From: Devansh Patel <[email protected]> The default product-only mapping generates a vendor-wildcard CPE. perl:perl is the active NVD dictionary CPE and configuration identity and also covers CNA affected data using vendor perl. larry_wall:perl preserves historical NVD configurations.
leont:perl covers authoritative CNA affected data for the same Perl/perl5 source, including CVE-2026-15534. It has no dictionary record. This changes the generated identities to three exact CPEs, but the frozen sbom-cve-check database leaves the 61-entry CVE report unchanged, with no current CVE delta. Signed-off-by: Devansh Patel <[email protected]> --- meta/recipes-devtools/perl/perl_5.44.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/perl/perl_5.44.0.bb b/meta/recipes-devtools/perl/perl_5.44.0.bb index ef76df7e0f..6cf88e7175 100644 --- a/meta/recipes-devtools/perl/perl_5.44.0.bb +++ b/meta/recipes-devtools/perl/perl_5.44.0.bb @@ -25,6 +25,8 @@ SRC_URI:append:class-target = " \ SRC_URI[perl.sha256sum] = "3b855066b92491cb40e86affb1ca57d1a388aa43e51b91c7806a32c2f65f96c3" +CVE_PRODUCT = "perl:perl larry_wall:perl leont:perl" + B = "${WORKDIR}/perl-${PV}-build" inherit upstream-version-is-even update-alternatives upstream-stable-release-point -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244322): https://lists.openembedded.org/g/openembedded-core/message/244322 Mute This Topic: https://lists.openembedded.org/mt/120933741/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
