[00:37] <blahdeblah> Ah, looks like the source of the confusion is a bug in cvescan: https://github.com/canonical/sec-cvescan/issues/81