Debian VulnSrc does not properly handle Status for CVEs where a fix version has been set but the fixed package has not been released

[mpoindexter]

When the Debian metadata lists a fix version, the status is assumed to be "fixed", even if the package has not yet been released.

This is noticeable in CVE-2023-5981: https://security-tracker.debian.org/tracker/CVE-2023-5981 shows that the fix has not been released in "bullseye", but the Trivy DB shows fixed for this.

[wagde-orca]

if trivy relies on this feed https://security-tracker.debian.org/tracker/data/json... it won't havve these "fixed" issues...
this json feed has more accurate indications about the fixed versions.
I think trivy-db should use it instead of https://salsa.debian.org/security-tracker-team/security-tracker