I have noticed that right after merging this commit, 9 historical CVEs were newly reported in Yocto master metrics. (which is higher number than what was resolved by this update, which was 3 or 4).
All are caused by "no-version-ranges": gnutls CVE-2023-0361 glibc CVE-2011-0536 glibc CVE-2025-0577 (was "Fixed from version >2.40-17.fc41") ovmf CVE-2017-5731 ovmf CVE-2019-14584 pulseaudio CVE-2020-15710 pulseaudio CVE-2020-16123 openssl CVE-2015-3216 ppp CVE-2020-15704 (was "Fixed from version 2.4.7-2\\+2ubuntu1.3") I guess the two above which I extra commented are something which in theory could be looked at and handled in code? The rest are unfortunately all data source issues. I'll send annotations for all anyway... Peter > -----Original Message----- > From: Benjamin Robin (Schneider Electric) <[email protected]> > Sent: Monday, August 3, 2026 11:26 AM > To: [email protected] > Cc: [email protected]; Marko, Peter (FT D EU SK BFS1) > <[email protected]>; [email protected]; mathieu.dubois- > [email protected]; [email protected]; [email protected]; > [email protected]; Benjamin Robin (Schneider Electric) > <[email protected]> > Subject: [PATCH 0/3] sbom-cve-check: Update to version 1.3.3 and update CVE > databases > > This series update sbom-cve-check to the latest release. > This release of sbom-cve-check addresses various fixes and improvements > as detailed in the changelog [1] > > This series also updates the sbom-cve-check-update-* recipes to fetch > a more recent version of the CVE databases. > > [1] https://github.com/bootlin/sbom-cve-check/blob/main/CHANGELOG.md#v133 > > Signed-off-by: Benjamin Robin (Schneider Electric) > <[email protected]> > --- > Benjamin Robin (Schneider Electric) (3): > python3-sbom-cve-check: update to version 1.3.3 > sbom-cve-check-update-cvelist-native: update to version 2026-08-03 > sbom-cve-check-update-nvd-native: update to version 2026.08.03-000011 > > ...{python3-sbom-cve-check_1.3.2.bb => python3-sbom-cve-check_1.3.3.bb} | 2 > +- > ...2026-07-23.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} | 2 > +- > ...-000007.bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} | 2 > +- > 3 files changed, 3 insertions(+), 3 deletions(-) > --- > base-commit: 6a91494f29a1f9da28280bc93771714c4545da46 > change-id: 20260803-update-sbom-cve-check-1-3-3-d9347fb56ae6 > > Best regards, > -- > Benjamin Robin (Schneider Electric) <[email protected]>
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242850): https://lists.openembedded.org/g/openembedded-core/message/242850 Mute This Topic: https://lists.openembedded.org/mt/120574382/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
