Bug#1001883: security-tracker: Issue with merge-cve-files when entry contains as well en experimental tagged upper suite entry

[Salvatore Bonaccorso <carnil@debian.org>]

Package: security-tracker
Severity: normal
X-Debbugs-Cc: carnil@debian.org,pochu@debian.org

Hi

When there is an entry like:

,---- [ data/CVE/list ]
| CVE-2024-1234 [description]
|         [experimental] - foo 1-1
|         - foo 1-2
|         [bullseye] - foo <no-dsa> (Minor issue)
`----

and an entry to be merged:

,---- [ merge.list ]
| CVE-2024-1234
|         [bullseye] - foo 1-2~deb11u1
`----

$ bin/merge-cve-list data/CVE/list merge.list
[...]
AttributeError: 'NoneType' object has no attribute '_order'

Will fail. Even though this is not a standard situation maybe
merge-cve-list can account for this situation as well.

Emilio can you have a look?

Regards,
Salvatore