From: Devansh Patel <[email protected]> The current product-only "lxml" mapping generates a wildcard-vendor product identity instead of the vendor assigned to the packaged project.
Use "lxml:lxml" for its exact NVD dictionary CPE, NVD configuration, and CNA affected-data identity. This changes the generated CPE, but the current CVE report is unchanged with sbom-cve-check 1.3.3 and the pinned NVD snapshot. Signed-off-by: Devansh Patel <[email protected]> --- meta/recipes-devtools/python/python3-lxml_6.1.1.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-devtools/python/python3-lxml_6.1.1.bb b/meta/recipes-devtools/python/python3-lxml_6.1.1.bb index 4ca7f08b39..da19905f89 100644 --- a/meta/recipes-devtools/python/python3-lxml_6.1.1.bb +++ b/meta/recipes-devtools/python/python3-lxml_6.1.1.bb @@ -39,6 +39,6 @@ BBCLASSEXTEND = "native nativesdk" RDEPENDS:${PN} += "libxml2 libxslt python3-compression" -CVE_PRODUCT = "lxml" +CVE_PRODUCT = "lxml:lxml" CLEANBROKEN = "1" -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243939): https://lists.openembedded.org/g/openembedded-core/message/243939 Mute This Topic: https://lists.openembedded.org/mt/120860724/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
