From: Devansh Patel <[email protected]> The default product-only mapping generates a vendor-wildcard CPE. NVD deprecates each openssh:openssh record in favor of openbsd:openssh, the active dictionary CPE and configuration identity for the packaged source. The deprecated spelling has no exclusive CVEs in the frozen backend.
This changes the generated product identity to the active exact CPE, but the frozen sbom-cve-check database leaves the 137-entry CVE report unchanged, with no current CVE delta. Signed-off-by: Devansh Patel <[email protected]> --- meta/recipes-connectivity/openssh/openssh_10.5p1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb index e4b6ddef9d..b0d7962063 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb @@ -43,6 +43,8 @@ PAM_SRC_URI = "file://sshd" inherit manpages useradd update-rc.d update-alternatives systemd +CVE_PRODUCT = "openbsd:openssh" + USERADD_PACKAGES = "${PN}-sshd" USERADD_PARAM:${PN}-sshd = "--system --no-create-home --home-dir /var/run/sshd --shell /bin/false --user-group sshd" INITSCRIPT_PACKAGES = "${PN}-sshd" -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244382): https://lists.openembedded.org/g/openembedded-core/message/244382 Mute This Topic: https://lists.openembedded.org/mt/120934128/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
