fix: check if there are no metrics on NVD before attempting to add to Alpine/Debian records (#4044)

Author: jess-lowe

vulnfeeds/cmd/alpine/main.go

@@ -36,7 +36,7 @@ func main() {
 	logger.InitGlobalLogger()
 
 	alpineOutputPath := flag.String(
-		"alpineOutput",
+		"output_path",
 		alpineOutputPathDefault,
 		"path to output general alpine affected package information")
 	outputBucketName := flag.String("output_bucket", outputBucketDefault, "The GCS bucket to write to.")
@@ -220,7 +220,10 @@ func generateAlpineOSV(allAlpineSecDb map[string][]VersionAndPkg, allCVEs map[cv
 			logger.Warn(fmt.Sprintf("Skipping %s as no affected versions found.", v.ID), slog.String("cveID", cveID))
 			continue
 		}
-		v.AddSeverity(cve.CVE.Metrics)
+		if cve.CVE.Metrics != nil {
+			v.AddSeverity(cve.CVE.Metrics)
+		}
+
 		osvVulnerabilities = append(osvVulnerabilities, v)
 	}
 

vulnfeeds/cmd/debian/main.go

@@ -143,7 +143,10 @@ func generateOSVFromDebianTracker(debianData DebianSecurityTrackerData, debianRe
 						},
 					},
 				}
-				v.AddSeverity(currentNVDCVE.CVE.Metrics)
+				if currentNVDCVE.CVE.Metrics != nil {
+					v.AddSeverity(currentNVDCVE.CVE.Metrics)
+				}
+
 				osvCves[cveID] = v
 			}