From: "mark.yang" <[email protected]> The CERT-PL record for CVE-2026-42250 carries bzip2:bzip2 in its affected entry [1], which the bzip:bzip2 pin does not cover, so tools consuming CNA identities cannot connect the in-tree CVE-2026-42250.patch to the CVE. NVD has not analysed the entry yet and currently mirrors the same bzip2:bzip2 identity.
[1] https://www.cve.org/CVERecord?id=CVE-2026-42250 Signed-off-by: mark.yang <[email protected]> --- meta/recipes-extended/bzip2/bzip2_1.0.8.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-extended/bzip2/bzip2_1.0.8.bb b/meta/recipes-extended/bzip2/bzip2_1.0.8.bb index 39f0f6749d..3bc74d74aa 100644 --- a/meta/recipes-extended/bzip2/bzip2_1.0.8.bb +++ b/meta/recipes-extended/bzip2/bzip2_1.0.8.bb @@ -67,7 +67,7 @@ FILES:libbz2 = "${libdir}/lib*${SOLIBS}" RDEPENDS:${PN}-ptest += "make bash" -CVE_PRODUCT = "bzip:bzip2" +CVE_PRODUCT = "bzip:bzip2 bzip2:bzip2" PROVIDES:append:class-native = " bzip2-replacement-native" BBCLASSEXTEND = "native nativesdk"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241765): https://lists.openembedded.org/g/openembedded-core/message/241765 Mute This Topic: https://lists.openembedded.org/mt/120406462/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
