From: Devansh Patel <[email protected]> The default product-only mapping generates a vendor-wildcard CPE. xmlsoft:libxml2 is the active NVD dictionary CPE and configuration identity, while gnome:libxml2 covers authoritative CNA affected data for the same GNOME source, including two records exclusive to that backend identity.
This changes the generated identities to two exact CPEs, but the frozen sbom-cve-check database leaves the 112-entry CVE report unchanged, with no current CVE delta. Signed-off-by: Devansh Patel <[email protected]> --- meta/recipes-core/libxml/libxml2_2.15.3.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-core/libxml/libxml2_2.15.3.bb b/meta/recipes-core/libxml/libxml2_2.15.3.bb index 8b0ba29412..7ddba7429c 100644 --- a/meta/recipes-core/libxml/libxml2_2.15.3.bb +++ b/meta/recipes-core/libxml/libxml2_2.15.3.bb @@ -31,6 +31,8 @@ BINCONFIG = "${bindir}/xml2-config" inherit autotools pkgconfig binconfig-disabled ptest +CVE_PRODUCT = "xmlsoft:libxml2 gnome:libxml2" + # libxml2 publishes bugfix/security-only micro releases on its per-minor # release branches. inherit upstream-stable-release-point -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244324): https://lists.openembedded.org/g/openembedded-core/message/244324 Mute This Topic: https://lists.openembedded.org/mt/120933745/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
