Support Windows PE metadata parsing for Python binaries

cve_bin_tool/checkers/openssl.py

@@ -18,6 +18,9 @@ class OpensslChecker(Checker):
     CONTAINS_PATTERNS = [r"part of OpenSSL", r"openssl.cnf", r"-DOPENSSL_"]
     FILENAME_PATTERNS = [r"libssl.so.", r"libcrypto.so"]
     VERSION_PATTERNS = [
+        # for general format: OpenSSL 1.0.2u�BOpenSSL 3.0.0�BOpenSSL 1.1.1k
+        r"OpenSSL\s+([0-9]+\.[0-9]+\.[0-9]+[a-z]*)",
+
         r"OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+\r?\n(?:%s \(Library: %s\)|[a-zA-Z0-9:,_ \.\-\r\n]*OPENSSLDIR|ssl)",
         r"(?:%s \(Library: %s\)\r?\n|OPENSSLDIR[a-zA-Z0-9:/ \"\-\r\n]*)OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+",
     ]

cve_bin_tool/checkers/python.py

@@ -19,6 +19,9 @@ class PythonChecker(Checker):
     ]
     FILENAME_PATTERNS = [r"python"]
     VERSION_PATTERNS = [
+        # to match the data from PE file
+        r"[Pp]ython ([0-9]+\.[0-9]+\.[0-9]+)",
+
         r"src\\python[23]\\Python-([23]+\.[0-9]+\.[0-9]+)",
         r"python(?:[23]+\.[0-9]+)-([23]+\.[0-9]+\.[0-9]+)",
         r"pymalloc_debug\r?\n([23]+\.[0-9]+\.[0-9]+)",

cve_bin_tool/version_scanner.py

@@ -231,6 +231,27 @@ def is_linux_kernel(self, filename: str) -> tuple[bool, str | None]:
 
         return False, output
 
+	# used to get product name, version, vendor info PE metadata
+    def extract_version_from_pe(self, filename: str) -> str:
+        info = ""
+        try:
+            import pefile
+            with pefile.PE(filename) as pe:
+            #pe = pefile.PE(filename)
+                for fileinfo in pe.FileInfo:
+                    for entry in fileinfo:
+                        if entry.Key == b'StringFileInfo':
+                            for st in entry.StringTable:
+                                entries = st.entries
+                                product_name = entries.get(b'ProductName', b'').decode(errors='ignore')
+                                product_version = entries.get(b'ProductVersion', b'').decode(errors='ignore')
+                                company_name = entries.get(b'CompanyName', b'').decode(errors='ignore')
+                                info = (f" {product_name} {product_version} {company_name}")
+                                self.logger.debug(f"peFile.PE Metadata:{info}")
+        except Exception as e:
+            LOGGER.debug(f"[PE Metadata] Failed to parse PE file {filename}: {e}")
+        return info
+
     def scan_file(self, filename: str) -> Iterator[ScanInfo]:
         """Scans a file to see if it contains any of the target libraries,
         and whether any of those contain CVEs"""
@@ -261,6 +282,7 @@ def scan_file(self, filename: str) -> Iterator[ScanInfo]:
 
         # parse binary file's strings
         lines = parse_strings(filename)
+        lines += self.extract_version_from_pe(filename)
 
         if self.no_scan:
             yield from self.run_checkers(filename, lines)