def build_cpe2pkg_query(vendor, product):
    """Build a query string for cpe2pkg tool.

    :param vendor: list[str], list of possible vendor strings
    :param product: list[str], list of possible product strings
    :return: str, query string for cpe2pkg
    """
    query_template = 'vendor:( {vendor} ) AND product:( {product} )'
    # query string cannot contain colons, replace them with spaces
    p = ' '.join(product).replace(':', ' ')
    v = ' '.join(vendor).replace(':', ' ')
    return query_template.format(vendor=v, product=p)