From: Devansh Patel <[email protected]> The current "avahi" mapping generates a vendor-wildcard product identity for the packaged Avahi source.
Use "avahi:avahi", which matches the active NVD dictionary CPE, NVD configuration criteria, and CNA affected data for the upstream project. This changes the generated identity from cpe:2.3:*:*:avahi:0.9~rc5:*:*:*:*:*:*:* to cpe:2.3:*:avahi:avahi:0.9~rc5:*:*:*:*:*:*:*, but sbom-cve-check 1.3.3 with the frozen 2026-08-10 databases has no current CVE report delta. Signed-off-by: Devansh Patel <[email protected]> --- meta/recipes-connectivity/avahi/avahi_0.9.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-connectivity/avahi/avahi_0.9.bb b/meta/recipes-connectivity/avahi/avahi_0.9.bb index 7cf0eb2b71..9397baa6ab 100644 --- a/meta/recipes-connectivity/avahi/avahi_0.9.bb +++ b/meta/recipes-connectivity/avahi/avahi_0.9.bb @@ -29,6 +29,8 @@ SRC_URI = "git://github.com/avahi/avahi;protocol=https;branch=master;tag=v0.9-rc PV = "0.9~rc5" SRCREV = "71b640e686964efb27cb708f4457ffaed183c319" +CVE_PRODUCT = "avahi:avahi" + GITHUB_BASE_URI = "https://github.com/avahi/avahi/releases/"; CVE_STATUS[CVE-2021-26720] = "not-applicable-platform: Issue only affects Debian/SUSE" -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244089): https://lists.openembedded.org/g/openembedded-core/message/244089 Mute This Topic: https://lists.openembedded.org/mt/120901045/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
