml
...
[servers]
[servers.pseudo]
type = "pseudo"
cpeNames = [
  "cpe:2.3:a:kingsoft:wps_office:v12.2.0.13489:*:*:*:*:*:*:*",
  "cpe:2.3:a:kingsoft:wps_cloud:v11.2.0.10693:*:*:*:*:*:*:*"
]
$ vuls scan

before

$ vuls report --refresh-cve
$ cat results/2024-10-02T03-56-59+0900/pseudo.json | jq '.scannedCves."CVE-2024-7263".distroAdvisories'
[
  {
    "advisoryID": "JVNDB-2024-000098",
    "severity": "",
    "issued": "0001-01-01T00:00:00Z",
    "updated": "0001-01-01T00:00:00Z",
    "description": ""
  }
]

after

$ vuls report --refresh-cve
$ cat results/2024-10-02T03-56-59+0900/pseudo.json | jq '.scannedCves."CVE-2024-7263".distroAdvisories'
[
  {
    "advisoryID": "JVNDB-2024-000098",
    "severity": "",
    "issued": "0001-01-01T00:00:00Z",
    "updated": "0001-01-01T00:00:00Z",
    "description": ""
  },
  {
    "advisoryID": "JVNDB-2024-005553",
    "severity": "",
    "issued": "0001-01-01T00:00:00Z",
    "updated": "0001-01-01T00:00:00Z",
    "description": ""
  }
]

Checklist:

You don't have to satisfy all of the following.

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: YES

Reference

[shino]

Fabulous!