fix: update libjpeg-turbo checker (#5278)

Add missing + in libjpeg-turbo pattern to avoid truncating latest digit
of version (e.g, 3.0.9 instead of 3.0.90)

Moreover, also update pattern to catch version on 4 digits

This issue is present since the addition of the checker in 2019

Fix 8089472

Signed-off-by: Fabrice Fontaine <[email protected]>

Author: ffontaine

cve_bin_tool/checkers/libjpeg_turbo.py

@@ -19,7 +19,7 @@ class LibjpegTurboChecker(Checker):
         r"Invalid JPEG file structure: two SOF markers",
     ]
     FILENAME_PATTERNS = [r"libjpg.so."]
-    VERSION_PATTERNS = [r"libjpeg-turbo version ([0-9]\.[0-9]\.[0-9])"]
+    VERSION_PATTERNS = [r"libjpeg-turbo version ([0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?)"]
     VENDOR_PRODUCT = [
         ("d.r.commander", "libjpeg-turbo"),
         ("libjpeg-turbo", "libjpeg-turbo"),

test/condensed-downloads/libjpeg-turbo-2.1.5.1-r3.apk.tar.gz

@@ -33,4 +33,11 @@
         "version": "2.1.2",
         "other_products": ["libjpeg"],
     },
+    {
+        "url": "https://dl-cdn.alpinelinux.org/alpine/v3.18/main/aarch64/",
+        "package_name": "libjpeg-turbo-2.1.5.1-r3.apk",
+        "product": "libjpeg-turbo",
+        "version": "2.1.5.1",
+        "other_products": ["gcc", "libjpeg"],
+    },
 ]